Slashdot Mirror

prostoalex writes "A lot of avid PC users got first introduced to the computers through games. Some later turned their hobbies into full-time jobs. The ExtremeTech series of Wiley books aims at the readers who are curious about technology and are willing to dedicate some time to personal to projects that educate and develop skills. Before this review starts reading as a press release, I will throw in a link to my review of another title, Linux Toys, the book that pioneered the series." Read on for Alex's review of Wi-Fi Toys. Wi-Fi Toys author Mike Outmesguine pages 408 publisher Wiley rating 9 reviewer Alex Moskalyuk ISBN 0764558943 summary 15 cool wireless projects for home, office and entertainment

Wi-Fi Toys by Mike Outmesguine offers 15 projects for radio enthusiasts and those, who have never dealt with wireless networking beyond buying an 802.11 access point at local electronics store. Former US AirForce and National Guard engineer, the author is currently running a technology services company.

Assume for a minute that you have had limited experience with wireless technologies, but are young, ambitious, and eager to dive into the deep sea of wireless data. What kind of projects would be fun to play with? What kind of projects would be educational as well as useful? Probably improving the reception via various antenna hacks would be a cool thing to do, and improving access point to increase coverage would be another way to wow the neighbors with your wireless skills. Discovering other people's networks and wardriving is a must for any wireless security beginner. The author dedicates the first three parts of the book (table of contents here) to building antennas, wardriving and hacking access points. Yes, the book requires toying with hardware and occasionally being outside in the fresh air.

The first chapter, Building Your Own Wi-Fi Antenna Cable, is available online in PDF format and it talks about building your own antenna cable. The rest of the chapters in Part 1 take the reader through building a paperclip antenna, creating a tin can antenna, and modifying the existing access point with a high gain antenna.

Probably there are some people that read the last sentence and asked themselves, "So what is a high gain antenna?" Which brings us to the next point - the readability of the book. Outmesguine did a really nice job outlining the projects step by step and supplying all the major steps with the photos. The pictures are black-and-white, and so are the diagrams. Overall the pictures turned out nicely, but I wish the author had the color version on the Web site, since some of the images (like on page 79), displaying computer graphics on dark backgrounds, did not turn out very detailed. Everything essential to the project is there, but still, color photos and screenshots would have made the difference in some cases.

The author does a good job of explaining terminology before launching into the project. Where needed, Mike Outmesguine provides helpful diagrams, that any radio amateur is probably already aware of, but they still make a nice and readable book for the rest of us. Also, the goal of the chapters is not just build the toy and get done with it as soon as possible. For example, in chapter 4 when talking about modifying the existing access point, the author understands that the only reason you want to do that is to increase the WiFi coverage in your house. So a few pages are dedicated to propagation losses, interference and everything radio-related that the reader needs to take into account before strengthening the access point with a high-gain antenna.

Chapter 14 is probably the coolest in the book, as it talks about creating a car-to-car wireless link for the purpose of... videoconferencing involving two Webcams and Microsoft NetMeeting. Naturally, this is not for driver-to-driver communication, but in case you've got two cars on the road trip, the passengers now can use their WiFi-enabled laptops (and by now everyone should have one) to launch a video conference.

Overall the book reads great, even if you're not serious about doing some projects, it's still fun to follow photographs and see what Mike and the contributors have done in terms of wireless projects. Each chapter is presented as a single project, so with the exception of terminology knowledge there's no preceding knowledge that needs to be there, so one could theoretically start with a digital picture frame (Chapter 15) that hangs on the wall, downloading the pictures via the wireless link and playing occasional videos.

Overall, this is an interesting book to read, and if you've been looking for simple and intermediate projects involving radio technologies and WiFi, the Wi-Fi Toys is packed with useful information.

You can purchase Wi-Fi Toys from bn.com. Slashdot welcomes readers' book reviews. To see your own review here, carefully read the book review guidelines, then visit the submission page.

Sarusa writes "Stop me if you've heard this one: Bright, innocent, bushytailed overachiever geek, inexorably crushed by the harsh realities of corporate America, turns into paranoid shaven-headed slacker (and Church of the Subgenius minister) who sees conspiracy theories under every rock. 'Heard it?' you sneer, 'I've lived it!' So why would you want to read a book about it? Cube Farm by Bill Blunden proves that if nothing else, you can always serve as a bad example." Read on for the rest of Sarusa's review. Cube Farm author Bill Blunden pages 150 publisher Apress rating 7 reviewer Sarusa ISBN 1590594037 summary Welcome to Hell, here's your cube.

The book chronicles Blunden's travails as a fresh Cornell grad finding out his degree is useless. After waiting tables, he discovers Java is hot, and gets a job in the incredibly dysfunctional R&D department of Lawson Software, one of those companies that makes horribly dull but necessary business software. Young Blunden is shunted from one doomed project to the next as internal divisions compete with each other (and internally) for territory. The code base is millions of lines of ancient K&R C with all the comments stripped out (!) for speed of compilation. Only a few people understand the entire system to any degree, and these Illuminati crush any attempt to create or disseminate any documentation since that would erode their power base. Any projects that might threaten their monopoly are dispatched by the simple expedient of not responding to any emails or phone calls or attending meetings.

Cube Farm is written in a conversational, semi-edgy style that I found very easy to read, though occasionally annoying when it gets too hip. The subject is technical, but the theme is purely human foible, and Blunden makes an effort to make things understandable even by the non-geeky. So you don't have to be a nerd to understand the book - it would sure help you appreciate it, though.

Important characters are assigned descriptive names such as the Puppet Master, the Godfather, the Wax Master, Mike and Ike, and the Mad Hungarian. This may sound a bit cheap, but works well and makes it easy to keep track of the defectis personae. Everything is well partitioned, and Dance of Death woodcuts enliven the pages.

The obvious question, Why you would read something so horribly depressing? There are only negative lessons to be learned here. Well, in many ways Cube Farm is the informal, nasty version of what you'd get by reading books like Death March (Yourdon, 2003 2nd ed), Herding Cats (Rainwater, 2002), and Software Runaways (Glass, 1997). You can learn a lot from a bad example, like what it means if they won't say Yes or No. Perhaps it'll make you feel better about your own company, which is probably not quite this screwed up. Or there's always good ol' schadenfreude.

Would you give this book to an eager young programmer? Either it would be a bit like taking a sledgehammer to a kitten, or (more likely) it would just all cascade off, unheeded -- "obviously, this could never happen to me." For everyone else, if you've had at least one job or failed project under your belt you might find this horrifically fascinating, similar to watching Repligator. It might help with your next (knock on wood) fine project. Finally, it's a quick read, so I felt my time was well (or at least enjoyably) spent.

You can purchase Cube Farm from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, carefully read the book review guidelines, then visit the submission page.

dba599 (Mark McKinnon) submits this review of Harlan Carvey's Windows Forensics and Incident Recovery, writing "This book takes an unusual approach to computer forensics in that it deals only with live analysis of the system: the compromised computer is left powered on and everything is running. (Compare to a dead analysis, for which the computer is powered off and the hard drive's contents are then analyzed.)" Read on for the rest of McKinnon's review. Windows Forensics and Incident Recovery author Harlan Carvey pages 460 publisher Addison Wesley rating 9 reviewer Mark McKinnon ISBN 0321200985 summary Forensic analysis and incident recovery on a live Microsoft Windows is explained for the system administrator, security administrator and knowledgeable home user.

The intended audience, according to the author, is "anyone with an interest in Windows security, which includes Windows system and security administrators, consultants, incident response team members, students and even home users." The author assumes the reader is familiar with basic networking (including TCP/IP) and has some Windows administration skills. Some programming ability, though not actually required, will help out greatly with reading and understanding the many examples provided, and will let you make your own modifications (this is encouraged by the author throughout the book).

The chapter on data hiding was a real eye-opener -- it's amazing the things Microsoft has implemented as part of the operating system (and included applications) that can be used to hide things. Discovering the hidden information is talked about, as well how it is hidden. Sample topics include file attributes, alternate data streams, OLE and stenography. This is an excellent chapter with many examples; I found myself stopping after each subject to try out each of the discussed techniques.

The next chapter delves into incident preparation. Carvey addresses some of the things that administrators can do to harden their systems. He goes over the application of security policies in general, as well as intelligent assignment of file permissions. He then covers Windows File Protection and how it is implemented, and includes a perl script to implement your own file watcher. He touches briefly on patch management and anti-virus programs, then moves into monitoring. He provides quite a few scripts, and discusses other means by which you can monitor your system.

The next chapter describes tools that can be used in incident response. This chapter has quite a lot of information and took me the longest to get through, because of all the tools mentioned that I had to download and check while I was reading the book. Carvey uses a mixture of his own perl scripts and programs that can be downloaded from places like Sysinternals, Foundstone, DiamondCS and others. All of the tools used are open source (or are at least freely available). That equips the reader with a low-cost toolkit, especially important to the home user or small business owner who cannot afford to buy the commercial equivalent. Carvey does acknowledge, though, that there are quite a few commercial tools with great functionality out there.

The first part of the incident-response tools chapter deals with the collection of volatile information (processes, services, etc.); this is a vital part of live analysis. The second part deals with the collection of non-volatile information (the content of the Windows registry, file MAC times and hashes, etc.) and tools for analyzing files. Carvey also shows how some of the tools complement each other, and that there is not one almighty tool that will find all the data you need. (This is also proven by example in a later chapter when he talks about rootkits.)

The next chapter deals with developing a security methodology, and it's handled differently than in most books: the author presents the material as a series of dreams that a Windows system administrator has, showing how an individual can come up with and fine tune a methodology as incidents happen. Carvey has used this approach before in a series of articles entitled "No Stone Unturned" for SecurityFocus.com, and the creative approach appeals to me. As he moves from dream to dream, you can relate to the admin's circumstances (and mistakes), and how be and becomes better at responding to different incidents.

The next chapter talks about what to usefully look for with the tools the book has introduced. It discusses infection vectors, types of malware and rootkits, and demonstrates tools and techniques for detecting them. This is where the author makes a clear point of why you would need to run several different tools, even if some overlap. His example uses an installed rootkit; running a particular program from a previous chapter, he shows that it fails to find that anything untoward is running -- it takes another program from the same chapter to actually reveal the rootkit's presence. By cross referencing the output for both programs, you can see why you should run more then one type of analysis tool for certain areas to make sure you are not missing anything.

Finally, the author dedicates an entire chapter to his own Forensic Server Project, a two-pronged approach to live forensic analysis which uses two machines simultaneously. The first piece, the Forensic Server Module, is the listener software; this runs on a clean PC where the data will be sent from the compromised system. The other piece, called the First Responder Utility, runs several of the programs and scripts from the incident tools chapter on the compromised system . After installing everything needed for both parts of this system, I followed the author's instructions on how to run it. What a slick tool! I ran it from a couple of PCs on my home network and was able to get a lot of the information that was described in the book as well as hash values for each log file that was produced, and a general log of everything the First Responder Unit did. The whole principle of this is that when you have an incident there will be very little interaction with the compromised system, since everything is scripted to begin with.

The framework that this software constitutes is very flexible. I was able to add two new features to the Forensic Server Module and the First Responder Utility with very little code. The first addition I made was to mark all the logs as read-only on the file system after they were written from the Forensic Server module. The next addition I made was to add a perl script to scan the c:\ drive of the PC that the First Responder Utility was running on. After I made both additions, I tested everything out, and it worked great. I had my extra log files and they were all read-only. My hat goes off to the author for coming up with and including this in the book, a really nice piece of software.

You can purchase Windows Forensics and Incident Recovery from bn.com. Slashdot welcomes readers' book reviews. To see your own review here, carefully read the book review guidelines, then visit the submission page.

I spent several hours this week poring through Gordon Laing's beautiful book Digital Retro , and it's one I'm sure to return to at odd moments, the same way I like to flip through old copies of The Whole Earth Catalog. Digital Retro represents years of research into a 14-year stretch of personal computing history, distilling that effort into a work that is graphically appealing, but also an informative, informal historical look at the machines it celebrates (all 40 of them). Depending in part on what year you were born (and at what age computers entered the picture) you may recognize most of these machines, or only a few -- it's an equally fun read either way. Read on for the rest of my review. Digital Retro: The Evolution and Design of the Personal Computer author Gordon Laing pages 192 publisher Sybex rating 9 reviewer timothy ISBN 078214330X summary Eye-candy mixed with a good dose of history, perfect for the library of a modern techno fetishist.

Digital Retro is about personal-use (though not necessarily home-use) machines: there are no PDP11's or mainframes represented, nor devices like the DECWriter, which gave computer access to individuals but required a mainframe or minicomputer in the background. The book covers hardware that was sold at retail (barring the Altair and a few other mail-order-only kit machines), at prices householders could afford for their hobby use, including gaming, or that businesses could afford for their executives and other knowledge workers. All the same, the prices are sure to make you calculate every so often things like how many BogoMIPS could be had today for the $3,250 that a 613KHz HP-85 cost in 1980 -- and those are 1980 dollars. Early adoption has its risks as well as its rewards.

From iconic to obscure

Too many computer makers (and even more computers) came and went in the decade-plus spanned by this book for it to cover all of them; Laing's list of chosen machines is representative rather than comprehensive. More than 30 of the machines came from the The Museum of Computing in Swindon, and despite their age most look like they just popped out of their delivery boxes.

Digital Retro's central section starts out with a MITS Altair, the machine generally considered the first computer practical for a hobbyist to buy. (And the buyer had to be a dedicated hobbyist; the Altair was sold in kit form for home-assembly, and its display was a series of winking lights, its input facilities a row of toggle switches.) "Practical" in the case of the Altair meant affordable and accessible -- there wasn't much of a practical nature for the solder-weary user to actually do with an Altair once it was assembled; the chicken and the egg of availability and usefulness were still fighting it out at this point in computer history. The Altair also has another interesting spot in personal computer history: it provided the first platform for an operating system from Bill Gates and Paul Allen.

(There's an Apple I in homemade wooden raiment snuck into the book's introduction -- an Apple I proved too difficult to find for a full writeup and photoshoot, however, and no Apple II clones made the cut.)

From the Altair to the NeXT cube which caps off the Digital Retro's collection, the 38 machines (and in some cases machine families, such as the MSX computers mentioned below) are presented in order of appearance. The book presents too many interesting machines to give each a proper summary, but here are a few to whet your appetite:

• The Sharp MZ-80K (December, 1978) -- with its 10" screen and built-in drive (tape drive, though -- the 3.5" diskette wasn't invented yet), the MZ-80K seems ahead of its time; the choice of a Zilog Z80 processor didn't do much for its longevity as a business system, though; Z80 systems were soon eclipsed by other choices.
• The GCE/MB Vectrex (June, 1982) -- the only video game system I really wanted as a kid, and one of the seeming few I've never encountered used in thrift stores. Bright vector graphics, built-in screen and a quality joystick gave it the same kind of appeal that the arcade-console versions of Asteroids and Battlezone had for me.
• The Jupiter ACE (September, 1982) -- an impossibly simply looking machine, a terraced slab of white plastic with a minimalist typewriter layout (just 40 grey keys). The ACE was aimed at programmer-hobbyists, though, like the similar-looking Sinclair ZX-80, but the ACE ran a version of FORTH and had raised keys rather than the Sinclair's flat membrane.
• The Sinclair QL (January, 1984) -- one of which, Laing notes, was Linus Torvalds' machine (between a VIC-20 and the 386 with which Torvalds started a quaint Unix-like operating system).

Game consoles are also well represented; six dedicated game machines, starting with the Atari VCS (1977) are included; a whole book could be devoted to consoles, but the ones chosen for Digital Retro (besides Atari and the Vectrex mentioned above, the others come from Colleco, Mattel, Nintendo, Sega) are an eclectic bunch, and a good use of space.

Because Laing is based in the UK, the book features quite a few machines that most Americans have probably never encountered in person, like the Acorn Atom, the Dragon 32 (a Welsh-made near-clone of the Tandy TRS-80) and the Grundy NewBrain. If this book had been an American production, many of these UK-made machines might have gone overlooked.

No incentive to work together

In the wilder days of the personal computer's adolescence, the quest for compatibility and standardization among machines was anything but a top priority -- and when it was a factor at all, it was usually about software compatibility between sibling computers (like the TI 99/4 and its 99/4A successor) or at most within a single model line.

As the book's back cover points out, "Compatibility? Forget it! Each of these computers was its own machine and had no intention of talking to anything else." An overstatement, but not much of one.

Laing covers an intriguing exception to this one-off philosophy, a multi-manufacturer line of machines that appeared in 1983 (starting a 5-year run), sharing a Zilog processor and adherence to an early Microsoft attempt at standardization called MSX. Mostly-compatible machines were launched by JVC, Hitachi, Sony (a name that didn't pop up in the American computer market for quite a few more years) and 18 other Japanese manufacturers as well as SpectraVideo, the only non-Japanese maker. Each manufacturer tweaked their entries in the line to distinguish themselves, adding features like (in Pioneer's case) control of laser-disc players. The differences soon rendered the attempt at standardization moot, and the MSX standard fell from grace. And if you're wondering what MSX stands for, you'll have to choose from the three possibilities listed: I prefer "Matsushita Sony X, where X could stand for any other company."

Get a good look

The photographs dominate; they give external views of each machine from several angles, over two two-page spreads apiece. (The pictures are well-chosen, but not exhaustive: there are no shots from the underside, and in only a few cases are internals exposed. Don't expect to replicate the innards of an Altair from the photographs.) You can make out what sort of ports each device provided, see what kind of display it used in most cases, and look at the included input peripherals. (Many of these machines, though, were hooked to televisions, and only the main unit and its input devices are pictured.)

Speaking of peripherals, one of the nice things about a photo book like this is for the mugshots it provides of unique physical arrangements tried by computer manufacturers: the integrated tape drive of the black-clad Amstrad CPC-464 (which sits to the right of the keyboard) makes it one of the most interesting to me; it sure is a lot neater arrangement than the cassette drive linked messily to the family C64 in the early '80s.

Besides the photographs, though, the spreads devoted to each computer provide a compact history of the machine, list its country of origin, and give a rundown of the most important specs (processor type and available I/O ports).

Practical Upshot

Digital Retro is a coffee-table book which happens to have quite a bit of interesting history, not a deep historical text. For each machine displayed, though, a chunk of text titled "What happened next" gives an idea of what developments each one led to (or prevented); some of these are only a paragraph or two, others are mini-essays in themselves. If you crave more technical and historical details, Laing's book makes an excellent companion volume to narrative-centric books which cover the same period of computer history though, like Fire in the Valley and Steven Levy's Hackers. It's a perfect way to appreciate the aesthetic appeal (and exuberant variety) of personal computers from the mid '70s to the late '80s.

You can purchase Digital Retro from bn.com. Slashdot welcomes readers' book reviews. To see your own review here, carefully read the book review guidelines, then visit the submission page.

Ben Rothke writes "Outsourcing information technology has been the rage over the last decade, to the degree that there are not enough bodies in Bangalore and Mumbai for companies such as Wipro, Infosys and Tata to hire. The problem is that many companies have gone down the road of outsourcing without performing the proper due diligence. Rather than saving money, many organizations have found that outsourcing ultimately is much more expensive than keeping security functions in-house, in addition to other negative consequences." Read on for the rest of Rothke's review of Outsourcing Information Security. Outsourcing Information Security author C. Warren Axelrod pages 248 publisher Artech House rating 10 reviewer Ben Rothke ISBN 1580535313 summary Examines security risks related to IT security outsourcing

When it comes to the outsourcing of information security functions specifically, the situation is even worse. Far too few organizations know the inherent risks involved with outsourcing security, and don't properly investigate what they are getting into. The same company that makes it nearly impossible for an employee to enter the office supply closet to get much needed toner cartridge will outsource their intrusion detection, email and firewall systems without a blink.

One of the many reasons companies turn to security outsourcing and managed security services providers (MSSP) is to use their limited internal security staff for more interesting areas such as web development, VPN and e-commerce applications. They will then outsource the boring activities such as firewall and IDS monitoring and maintenance to a MSSP.

Given that activities such as firewall monitoring and administering an IDS in large enterprise requires 24/7 support, it is not unusual for a company to want to outsource such activities; monitoring and administering are not core functions of most organizations.

The trouble comes from the lack of due care often given to choosing a MSSP. With that, Outsourcing Information Security is a long-overdue book that asks the questions that are necessary before an organization decides to outsource any information security function.

The author's general tone is against the outsourcing of information security; but provides readers with the various benefits and risks involved in outsourcing security, and let's them ultimate decide if outsourcing security is right for their organization. It is the reader who must define, evaluate and manage those risks and determine if outsourcing is a viable solution. These include technology, business and legal risks.

The book comprises nine chapters and three appendices totaling a bit under 250 pages. The first two chapters provide a good introduction to and overview of outsourcing and information security, and the associated security risks.

Chapter 3 details various reasons why outsourcing information security makes sense. The chapter includes various tables and references to the many reasons why a company would want to outsource security.

Chapter 4 takes the other side and analyzes the risks of outsourcing. The chapter details the traditional risks, in addition to other factors such as hidden costs, broken promises, phantom benefits and more. The book shows that while many organizations hand over information security responsibility to their MSSP, when things go wrong, they can't effectively blame the MSSP. When things go wrong -- and they will -- all of the fingers in the world can be pointed at the MSSP, but the ultimate responsibility falls on the organization itself. With outsourced security, if something goes wrong, those fingers will point back to the company's security manager, not the incompetent firewall administrator in Bangalore.

The chapter provides a balanced look at the risk of outsourcing, and while calm in its overall approach, the chapter should at least make the person considering outsourcing information security think twice. In fact, the author concludes the chapter by stating "when all of the risks of outsourcing are considered, one wonders how anyone ever makes the decision to use a third party." Nonetheless, there is plenty of evidence that many security activities are indeed outsourced to MSSP, and are often satisfactory from both the buyer's and seller's perspective.

Chapters 5 and 6 provide a thorough summary of the costs and benefits of outsourcing, and provides a method with which to categorize them. The chapter is well suited for a CFO with its discussion of direct vs. indirect costs, controllable vs. non-controllable costs, and much more. These two chapters show that creating meaningful financial numbers to see if outsourcing makes financial sense is not such an easy task. It is important to understand that outsourcing sometimes makes financial sense, but certainly not all the time. For those organizations that don't crunch the numbers seriously at the beginning, these costs can later come back to haunt them in a big way.

Chapters 7 and 8 detail the processes involved in commencing an outsourcing project, from requirements gathering to placing policy against the outsourced company. A mistake many organizations make is failure to ensure that the MSSP is abiding by the client's information security policies, rather than their own.

Similarly, one of the most overlooked areas of outsourcing information security functionality is regulation. A U.S. company may be under numerous regulations, from HIPAA to Sarbanes-Oxley, GLBA, SEC and more; when they outsource their security functionality, the remote technician may not be under the jurisdiction of the SEC; but the corporate data still must be protected according to those regulations.

The main part of the book concludes with chapter 9, which provides a 20-step process to determine if an outsourced security solution is appropriate. In seven pages, the author specifies the various events, tasks and steps that make up the typical outsourcing project.

Appendix A provides a breakdown of the various services that can be outsourced, with Appendices B & C providing brief histories of IT Outsourcing and Information Security.

The only downside to the book is its $85.00 price, which is at the high-end for technology and business books. While the price is high, the book is a huge value for anyone considering outsourcing security. The book asks the questions that are often never asked, and details how the outsourcing of information security is not the slam-dunk that the MSSPs often portray it to be.

For those who know what their security issues are and look to outsource their security functionality to a trusted MSSP, Outsourcing Information Security shows how it can be done. On the other side, for those who are drunk with the panacea that outsourcing security is supposed to provide, Outsourcing Information Security will be a sobering wake-up call.

You can purchase Outsourcing Information Security from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, carefully read the book review guidelines, then visit the submission page.

Richard Rodger writes with a review of Godfrey Nolan's Decompiling Java. "I've just put this book down after reading it right through non-stop for four days. I haven't done that with a technical book since Learning Perl. Most techie book these days are quickie grab-bags, and you end up paying for a lot of dead trees that you aren't interested in." Read on for the rest of his review. Decompiling Java author Godfrey Nolan pages 264 publisher apress rating 8/10 reviewer Richard Rodger ISBN 1590592654 summary Learn how decompilation works in order to properly protect your intellectual property.

If you are interested in Decompiling Java, then this book tell you exactly how to do that. There's no fluff and every chapter counts. I can safely concur that Fiachra's observations are indeed correct. You'd better be prepared for some serious hard core details, but then that's what you'd paid for. It is really great to read a book that doesn't end each chapter with a few links to the real material because the author couldn't be bothered to write it up.

So what do you get? As a battle-hardened Java coder of not a few years programming, I wanted to find out about the gory details of bytecodes and how to get at them. Now it's a subject I always knew I should know about, but never took the time to read up on it. Decompiling Java puts all that knowledge into one place.

Here's a quick run-through of the chapters so you know what you're getting:

Ch.1 Introduction
Decompilation isn't just another coding tool - there are other, real world issues like ending up in jail to think about. Godfrey proposes a sort of code-of-honour for decompilers. This book could so easily have been positioned for the fr33ky kod3r skript kiddie market, and I'm glad that the author and publishers took a mature and sensible approach to the subject. I have had to decompile purchased code because of bugs and I'm glad that someone took the time to think about an ethical framework for doing this.

Ch.2 Ghost in the Machine
A good and solid introduction to the JVM and the classfile format. If you're in the market for this book, you probably already know most of this, but a refresher course is always good. For me, it definitely sorted out a lot on internal hand-waving on the subject. Just remember kids, the only thing to fear is fear itself - it's only binary data after all.

Ch.3 Tools of the Trade
Although the author builds his only decompiler later in the book, it nice to get a chapter devoted to the existing toolset and the Java decompiler scene.

Ch. 4 Protecting your Source
For the honest developer, knowing how to decompile code is more about protecting your own source code than breaking someone else's (who wants to read other people's smelly code anyway!). This chapter is one of the most directly practical. I had always assumed that obfuscation was a magic fix that I could apply if necessary. In reality, good obfuscation is just like good encryption (that is, uncommon, difficult to verify, and still subject to lateral attacks). Even compiled bytecode has relatively low entropy, so the value of obfuscation must be considered carefully.

Ch.5 Decompiler Design
This is were it starts getting a wee bit technical. Decompilation, as you can imagine, is a bit of a black art, and there are many ways of doing it. Some of them involve scary maths and some involve scary coding and the rest both. But that's why you don't meet many people who can write decompilers. Godfrey does a great job of taking you on a practical run through this fog of decompilers. At the end of this chapter you will be able to decide for yourself what approach is best suited to your problem domain. Again, this material can be challenging but it's like boot camp: You just gotta.

Ch.6 Decompiler Implementation
If the previous chapter hurt your brain and scared you silly then this chapter will have you weeping for joy. The author takes a practical, effective, and most importantly, understandable approach to actually implementing a compiler. Now, as he freely admits, his design may encounter difficulties with edge effects and infrequently used idioms, but it will take you to the point where you can solve them yourself. I really had to smile at how simple and effective the approach taken here is - instead of the expected multiple passes and mind bending parse tree manipulation, we have a single-pass, source-generating decompiler for Java. You won't follow it all first time, but it does work and you can verify it for yourself. Like I said at the start, you don't get that empty feeling from this book, and this chapter is pretty much why. I bought a book about decompiling Java, and now I can.

Ch.7 Case Studies
This chapter addresses the "why" of decompiling, returning again to the moral questions raised at the start. It's more food for thought than prescriptive preaching though, which again is refreshing. I have admit to dipping into this chapter while reading the rest of the book - the human interest angle always works a treat!

Of course, no book is perfect. What I think could have helped a bit overall would have been a introductory chapter to bytecode. But it's not a great loss and bytecode is actually pretty simple once you get your head around it. Still it might have lessened the learning curve somewhat.

Decompiling Java is a great addition to that section of your bookshelf dedicated to serious books that will be around for a while. The JVM specification and Java bytecode are not going to change that much, so this book is something you'll be able to use for a long time. Personally the best thing about this book for me was that it took me to the next level. Not many books can do this. As a working coder, I pretty much put things like decompilation into the "too hard, just for academics, and I could never grok it", category. It's great when a book comes along that can can you out of that comfort zone.

You can purchase Decompiling Java from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, carefully read the book review guidelines, then visit the submission page.

Anton Chuvakin writes "I've read some pretty bad books on penetration testing; till now, nobody seemed to get this fun subject right! Good news - this time somebody did. Assessing Network Security comes to us direct from the bunkers of Redmond. Written by three Microsoft security researchers, the book provides a great overview as well as an in-depth coverage of assessing security via penetration testing ('pentesting'), scanning, IT audit and other means." Read on for the rest of Chuvakin's review of the book. Assessing Network Security author Ben Smith, David LeBlanc, Kevin Lam pages 592 publisher Microsoft Press rating 8/10 reviewer Anton Chuvakin ISBN 0735620334 summary Great pentesting book

Assessing Network Security starts with a nice overview of key principles of security (definitely not news for industry practitioners, but nice anyway), and then goes on to defines vulnerability assessment, penetration testing and security audit. A critically important section on reporting the findings is also nicely written, and shows that the authors are knowledgeable, and interested in showing a complete security process rather than just the looking-for-leaks part.

The authors then go into developing and maintaining pentesting skills, including advice on choosing training and resources (nice for those starting in the field). The actual pentesting process is split into non-intrusive (combining the usual "intelligence gathering" with port scans, sweeps and various host queries) and intrusive tests (such as running a vulnerability scanner, brute-forcing passwords, DoS testing and others). Some entries seem to belong in both categories (such as sniffing) but are placed into the intrusive section, for whatever reason. Up-to-date content (wireless, Bluetooth and web assessment, for instance) is well represented.

The authors also include a fairly insightful social engineering testing section (touching on dumpster diving and other non-network assessment methods). My favorite chapter was the one presenting various case studies - examples of specific threats/tests against Web, email, VPN and domain controller systems.

Among other features that I liked in Assessing Network Security were 'notes from the field' sidebars with fun stories related by authors, and FAQs at the end of each section. On the down side, the book is somewhat Windows-focused (although it is amazingly vendor-neutral in most respects, considering the source). The book is also somewhat dry, although the sidebars provide some needed relief when the text gets too process-oriented at times.

Assessing Network Security is largely about methodology, but I'd have preferred to see a bit more technical content, since it is a 600-page volume. I think the checklists present in the Appendix are a great step in that direction.

Overall, I enjoyed the book and think it is both a great guide and a reference for most security professionals, especially for those starting to be involved with penetration testing.

Anton Chuvakin, Ph.D., GCIA, GCIH is a Security Strategist with a security information management company and maintains the security portal info-secure.org. He wrote Security Warrior and contributed to Know Your Enemy, 2nd Edition . You can purchase Assessing Network Security from bn.com. Slashdot welcomes readers' book reviews. To see your own review here, carefully read the book review guidelines, then visit the submission page.

Alex Moskalyuk writes "When reading about the computer crimes, we are usually told the victim's point of view. We learn about the thieves stealing thousands of credit card numbers and identity theft victims, who lost their credit history with the wallet they lost at the mall. But how do criminals ever get caught? Who performs the forensic search and participates in sting operations?" Read on for Alex's review of High-Tech Crimes Revealed, which addresses these questions. High-Tech Crimes Revealed author Steven Branigan pages 448 publisher Addison-Wesley rating 9 reviewer Alex Moskalyuk ISBN 0321218736 summary Cyberwar Stories from the Digital Front Steven Branigan is a cop, a system administrator, an Internet security consultant and network security researcher. Ex-employee of Bell Labs now is a founder of a company that "specializes in solving leading edge computer and network security issues."

The book is a collection of high-tech investigations performed by Branigan in cooperation with the police force and sometimes the Feds. Generally Branigan would be involved in forensic research of the evidence and be on the scene as the "computer expert" that cops would refer to when dealing with cybercrime.

Twelve chapters take us through some of the high-tech crimes that the Western world faces today. An attack on the telephone network (unauthorized access to the switches), backdoors left at the former employer, hacking into university networks and the well-publicized identity theft are all covered in the book. Branigan brings up anecdotal evidence from his own career, describes some of his cases in great detail, and provides advice for practitioners in the forensics field.

The author is a Linux/Unix/BSD guru, and he shares his methods for retrieving telltale data from the equipment that the criminals leave behind. He also talks about the generic problems that law enforcement faces when investigating a high-tech crime - how do you obtain a warrant, what's a proper way to conduct searches, how do you work with the confiscated computer so that all the data is left intact?

However, don't expect some secrets to pop-up in regards to data collection - Branigan uses commonly available Linux tools like grep for searching the suspect's hard drive for needed data. More often that not, the investigator, it turns out, depends on his experience, not the book knowledge - one has to recognize the network sniffer log when they see it, and be capable of recognizing the tools freely downloadable from security sites.

Thus it's not surprising that there are some chapters in the book dedicated purely to the author's experience in the field. He describes working with the hackers who have been arrested, discusses how rootkits are spread around, discusses the motivation behind the network attacks (it's not always money, to say the least), describes the structure of a hacking ring and their potential revenues and also talks about ways to unravel the networks. His motto? No crime is too small, and sometimes things so little as missing the rent can lead to more discoveries and tie-ins into bigger crimes.

If you're thinking about becoming a security consultant, a law enforcement officer or just a sysadmin with better than average knowledge of security, this book is an interesting read. It's not a textbook, nor it is technical by nature. It reads more like a detective story, except the stories are real, the culprits are real and so are the victims. One can read the book on two levels - as a forensics tutorial (however, don't expect extended technical tutorials and tools overview) or as an autobiography of a cop, who had to deal with high-tech crimes all his life. If you liked Art of Deception or Hacking: The Art of Exploitation , this title would be a perfect complement.

Chapter 3, If Only He Had Paid the Rent, is available online from Addison-Wesley.

Alex enjoys reading programming, technology and business tech books in his spare time. He also keeps a list of free books available on the Internet for tech readers on a budget. You can purchase High-Tech Crimes Revealed from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, carefully read the book review guidelines, then visit the submission page.

John Suda writes "There are more new books being published about PHP than you can shake a joystick at. PHP (along with program friends - MySQL and Apache) has become very popular among developers and web designers, and for good reason. As a programming language, it is particularly suited to web development projects, while being relatively easy to write, use and learn. More importantly, it's open-source and free, cross-platform, and widely supported. David Sklar's Learning PHP5 is one of the latest volumes dealing with PHP. It describes itself as 'a Pain-Free Introduction to Building Interactive Web Sites,' and provides a gentle introduction to the latest version of PHP, which is version 5 and only recently available." Read on for Suda's review.

This book is not particularly useful for those experienced already with PHP, nor for those wanting to upgrade their knowledge of PHP from versions 4 and earlier to the newest version. It's also probably not particularly useful for those power programmers who need and want a deep and comprehensive coverage of the topic. But it is a very well-written and designed introduction to PHP 5 for beginning programmers or those experienced PERL, ASP, or Cold Fusion programmers who want to learn a different language. There are many illustrations and code samples sprinkled throughout the book. Sklar, however, skims over some topics, concentrating instead on practical examples.

The publisher is O'Reilly Media, Inc. which seems to have an editor's policy of covering complex computer-related topics in a comprehensive manner by publishing a range of volumes covering different aspects of a topic or from different angles or for different audiences. O'Reilly also publishes volumes on moving to PHP 5 (Upgrading to PHP 5), detailed and technical PHP (Programming PHP), and a collection of solutions to common PHP programming problems (The PHP Cookbook).

Sklar is an experienced consultant in computer software development and technical training. He is the author of Essential PHP Tools and coauthor of the aforementioned The PHP Cookbook. He takes a deliberate and comprehensive approach to explaining PHP 5, not in great depth, but with the intent of providing enough information, concepts, detail, and scope to create a pleasant and useful read of a technical subject. The basic promise of PHP is in the relatively easy creation of more dynamic and interesting web sites which would include, for example, product catalogs, blogs, photo galleries, event calendars, forms, and more.

There are 13 chapters and 3 appendices. The early chapters provide an orientation to PHP, including its place in contemporary web development, its basic rules, and its syntax. They explain the basic background of PHP and how it interacts with the browser and web server. Later chapters introduce primary concepts like loops, arrays, and functions. The idea here is to facilitate learning the fundamentals of the grammar and vocabulary. Chapters 2 through 12 have short exercises at the end of each to allow the reader to practice writing PHP code and to test learning. (The answers are contained in Appendix C.) Experienced programmers and geeks may recoil at the inclusion of these exercises, but they are useful for beginners.

Chapter 6 provides a practical exercise - how to make and use a web form. The author shows how to access form variables, how to validate user-inputted data for security and efficiency reasons, and how to process forms using functions. Chapter 7 shows how PHP interacts with database programs, like SQL and Oracle, but focuses primarily on MySQL, and demonstrates how to organize data, connect to a server-based database, create tables, and enter and retrieve data.

The rest of the middle chapters cover the use and implementation of cookies and sessions, handling dates and time, and working with files. The practical exercise using dates and times is creating and displaying a monthly calendar. The final chapters provide brief but practical coverage of XML, debugging, and in Chapter 13, other PHP aspects. PHP is amazingly useful, flexible, and practical. One can deal with graphics, PDF documents, and other media like Flash and Shockwave. It also has mailing and file uploading functions, encryption capabilities, and (for more experienced coders) the ability to run shell commands. The upgraded PHP 5 has new capabilities, which now include object-oriented programming.

Appendix A covers installing and configuring PHP for Windows, Mac OS X, and Linux; Appendix B is a short primer on regular expressions and how to use them with PHP.

I found the book to be the most accessible introduction to PHP I have read. It provides the basic fundamentals, engages the reader in practical examples, reinforces learning with exercises, and provides an overall perspective on the scope of PHP programming.

You can purchase Learning PHP 5 from bn.com. (Code examples used in the book can be downloaded at the O'Reilly site for the book, linked above.) Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

cgjherr (Jack Herrington) writes "The Cult of Mac, a new book by Leander Kahney, is a love letter to the Macintosh community. The book seeks to simultaneously define and evangelize the Apple cultural phenomenon. With 25 million users (in the author's estimation) there is a lot of culture to go around. The tattoos. The modified machines. The pilgrimage to MacWorld. The sub-cult of iPod. It's all here." Read on for the rest of Herrington's review. The Cult of Mac author Leander Kahney pages 268 publisher No Starch rating Excellent reviewer Jack Herrington ISBN 1886411832 summary A love letter to the Mac community

The form and structure of the book is a cross between a Wired magazine (for which Kahney has long written on Apple) and a coffee table book. There are great pictures of people, machines and art to appeal to the eye. Some pages are all pictures, while others are primarily text -- most are a combination of the two. The layout is always attractive. If this were a book from Apple, the style would be cleaner and there would be less emphasis on the past; this book is from and for the fans, though, so the style is more edgy and chaotic.

The book is divided into five large sections. The first covers the Macintosh itself, its users, its evangelists, and a little of its history. Including, to my amusement, but not surprise, its connection with pot, which occupies three pages. Wozniak is covered lovingly, and Jobs is painted with the same awe, love and hate brush that the community uses. Leander even covers the TV and movie Macintosh spotting, where the good guys always use Macs and the bad guys always use PCs.

Section two takes us into the MacWorld phenomenon. The secrecy, the crazy crowds, the keynote -- the whole shebang. We also get a look into the Mac phenomenon in Japan.

The final three sections are the most interesting to the hardware lovers. Section four covers modifying the Macintosh, futuristic designs, and the variety of things that have been built from dead Macs. The fourth section is about collecting Macintoshes; there is an excellent image here of a reception desk built entirely of old Mac Classics. Some attention is also paid to the devotees of Apple tsotchkes -- the shirts, the pins, the shoes, and other logo-branded novelties.

The final section is all about what comes next. Here Leander covers the iPod and its subculture, as well as the ongoing cultural battle between Microsoft users and the Mac world. The author even goes so far as to associate the construction of the swivel head iMac to that of a newborn baby to justify our attachment to it. And that makes my Powerbook a what?

There is a lot of great material in this book just to flip through, or to sit down for an enjoyable read. For the technically minded, there is nothing here to help you write better code or get more out of the operating system. This is a book about a culture, its icons, its people, and its ideology.

I can't recommend this book for a PC person, Unless he's interested in learning about the phenomenon or becoming part of it, I doubt there is much he'd interesting in this book. A PC user uses his machine to perform a task and thinks little of the machine itself. A Mac, on the other hand, is a key component of an integrated lifestyle. If you don't live the lifestyle and you care to know more about it, then check out the book. Otherwise, you might as well skip it.

As a Mac enthusiast myself I really enjoy this book. I started programming on the Macintosh with the first 128K machine, took a hiatus on Windows for a couple of years, and switched back with OS X. I've been to a MacWorld and seen some of the phenomenon first-hand. But it's nice to see it catalogued here in such an attractive, nicely constructed, well-written book.

In the early days of Apple versus Microsoft we had a real culture war, command line versus GUI. Windows won. Which is bad because Mac is, IMHO, better. But the Windows victory does allow us in the Mac camp to revel in our own individuality. This book is a fun way for new and old Mac fans alike to share in the common insanity which is our somewhat unrealistic love for this computer and it's company.

I'm certainly glad this book came out before Christmas. Now I know what I am going to give a couple of my fellow Macaddicts.

Reviewer Jack Herrington authored Code Generation in Action, and edits the Code Generation Network. You can purchase The Cult of Mac from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, carefully read the book review guidelines, then visit the submission page.

John Suda writes "There are more new books being published about PHP than you can shake a joystick at. PHP (along with program friends - MySQL and Apache) has become very popular among developers and web designers, and for good reason. As a programming language, it is particularly suited to web development projects, while being relatively easy to write, use and learn. More importantly, it's open-source and free, cross-platform, and widely supported. David Sklar's Learning PHP5 is one of the latest volumes dealing with PHP. It describes itself as 'a Pain-Free Introduction to Building Interactive Web Sites,' and provides a gentle introduction to the latest version of PHP, which is version 5 and only recently available." Read on for Suda's review. Learning PHP 5 author David Sklar pages 432 publisher O'Reilly rating 9 reviewer John Suda ISBN 0596005601 summary An accessible introduction to the popular web scripting language PHP

This book is not particularly useful for those experienced already with PHP, nor for those wanting to upgrade their knowledge of PHP from versions 4 and earlier to the newest version. It's also probably not particularly useful for those power programmers who need and want a deep and comprehensive coverage of the topic. But it is a very well-written and designed introduction to PHP 5 for beginning programmers or those experienced PERL, ASP, or Cold Fusion programmers who want to learn a different language. There are many illustrations and code samples sprinkled throughout the book. Sklar, however, skims over some topics, concentrating instead on practical examples.

The publisher is O'Reilly Media, Inc. which seems to have an editor's policy of covering complex computer-related topics in a comprehensive manner by publishing a range of volumes covering different aspects of a topic or from different angles or for different audiences. O'Reilly also publishes volumes on moving to PHP 5 (Upgrading to PHP 5), detailed and technical PHP (Programming PHP), and a collection of solutions to common PHP programming problems (The PHP Cookbook).

Sklar is an experienced consultant in computer software development and technical training. He is the author of Essential PHP Tools and coauthor of the aforementioned The PHP Cookbook. He takes a deliberate and comprehensive approach to explaining PHP 5, not in great depth, but with the intent of providing enough information, concepts, detail, and scope to create a pleasant and useful read of a technical subject. The basic promise of PHP is in the relatively easy creation of more dynamic and interesting web sites which would include, for example, product catalogs, blogs, photo galleries, event calendars, forms, and more.

There are 13 chapters and 3 appendices. The early chapters provide an orientation to PHP, including its place in contemporary web development, its basic rules, and its syntax. They explain the basic background of PHP and how it interacts with the browser and web server. Later chapters introduce primary concepts like loops, arrays, and functions. The idea here is to facilitate learning the fundamentals of the grammar and vocabulary. Chapters 2 through 12 have short exercises at the end of each to allow the reader to practice writing PHP code and to test learning. (The answers are contained in Appendix C.) Experienced programmers and geeks may recoil at the inclusion of these exercises, but they are useful for beginners.

Chapter 6 provides a practical exercise - how to make and use a web form. The author shows how to access form variables, how to validate user-inputted data for security and efficiency reasons, and how to process forms using functions. Chapter 7 shows how PHP interacts with database programs, like SQL and Oracle, but focuses primarily on MySQL, and demonstrates how to organize data, connect to a server-based database, create tables, and enter and retrieve data.

The rest of the middle chapters cover the use and implementation of cookies and sessions, handling dates and time, and working with files. The practical exercise using dates and times is creating and displaying a monthly calendar. The final chapters provide brief but practical coverage of XML, debugging, and in Chapter 13, other PHP aspects. PHP is amazingly useful, flexible, and practical. One can deal with graphics, PDF documents, and other media like Flash and Shockwave. It also has mailing and file uploading functions, encryption capabilities, and (for more experienced coders) the ability to run shell commands. The upgraded PHP 5 has new capabilities, which now include object-oriented programming.

Appendix A covers installing and configuring PHP for Windows, Mac OS X, and Linux; Appendix B is a short primer on regular expressions and how to use them with PHP.

I found the book to be the most accessible introduction to PHP I have read. It provides the basic fundamentals, engages the reader in practical examples, reinforces learning with exercises, and provides an overall perspective on the scope of PHP programming.

You can purchase Learning PHP 5 from bn.com. (Code examples used in the book can be downloaded at the O'Reilly site for the book, linked above.) Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

donour (Donour Sizemore) writes "I recently bought a high-performance automobile that has a reputation for its tuning potential. Before making the purchase, I joined several online forums for enthusiasts in order to get a good reading on how happy people are with the particular model. I was amazed at the vibrant communities built around websites such as evolutionm.net and nasioc.com. A wealth of information is available, but the data is surrounded by noise. For every knowledgeable enthusiast, there are many more misinformed or incorrect speculators whose opinions usually spring from personal preference or a need to hear themselves talk. Enter David Vespremi's Car Hacks & Mods for Dummies." Read on for the rest of Sizemore's review. Car Hacks & Mods for Dummies author David Vespremi's pages 384 publisher Wiley & Sons rating 9 reviewer Donour Sizemore ISBN 0764571427 summary Presents the big-picture view of car mods that have to do with making the car stop, go, turn, and keep the occupants safe.

In general, I steer myself and others away from the "for Dummies" book series since I believe a lot of material at this level can be found on the internet for free. HOWTOs and tutorials abound for using and modifying most consumer products. In this case, the time saved from filtering online discussion is well worth it. The book is well organized, with separate sections devoted to handling, power, braking, engine management, safety, and cosmetics. There are 26 chapters spread across 360 pages. As you can see, chapters are short and can be tackled easily during lunch or a short taxi ride to retrieve your broken car.

Slashdot readers may be surprised to learn that there is no discussion of entertainment electronics such as stereos or car-mounted computers. This should not be confused with engine management units (ECU). ECUs are discussed at length. Car Hacks & Mods for Dummies main focus is making your car go, stop and turn. Sections were added for safety and cosmetics, but performance is by far the emphasis.

The book does not actually explain how to do any specific modifications whatsoever. Instead it serves as a guidebook to learn what options are out there and compare one upgrade path to another. For example, there is a great explanation of the differences between a turbocharger and a supercharger, but you're not going to get an analysis of the mods required to support your brand new 10.5cm hotside. Instead there are careful treatments of the pros and cons associated with almost any upgrade car car enthusiast may be considering. The coverage of jargon and rating systems used for various products is especially useful. Whenever a new subject or car component is mentioned, the author goes over regulating and standardizing bodies (the DOT, EPA, and SAE) as well as explains how parts, pieces, and fluids are rated. While this is useful when thinking about a new project, it isn't the information someone would want to rely on once they begin such an undertaking itself. The author clearly states, "this book is not intended to be an instruction manual."

The author gets high marks for addressing safety -- both the driver's and the vehicle's -- before any modification. The emphasis on maintaining legal and effective safety devices on a tuner car is something you are not likely to get during an argument about which upgrade path is optimal, nor is it obvious that many safety 'upgrades' -- 4-point harnesses, flashy roll-bars -- actually decrease driver safety when used on the street. In addition the author consistently gives warning when introducing a mod that could put added stress on a vehicle.

If you are a professional mechanic, this book is not for you. You already know most of the contents. Mechanics would be better served by product literature and shop manuals. If you are thinking about modifying your car, but don't have any idea where to start, this is probably a good place. Just be sure to read the first chapter. Car modding quickly becomes expensive, and jumping in without knowing the attached costs (which this book addresses) can be a financial nightmare.

You can purchase Car Hacks & Mods from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Dozix007 (Kurt Kaylor) writes "Daniel Sweeney, a technical writer, business reporter, and industry analyst is coming full circle in his series of wireless related writings with his latest book WiMax Operator's Manual: Building 802.16 Wireless Networks. Sweeney brings the WiMax 802.16 standard into the context of a ISP solution for the masses. WiMax is a recent standard from the IEEE that is similar to conventional wireless technology, however WiMax supports higher data rates and longer distance transmissions than other standards from the IEEE. This book drifts away from the recent flood of wireless books by conveying all needed knowledge to establish, understand, operate and potentially profit from an 802.16 wireless network, rather than a specific look at one aspect of the technology. This book is not only for the business minded, but for a consumer looking to establish a quality long-distance wireless network of their own." Read on for the rest of Kaylor's review. WiMax Operator's Manual: Building 802.16 Wireless Networks author Daniel Sweeney pages 240 publisher Apress rating 9 reviewer Kurt Kaylor ISBN 159059357X summary This book serves as a guide for present and future entrepreneurs and it is intened to assist them in avoiding the experiments and false starts that proved so frustrating for the pioneers.

WiMax Operator's Manual: Building 802.16 Wireless Networks is primarily a utilitarian book rather than conceptual. It provides a background in broadband wireless fundamentals, packet data, and overall network operation and management to enable a network operator to set up a network with standards-based equipment and to run it profitably thereafter. Sweeney notes early in the book : "Nothing is particularly admirable about purism in terms of wireless technology, and if wire line technologies serve the same purpose better over some portion of the network footprint, then wise network operators will avail themselves of them." This theme of realism in relation to the application of a wireless network is prevalent though out the book.

Wired networks in the same footprint will almost always beat a wireless network in speed, reliability, and cost. This is primarily due to the previously created infrastructure available to Internet carriers. The goal that Sweeney promotes is to find an ideal region that has not yet been exploited by a wired service provider. These regions are ideal due to the low-cost setup for a wireless network compared to the cost of a wired network. Sweeney describes and informs the user of ways to find and establish these networks in an efficient manner to maximize profitability.

Sweeney also discusses network security in the later chapters of his book. He acknowledges the increasing need to secure the network's own infrastructure, the safety of its customers, and a nation itself. In relation to wireless networks, Sweeney notes "[Security] is becoming increasingly important in network operations today and cannot be considered optional at this point." To this end, the network security section is devoted to security policies, secure electrical systems, cyber warfare, and other information on safeguarding your network. Another concern also addressed is the Communications Assistance for Law Enforcement Act. CALEA is a complex piece of federal legislation that expands law enforcement's authority to conduct electronic surveillance, including surveillance over public networks. Sadly, as of yet there is no real way to combat this intrusive act.

WiMax Operator's Manual: Building 802.16 Wireless Networks is a great resource for businesses and individuals looking to establish their own 802.16 network. I enjoyed the foresight provided in this book for potential problems faced by network operators. The honesty in the practicality of an 802.16 network as a realistic network solution also made the book a great resource. There was no fantasy scenario or white lies to convince a user of the merit of a 802.16 network beyond what it can do.

The gripe I do have with this book is its complete utilitarian nature. A little more theory and insight into the standard itself would have been great. This book stands purely as an Operator's Manual, and not an exploration of WiMax as a standard, but rather a tool. Otherwise, this book was highly enjoyable and well written. I would recommend this book to anyone looking to establish a network beyond the standards commonly available (e.g. 802.11a - 802.11g). This book is unique in its topic and sheer honesty, and is one of the few references available on the specific subject.

You can purchase WiMax Operator's Manual: Building 802.16 Wireless Networks from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

swsuehr (Steve Suehring) writes "Knowing that Jeremy Zawodny works with MySQL in a highly demanding environment at Yahoo! Finance, I have to admit that I was somewhat anxious to crack open a copy of the book High Performance MySQL published by O'Reilly and written by Jeremy and Derek J. Balling. With such high expectations, it would be easy to be disappointed with the content or level of the material in the book. Far from disappointing, High Performance MySQL was exactly what I had hoped it would be and more." Read on for the rest of Suehring's review. High Performance MySQL author Zawodny & Balling pages 294 publisher O'Reilly rating Excellent reviewer Steve Suehring ISBN 0596003064 summary Optimization, Backups, Replication, Load Balancing & More

With a title like High Performance MySQL, the reader should not expect assistance with tasks such as installation or the basics of SQL. The authors acknowledge that the book isn't meant for the MySQL beginner. Even so, the book does spend a little time going over a refresher of MySQL. If the reader is looking for a book on the basics of MySQL, though, I'd recommend picking up a different title. I might be so brazen as to suggest looking at the book on MySQL that I wrote a couple years ago, but I'll leave it for the reader to find an appropriate title for their level of knowledge with MySQL.

The book is broken out into ten chapters, beginning with a chapter on the basics of MySQL as seen from someone with some level of MySQL experience. (And since I am someone with some level of MySQL knowledge, this chapter didn't seem to be too painful of a read.) That statement begs for a further explanation. I find it painful to read books that claim to have advanced topics but find it necessary to spend (or waste) time by giving yet another explanation of how to type ./configure; make; make install in the beginning chapter. In this regard, I find High Performance MySQL to be quite good at providing the appropriate level of explanation for the audience.

The first pages alone are a great starting point for those who are wondering about the performance as it relates to the different versions of MySQL. A discussion of the binary versions of MySQL versus the source code versions gives the reader a good understanding of the implications of this important decision. Choosing correctly between the versions of MySQL can help to maximize performance.

Though only the first chapter is titled "Back to Basics," most chapters include some basic or background information pertinent to that chapter. For example, both the query and index performance-related chapters include sections with the word 'Basic' in their titles. These two chapters, "Index Performance" and "Query Performance," cover topics often misunderstood when considering performance on a database. Naturally, any database administrator worth their pay (insert your own joke here) will tell you that an index can help to improve performance. But High Performance MySQL takes it a step further by diving into why you might use a particular index given your database needs. This type of practical information is common throughout the book. Rather than just give the reader a listing of the indexes (which are mostly common among RDBMS anyway), the authors choose to tell you why you might choose one method over another.

Other chapters within High Performance MySQL include chapters on server performance tuning, replication, load balancing, and high-availability, backup and recovery, and security. I've followed MySQL forums and mailing lists over the years and some of the more common questions relate to MySQL security. The chapter on security gives the reader a great explanation of the MySQL GRANT tables and includes a sidebar on the significance of 'localhost' in MySQL which nearly always seems to be a source of confusion, though maybe not for the reader of this particular book. Like other chapters, the security chapter includes tips for the underlying environment upon which MySQL operates. For example, regardless of how good the MySQL database permissions are configured, if another piece of software on the server isn't kept up to date then the entire server, including the MySQL data, could be compromised.

Looking back at the book, I might have laid the chapters out in a different order or provided more structure through sections of the book. However, this can be dismissed as personal opinion and is non-substantive anyway. I believe High Performance MySQL is an excellent choice for the MySQL administrator or developer not only looking to improve their database performance but also to improve his knowledge of MySQL.

You can purchase High Performance MySQL from bn.com. (And the book that Suehring alludes to is the MySQL Bible . Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

swsuehr (Steve Suehring) writes "Knowing that Jeremy Zawodny works with MySQL in a highly demanding environment at Yahoo! Finance, I have to admit that I was somewhat anxious to crack open a copy of the book High Performance MySQL published by O'Reilly and written by Jeremy and Derek J. Balling. With such high expectations, it would be easy to be disappointed with the content or level of the material in the book. Far from disappointing, High Performance MySQL was exactly what I had hoped it would be and more." Read on for the rest of Suehring's review. High Performance MySQL author Zawodny & Balling pages 294 publisher O'Reilly rating Excellent reviewer Steve Suehring ISBN 0596003064 summary Optimization, Backups, Replication, Load Balancing & More

With a title like High Performance MySQL, the reader should not expect assistance with tasks such as installation or the basics of SQL. The authors acknowledge that the book isn't meant for the MySQL beginner. Even so, the book does spend a little time going over a refresher of MySQL. If the reader is looking for a book on the basics of MySQL, though, I'd recommend picking up a different title. I might be so brazen as to suggest looking at the book on MySQL that I wrote a couple years ago, but I'll leave it for the reader to find an appropriate title for their level of knowledge with MySQL.

The book is broken out into ten chapters, beginning with a chapter on the basics of MySQL as seen from someone with some level of MySQL experience. (And since I am someone with some level of MySQL knowledge, this chapter didn't seem to be too painful of a read.) That statement begs for a further explanation. I find it painful to read books that claim to have advanced topics but find it necessary to spend (or waste) time by giving yet another explanation of how to type ./configure; make; make install in the beginning chapter. In this regard, I find High Performance MySQL to be quite good at providing the appropriate level of explanation for the audience.

The first pages alone are a great starting point for those who are wondering about the performance as it relates to the different versions of MySQL. A discussion of the binary versions of MySQL versus the source code versions gives the reader a good understanding of the implications of this important decision. Choosing correctly between the versions of MySQL can help to maximize performance.

Though only the first chapter is titled "Back to Basics," most chapters include some basic or background information pertinent to that chapter. For example, both the query and index performance-related chapters include sections with the word 'Basic' in their titles. These two chapters, "Index Performance" and "Query Performance," cover topics often misunderstood when considering performance on a database. Naturally, any database administrator worth their pay (insert your own joke here) will tell you that an index can help to improve performance. But High Performance MySQL takes it a step further by diving into why you might use a particular index given your database needs. This type of practical information is common throughout the book. Rather than just give the reader a listing of the indexes (which are mostly common among RDBMS anyway), the authors choose to tell you why you might choose one method over another.

Other chapters within High Performance MySQL include chapters on server performance tuning, replication, load balancing, and high-availability, backup and recovery, and security. I've followed MySQL forums and mailing lists over the years and some of the more common questions relate to MySQL security. The chapter on security gives the reader a great explanation of the MySQL GRANT tables and includes a sidebar on the significance of 'localhost' in MySQL which nearly always seems to be a source of confusion, though maybe not for the reader of this particular book. Like other chapters, the security chapter includes tips for the underlying environment upon which MySQL operates. For example, regardless of how good the MySQL database permissions are configured, if another piece of software on the server isn't kept up to date then the entire server, including the MySQL data, could be compromised.

Looking back at the book, I might have laid the chapters out in a different order or provided more structure through sections of the book. However, this can be dismissed as personal opinion and is non-substantive anyway. I believe High Performance MySQL is an excellent choice for the MySQL administrator or developer not only looking to improve their database performance but also to improve his knowledge of MySQL.

You can purchase High Performance MySQL from bn.com. (And the book that Suehring alludes to is the MySQL Bible . Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

James Edward Gray II writes " Programming Ruby: The Pragmatic Programmers' Guide (Second Edition), known as the Pickaxe II to its fans, is an extremely current view of the Ruby programming language. Revised primarily by Dave Thomas, a founding father of the English Ruby community, Programming Ruby is distilled expertise from a reliable source. In the past, quality English documentation of Ruby has been in short supply, but if any one volume could solve that problem, this is it." Read on for the rest of Gray's review. Programming Ruby: The Pragmatic Programmers' Guide author Dave Thomas with Chad Fowler and Andy Hunt pages 830 publisher Pragmatic Bookshelf rating 9 reviewer James Edward Gray II ISBN 0974514055 summary The definitive source for all things Ruby.

If you're not familiar with it, Ruby is a very fun and elegant scripting language that has been described as "more powerful than Perl and more object oriented than Python." I won't start a language war by defending that statement, but I will tell you what makes Ruby very attractive to me: Extremely object oriented, super clean syntax, and a smooth blending of iterators and code blocks for straightforward, concise solutions. If that sounds like a language you would like to know more about, Programming Ruby is the book for you.

At 830 pages, this edition is considerably larger than the first. It represents an expansion on many topics originally covered, in addition to all new coverage on topics like unit testing, RDoc documentation for Ruby source code, and more. Better still, "Duck Typing," a topic central to Ruby philosophy, receives its own enlightening chapter. This volume covers the very latest release of the language, often highlighting new features and even giving tips for things to watch for in future versions.

Programming Ruby is divided into four distinct sections. "Part I - Facets of Ruby" is a tutorial on the Ruby Programming Language. It's very effective, but I probably better give a warning here: This book teaches you how to program in Ruby, not how to program. You likely won't feel comfortable, even in this tutorial section, unless you have some experience with other programming languages. As an example, Ruby is object oriented on a scale with languages like Smalltalk, so you'll need to know object oriented programming. This book makes no attempt to teach such concepts, excepting how they apply to Ruby. As long as you come with the proper background, this section will get you on your feet with Ruby in under 200 pages. It's very well thought out.

"Part II - Ruby in its Setting" is a mixed-bag tour on the many places Ruby sees use. Web programming, command-line hacking, using TK to build GUIs, and Windows programming are just some of the covered topics. Other chapters in here focus on elements unique to Ruby, like the earlier mentioned RDoc or "irb," the interactive Ruby shell. There's even a chapter in here on package management with RubyGems.

When you're ready, "Part III - Ruby Crystallized" will take you deep into the core of Ruby syntax and functionality. This section tells you all the details about how Ruby reads your code, and how it runs. I think few people could soak in all the tidbits in here in one scan. I've read it twice now and learned about as much both times. There's a lot of great Ruby knowledge waiting to be mined out of here.

Finally, "Part IV - Ruby Library Reference" is the best Ruby reference I've yet run across. It covers every class, module, method and constant in core Ruby. The descriptions for these entities tell you exactly what you need to know, the examples, though short, are inspiring, and the comments sneak in subtle hints that are more than useful. Following this, the book gives an overview of all Standard Libraries included with Ruby. This section really opened my eyes to the tools I've been missing out on simply because I didn't know they were there. Be warned: These Standard Library summaries won't teach you every feature available. They just tell you what they're for so you'll know where to look for the information you need. The last great feature in this section is a terrific index. I care about the index and a book that has a bad one will really bother me. Luckily, that couldn't be further from the truth here.

Programming Ruby isn't perfect, of course. Some of the chapters are not as thorough as you wish they could be, simply because of the amount of information that needs to be covered. The chapter on threads is probably the biggest example of this, but remember that entire volumes have been written on threading. Another minor point is that some of the examples are quite contrived. This bothers some people, but I don't feel it's too much trouble for the book's target audience. As I've said, you're expected to know how to program going into this book, just not how to program in Ruby.

Programming Ruby at least touches on most things central to the Ruby Programming Language, and goes into considerable detail more often than not. There's something for all levels here. You can learn Ruby from the tutorial, as I did with the first edition, but you'll keep coming back to the wonderful reference and to go deeper into specific areas of interest. That's a lot of great mileage for one book. I'm willing to bet most Ruby Gurus keep it in arm's reach, because Ruby wouldn't be half as much fun without it.

You can purchase Programming Ruby from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Paul S. R. Chisholm writes "What makes a software development project succeed? It's not language or tools or process. It's not a simple as people; even great programmers sometimes find themselves associated with disasters. In some sense, a successful project is the same thing as a successful organization; but what makes those? We need an anti-Dilbert. In Organizational Patterns of Agile Software Development, James O. Coplien and Neil B. Harrison lay out the results of their research on the subject; what they found, helps." Chisholm also offers this disclaimer: "Full disclosure: I was a member of one of the organizations studied, and I contributed to one of the patterns in the book. I know both the authors; one is a long-time friend and mentor. This review reflects my opinion of the book, not of the authors. I paid for my copy of the book." Read on for the rest. Organizational Patterns of Agile Software Development author Coplien, Harrison pages 419 publisher Prentice Hall rating 9 reviewer Paul S. R. Chisholm ISBN 0131467409 summary Practical and theoretical ends meet in this opinionated but open-minded approach to implementing agile software projects, including very large-scale ones.

Organizational Patterns of Agile Software Development starts by describing the foundations of the authors' research. There are definitions of a "pattern" (but "your intuition about the meaning of the term will take you far") and of a "pattern language" (read the book), the history of their research, and some information about how the book is laid out. The authors recommend you read this section, and so do I; but if it's too dry for you, by all means move on.

The meat of this book is four pattern languages: how to manage a project, how to grow it over time, what can make up an organization's "style" (I'd use the word "culture"), and how the people fulfill their roles and interact with each other. These are not prescriptions or algorithms; they're elements of how successful organizations have worked.

Each pattern describes one aspect of some effective software development organizations. Some patterns are found in more than one pattern language; "Community of Trust" is common to all. Others are less general; "Moderate Truck Number" applies only to the "piecemeal growth" pattern language.

How valuable are the patterns? Some (such as "Get On With It", proceeding with an effort before the planning is considered complete) are common sense. Others (for example, "Don't Interrupt an Interrupt") are things you probably know, but might need to be reminded of ... or might need to remind your boss of. More than a few (my favorite is "Architect Also Implements") might help you understand how something could or should work. Finally, there are some patterns here (such as the "Day Care" pattern for training new members) that might be new to you.

The rest of the book puts the patterns and pattern languages into perspective. There are chapters on organizational principals and (seriously) anthropological foundations of this work. Then there are two case studies of very successful projects. On one, "[about one] million lines of code were written over a period of 31 months by about eight people (that's about 1,000 lines of code per person per week) -- that doesn't include code in the [two] prototypes." It's easy to crank out code at that rate for small bursts, or on small projects. To stay at that pace constantly for over two and half years is nothing short of astounding. The resulting product was released to great reviews. (It then did poorly in the marketplace when it went head-to-head with a directly competing product from Microsoft. Sound dissatisfying? Consider how very long people waited impatiently for Mozilla and its successors such as Firefox. More directly, look at Robert Glass's assertion of the "disconnect between managers and their programmers" as to what projects are seen as successful; it's Fact 13 in Glass's book reviewed August 30th on Slashdot.)

What's imperfect about this book? A couple of things.

First, sometimes the language gets too academic for easy reading. Example: "We have also seen a lighter though almost equally destructive form of this phenomenon, which we describe as schismogenesis.... Symmetrical schismogenesis occurs when two factions each rise in power (or in fear or distrust of each other) and form cliques or splinter groups that tend to focus inward rather than resolve issues in the dialogue with each other." Clear enough if you work on it, but a little intimidating.

Second, the book is surprisingly partisan on some subjects. The book is not kind either to ISO 9000 or Extreme Programming; it could serve as a sort of litmus test, delighting critics and coming across to supporters as unfairly harsh.

What's good about this book? It's a collection of good information, well presented, with information on how to apply it, on a topic where not much knowledge has been accumulated. For some specific circumstances, this book sometimes points out different likely alternatives, with information on when each is applicable. Don't expect Organizational Patterns for the Complete Dummy; then again, don't expect anything useful to be superficial.

How could Coplien and Harrison's work apply to open source development? For starters, they point out the value of people working physically together, and of individual code ownership; these aren't easily applied to open source, but at least it points out forces that need to be resolved somehow. On the other hand, some patterns here are hugely relevant to open source: "Work Queue," "Informal Labor Plan," "Self-Selecting Team," and "Team Pride" come to mind.

Organizational Patterns of Agile Software Development is no panacea. If your organizational practices are the opposite of what's found to be effective, you may find this book frustrating. A book can't take your organization where it needs to go; but Coplien and Harrison have put up some road signs.

You can purchase Organizational Patterns of Agile Software Development from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

mikael writes "ZDnet is reporting that the management guru Clayton Christensen (author of "The Innovator's Dilemma") has advised Microsoft to learn to love Linux. In particular he advises Microsoft to purchase "Research in Motion", otherwise they will see their applications sucked off from the desktop and onto handheld devices such as the Blackberry."

Sarusa writes "This may be the easiest book review I've ever written. If you program in Python and you want to write Internet applications, go buy Foundations of Python Network Programming by John Goerzen. There. What, you wanted more? Well, okay, but then I'm back to playing Katamari Damacy." Read on for the rest of Sarusa's review. Foundations of Python Network Programming author John Goerzen pages 500 publisher Apress rating 9 of 10 reviewer Sarusa ISBN 1590593715 summary If you program in Python, and you want to write Internet applications, you need this book.

First of all, 'Network' means 'Internet.' Everything in the book concerns protocols running over IP, which is almost anything useful these days. That said, this is a lot of ground to cover -- there's FTP, HTTP, POP3, IMAP, DNS, a veritable explosion of acronyms, and this book does a great job of hitting all the ones you're likely to need.

Foundations assumes you already know Python, but nothing about network programming. The first 100 pages covers the basics of IP, TCP, UDP, sockets and ports, server vs. daemon, clients, DNS, and more advanced topics like broadcast and IPv6. And in case you already know all that, how Python deals with them. This is the only part of the book you will probably read in order. After that you pick what you need.

Find a topic you need to know how to deal with, such as using XML-RPC, and locate the appropriate section of the book. There he'll cover the basics of the topic, show you how to use the correct Python module(s) to implement it, explain any gotchas (this is key!), and write a short but functional application or two that uses it. I'm not sure why this book isn't called 'Practical Python Network Programming.' It's eminently Practical. It won't make your heart race, but it tells you exactly what you need to get the job done.

All this information is out there to find for free, but having it all collected and summarized is worth every penny. And the real value is having the edge conditions and not-so-obvious practical details explained by someone who's obviously used this stuff in the field. Python and its excellent libraries make Internet tasks relatively easy, but it's even easier with some expert help, and the libraries assume you already know what you're trying to do. For example, if you're doing a DNS.Request() record query and using a DNS.Type.ANY, it (for good reason) returns information cached by your local servers, which may be incomplete. If you really need all the records you need to skip your local servers and issue a query to the name server for the domain. This is isn't hard; you just have to know what's going on. Or do you know which exceptions can get raised if you're using urllib to fetch web pages? It's here. Exception handling is not neglected.

So you know what you're getting, here's a laundry list of topics: IP, TCP, UDP, sockets, timeouts, network data formats, inetd/xinetd, syslog, DNS, IPv6, broadcast, binding to specific addresses, poll and select, writing a web client, SSL, parsing HTML and XHTML, XML and XML-RPC, email composition and decoding, MIME, SMTP, POP, IMAP, FTP, MySQL/PostgreSQL/zxJDBC (though you won't learn SQL), HTTP and XML-RPC servers, CGI, and mod_python. As a bonus you get some chapters on forking and threading (for writing servers) and handling asynchronous communication in general.

Just to find something to complain about churlishly, I wish Goerzen had managed to do all this and make it scintillatingly brilliant and witty from cover to cover (all 500 pages); perhaps dropping juicy bon mots of gossip from the Debian project. And while I'm at it I'd like a pony. No, seriously. If you program in Python, intend to do anything Internet related, and aren't already a Python networking god, you need Foundations of Python Network Programming. In terms of 'hours I could have saved if only I had this book sooner' it would have paid for itself many times over.

You can purchase Foundations of Python Network Programming from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Raymond Lodato writes "For a number of years now, I've been playing with Linux at my company. My laptop is dual-boot, and I've been trying to steer away from Windows as much as I possibly can. Most of the books I've read have been geared either to running Linux as a server, or as a personal workstation. The gap has been filled. Moving to the Linux Business Desktop, by Marcel Gagné, covers what you need to know to successful run Linux as a business workstation." Read on for the rest. Moving to the Linux Business Desktop author Marcel Gagné pages 696 publisher Addison-Wesley rating 9/10 reviewer Raymond Lodato ISBN 0131421921 summary Very valuable guide for business user of Linux.

M. Gagné, a writer for The Linux Journal, does not assume you're going to use any specific distro for Linux. He gives instructions and examples for the most common ones: Fedora (Red Hat), Mandrake, SUSE, Debian, etc. KDE is the primary desktop, but GNOME is covered fairly well, too. I have to admit that, as a long-time Red Hat user, I was well entrenched in the GNOME world. However, after reading Marcel's book, I've make KDE my default environment, and I've been very happy with it.

This book is broken up into three major parts: Getting to Know Linux, Administration and Deployment, and The Linux Business Desktop. Each part is packed with information in an easy-to-follow format. In fact, I found it hard to just read and not fire up my Linux to follow along.

Part One (Getting to Know Linux) covers the essentials of installing Linux and customizing your desktop. As I remarked earlier, Marcel covers multiple distros. He includes instructions on how to install using Mandrake, Fedora Core 1, and SUSE. For those of you who just can't wipe Windows from your hard drive completely, M. Gagné covers setting up a dual-boot environment clearly enough that you will be able to have the best of both worlds.

The second part (Administration and Deployment) assists in setting up a fully functional business environment. In Chapter 7 (Installing New Applications), Marcel covers the various installation programs available across the distros. SUSE's YaST2 installer, Mandrake's urpmi, Kpackage (from the K Desktop Environment), rpm (the shell program), dpkg (Debian's package manager) and apt-get are all covered. In addition, he gives a clearly written explanation of how to build from source (The Extract and Build Five-Step -- page 124) that dispels any anxiety a newbie to Linux might have.

The next chapter covers the device support in Linux. When I started using Linux, device support was spotty at best. Now it's tremendously improved. Marcel shows you the basic of Linux's support. He then goes on to explain about network and Internet connections. Unfortunately, there is one major piece of errata in this area of the book. During his explanation of the difference between Class A, B, and C IP addresses, the information for class A was inadvertantly switched with the class C info. I've been informed that the errata is corrected on his website (www.marcelgagne.com) and in future editions of the book. Outside of that one unfortunate error, the rest of the book is pretty clean.

Later chapters dig into the topics of Backup and Restore (the most important and most underutilized functions), printing, email, web servers, file sharing (both Windows-like with Samba and Unix-like with NFS), thin clients (server-side and client-side) and desktop remote control. He even includes a chapter on installing and configuring LDAP (something rarely written about, but becoming more and more important).

The third and final part of the book covers the usual business applications. Email, arguably the "killer app" for office environments, is addressed first. Focusing on KDE, Kmail gets the lion's share of the coverage, with Evolution following behind. Desktop organizers come next, with Korganizer the favorite and Evolution (again!) nipping at Korganizer's heels.

The web-browsing chapter focuses on Konquerer, KDE's jack-of-all-trades application, and Mozilla. Most notably, significant coverage is given in the next three chapters to OpenOffice and its basic applications Writer, Calc, and Impress. For working with images, digital cameras and USB scanners are covered, with The GIMP as the preferred image editor. On-demand contact via instant messaging and video conferencing rounds out this marvelous book. Kopete and GAIM are discussed in depth for the IM arena, and GnomeMeeting for the VC work.

As with most Linux books, a CD is supplied. However, this book does not give you a specific distro for installation. Instead, Marcel chose to include a branded copy of Knoppix, the CD-bootable Linux. The idea is to let you play around with the various aspects of Linux using Knoppix before committing yourself to the actual installation.

All in all, this is a valuable book, covering most of the areas a business user wants to address. Notably lacking was coverage on how to try to run Windows applications under Linux. At the top of the review, I mentioned I keep trying to steer away from Windows as much as I can. Unfortunately, I usually have a couple of applications that I need but don't come in a Linux version. Even though VMWare, Win4Lin, and Wine were mentioned briefly, I would have liked to have read some examples of running a Windows application using them. In addition, the major snafu with the IP address space marred an otherwise excellent book.

You can purchase Moving To the Linux Business Desktop from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Ben Rockwood writes "UNIX, in all its many forms, was developed by developers for developers. This is evident in the connection between UNIX and C. In many ways, you can't truly understand one without the other. Certainly, there are plenty of UNIX users and admins who understand semaphores but have never written a threaded application, and C programmers who have never left the Windows world, but nevertheless at some point you'll encounter the symbiotic relationship the two share. Often, though, we find system administration books that discuss programming topics but not programming itself -- and conversely, C programming books that don't address the essence of UNIX. When we combine the two topics we get a systems programming book, an epic guide that clarifies relationships essential to understanding both entities in a truly holistic manner." Read on for Rockwood's review of Solaris Systems Programming, a book he describes as reaching this ideal. Solaris Systems Programming author Rich Teer pages 1248 publisher Prentice Hall PTR rating 10 reviewer Ben Rockwood ISBN 0201750392 summary Guide to systems programming using C on UNIX systems, not limited to Solaris

Several such guides have popped up over the years, such as The UNIX Programming Environment (Kernighan & Pike 84), Advanced UNIX Programming (Rochkind 85), The Magic Garden Explained (Goodheart & Cox 94), Advanced UNIX Programming (Gay 00) (that's not a typo, there really are two books with the same name), UNIX Systems Programming (Robbins & Robbins 03), UNIX Systems Programming for SVR4 (Curry 96), and the undisputed heavyweight champ, Advanced Programming in the UNIX Environment (Stevens 92).

Each of these books is distinctive, yet they share a number of topics. Essential topics include low- and high-level IO, signal handling, processes, IPC, and basic file system mechanics. In the more modern books, we see the inclusion of popular topics such as threading. Discussion directed toward broader topics of UNIX vary widely, namely due to the OS agnostic nature of such guides, despite the fact that until recently many books tended to slant toward SunOS/Solaris. Regardless of how many systems programming texts have appear, however, most programmers will agree that Stevens' guide is the only truly definitive choice. Since its release, there has been little challenge to its prominence, despite the emergence of Linux as a major UNIX implementation, despite several newer systems programming books, and even the 2nd edition of Rochkind's guide. But all of this now changes thanks to the release of Rich Teer's Solaris Systems Programming.

At a whopping 1248 pages, this volume dwarfs just about every systems programming book available by over 500 pages. It avoids the distractions of OS ambivalence by being tailored to Solaris, but is applicable to any UNIX platform available including Linux. Its layout is similar to that of Stevens' or Curry's books but builds significantly on each topic.

New systems programmers will immediately appreciate Teer's completeness, both in topic coverage and in his example code. Almost every code example is complete and runnable, unlike many of the other guides that demonstrate a topic only in an abstract function rather than complete program. Essential topics for completeness which have remained surprisingly absent from nearly every guide available (such as memory, code security and 64-bit topics) are thoroughly covered. A striking example is coverage of memory topics. When I pulled volume after volume off the shelf of my local bookstore and looked up "memory" in the index of each, I found surprisingly few even cover the topic beyond explaining the difference between stack and heap. In fact, many don't even include the malloc() function. Solaris Systems Programming is the only book I've ever found so complete in its memory discussion that it not only covered stack and heap, all the available memory management functions, but even discusses such important topics as memory alignment!

A complete chapter on secure C programming is provided, thoroughly discussing such important topics as buffer overflows, chroot jails, and program environment. A good number of tips are provided to help you immediately incorporate better security into your app whether it's a real concern (for now) or not. Combine this with a complete chapter on resource control and limits, including discussions on system information, the /proc file system, and some Solaris-specific resource control facilities, you can write more intelligent, less obtrusive, and better-tuned applications.

The coverage of advanced IO topics (including STREAMS) and file system coverage are superior to that in any other text I've seen. System admins will appreciate the in-depth coverage of file system topics that have only seen this sort of detail in books such as Solaris Internals (Mauro & McDougall, 00). This level of discussion allows not only a better understanding of file system and IO techniques, but also the clarity to immediately start building your own tools that allow you to interact with file system with far greater precision than ever before. Other topics, such as memory mapped IO, have rarely seen such detailed coverage.

A full treatment of IPC topics are handled, but like Stevens', these techniques are discussed using conventional concurrency techniques such as fork(). A discussion of POSIX threading is absent and regarded as too large a topic to address properly in a systems programming book and the reader is urged to consult a complete guide to the topic such as Programming with POSIX Threads (Butenhof, 97). While some readers might be put off by this, you'll appreciate how this keeps IPC discussions unencumbered. POSIX threading is mentioned where applicable, so it's not at all ignored, but readers of Rochkind's 2nd Edition or Robbins' books will notice that introduction of a PThreads overview can quickly overwhelm the rest of the text. Unique to any other text with which I am familiar is the inclusion of a section on Solaris Doors (also applicable to the Linux implementation), which is the fastest IPC method in Solaris, introduced with Solaris 2.6.

Something that both new and seasoned programmers will appreciate is the inclusion of a chapter on utility functions, and another on localization. The utility chapter provides great a discussion of (and reference to) the often-used functions that many other books ignore, such as string handling and manipulation functions, memory management, byte arrays, temporary files, error reporting, command-line argument parsing, character classes and more. While it's true that these aren't strictly systems programming topics, they are inevitably going to be topics of interest to most programmers. It is the inclusion of such topics that allows you to take your pile of reference books and replace it with this single volume.

A major topic to systems programmers today is 64-bit programming. Naturally, Solaris is a robust 64-bit environment, and is well handled in this book. programmers new to 64-bit environments, whether on Linux, Solaris, or other UNIX platforms, will greatly appreciate the gentle introduction to 64-bit coding, as well as best-practice techniques and sprinkled 64-bit wisdom throughout the text.

Like it or not, Solaris is the dominant commercial UNIX platform in the market today and will be for the foreseeable future. This guide doesn't pull any punches in giving you the best information available to exploit that environment to its full potential. If you're a programmer, this book gives you a single reference to consolidate your library and give you a new appreciation for familiar topics and entry point to things that you might have never leveraged before (Doors, 64-bit optimization, etc). If you're a system admin, you'll find a whole new appreciation for Solaris and UNIX in general with unparalleled understanding of how they really work under the covers, especially if you've already read Solaris Internals. Everyone will love the detail and completeness, combined with with the hundreds of tips (not to mention nifty Solaris trivia) scattered throughout the book. Rich's style is compelling and relaxed, very readable in front of your keyboard or with a cup of coffee on the porch. And readers will enjoy his sense of humor, which is admittedly subtle; experienced programmers and system admins, though, will enjoy the book's wit.

Finally, given the impending release of Solaris 10, yet another aspect of this book needs to be considered: it's an essential companion for DTrace users! Rich couldn't have possibly foreseen this need when he started writing the book, but it is extremely important today. Solaris 10 provides more visibility and debugging tools than any other UNIX system in existence today, the most popular of which is DTrace. But all of these tools expect the user to have a certain level of understanding of the system itself. This book should be standard issue for any sysadmin that ever plays with Solaris 10. When doing system root-cause analysis with DTrace, this book becomes an essential reference, especially if you are allergic to system headers. If you have been using DTrace and getting lost, or feel that you just don't know Solaris the way you need to, buy this book and you'll find the confidence and skills to get you back on track.

You can learn more about Solaris Systems Programming on Rich Teer's home page for the book. On that page the full contents and index are available, including a sample chapter (Ch 8 "System Information and Resource Limits," 62 pages!). You can also visit Teer's personal home page to learn more about him and his work. You can purchase Solaris Systems Programming from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Adrian Spinei writes "From a documentation point of view, Hibernate is one of the most notable exception in the world of LGPL'ed projects. Its website offers a plethora of information, from solid documentation (the reference has no less than 141 pages) and various FAQs to sample projects and third-party resources. The forum is quite active and you may get answers to tricky questions. Or a little bit of rough treatment in case you haven't RTFM - but that is understandable, given the number of questions that the authors have to answer every day. Under these circumstances, one might wonder what Gavin King (Hibernate founder) and Christian Bauer (documentation/website maintainer and Hibernate core developer) can add in order to be able to write a 400-pages book about Hibernate. I mean - sure - only by joining the reference documentation, different FAQs and guides, one can easily 'extract' a hefty 'manuscript' with more than 200 pages." Read on for Spinei's review of Hibernate in Action. Hibernate in Action author Christian Bauer and Gavin King pages 400 publisher Manning rating unavoidable reviewer Adrian Spinei ISBN 193239415X summary ORM pour les connaisseurs

Well, I am glad to tell you that this is not just a dump of the on-line docs. The book not only gets you up to speed with Hibernate and its features (which the documentation does quite well). It also introduces you to the right way of developing and tuning an industrial-quality Hibernate application. I consider myself a pretty seasoned Hibernate developer, being familiar with the API since its 1.2 version in Q1-2002 (if I remember well the first app when we used Hibernate). However, I was proved wrong by Hibernate in Action, which describes best practices and even API features that were unknown or vaguely known to me. That is, until now.

The first chapter, in the good tradition of all first chapters in the world, is an introduction. It's a very well written introduction about why do we need ORM solutions in OO applications. The chapter explains the O/R impedance mismatch, while declaring quickly that OODB sucks (immature and not widely adopted). Wel'll also find out that EJB also sucks from a persistence point of view (for various reasons). Which can be quite a surprise knowing that Gavin is one of the authors of EJB3.0 specs. Or, on the contrary, this will explain a lot of things in the new EJB specs.

Now that we have cleared the "why Hibernate" issue, let's continue to the second chapter. Which - tradition obliged - is a "Hello, world" and a "Let's get started" chapter. Here you go: almost 50 pages later you should be able to write simple Hibernate-based persistence layers and integrate within an application server, like for instance ... Jboss ! Humm, well, why not ? They are sponsors of the Hibernate project, after all.

In the 3rd chapter, our fresh knowledge will be put to good use by starting the development of an online auction application called CaveatEmptor. This app will follow our reading progression and will grow bigger and smarter chapter by chapter. But for the moment, we are at the inception phase. What gives: a little bit of analysis, a stylish class diagram of the domain model and the resulting mapping file. And if you thought (based on 2nd chapter) that the mapping file is very intuitive and simple, you're in for a big surprise -- it is, indeed, intuitive and simple! Quite bizarre for an open-source project. As a matter of fact, the mapping file is one of the pivotal elements of Hibernate, since it addresses directly the O/R impedance mismatch, a recipe for transparent linking your POJOs and the constrained relational model. No wonder that a big part of this chapter is aimed at explaining why and how the mapping works in Hibernate. You'll see how class associations and inheritance translate at the metadata and mapping level. You'll start to understand the things that you took for granted in the previous chapter and you'll have that pleasant "uuh, I see" chain reaction. Hold on, it's just the beginning.

Because chapter 4 is going to explain once and for all the lifecycle of persistent object in Hibernate, their behavior from a persistence point of view as well as the available fetching strategies. And if you thought you already knew everything by heart from the documentation ... well, maybe you do know everything by heart. Nevertheless, it's very well synthesized in chapter 4 and I'll recommend it anytime to a coworker eager for Hibernate knowledge.

In the next chapter (the 5th) the rollercoaster slows down a bit. That is, if you already know the behavior associated with the four possible isolation modes in transactions, what are the different types of locking, what (the hell) MVCC means and the importance of transaction scopes. Chances are you already know some of this stuff quite well, but everybody needs a refresher from time to time, especially when it's well explained and when it comes with versioning and caching (1st and 2nd level) in Hibernate as a desert. By the way, I thought that OSCache supports clustering, not only SwarmCache and JbossCache, as stated in the book. There's even a thoroughly explained example of using JbossCache as a level 2 clustered cache for Hibernate, but it shouldn't be too hard to convert to other types of caching systems.

Now, if I were the author of the book, I would have placed chapter 6 before chapter 5. But I am not the author, which is quite fortunate for you dear readers since Christian and Gavin are much more competent than me at writing books about Hibernate (and probably at some other unrelated domains). They have decided to go back to mapping in chapter 6, after the short transaction/caching intermezzo. Well, they should know better... it's time for a serious dose of advanced mapping. This chapter is attacking interesting subjects such as custom mapping types (simple or composite) and (finally) the mapping of collections. Special guests stars: the whole gang of "sets, bags, lists and maps", together with explanations about their relational equivalent (associations, associations and associations !). Oh and yes "polymorphic association" (section 6.4.3) - I wasn't even aware that Hibernate is able to do that... guess I'm not that 'seasoned' (as a Hibernate developer) after all.

The 7th chapter is about "Retrieving objects efficiently" : about 45 pages for the 'retrieving' part and 6 pages for the 'efficiently' part. Fair enough ! You'll learn how to master basic HQL queries (parameters, pagination ...). You'll get a grip on the query by criteria API, as well as on advanced stuff such as dynamic queries, filters, subqueries and native SQL (very powerful). At the end of the chapter there's the Hibernate-specific solution for the n+1 selects problem, query caching and result iterators.

Following this wealth of useful knowledge, the 8th chapter starts a bit dry. Nevertheless, after a short introduction about Hibernate in managed environments, you'll find yourself again in the land of advanced programming techniques : application-level transaction implementation ! This is mostly new stuff (at least for me) - a great collection of best practices for transactional behavior management in industrial-quality apps. Somewhat unrelated but still interesting, the chapter ends with legacy schemas integration and a smart implementation example for audit logging.

The 9th (and last) chapter is about the round-trip development in Hibernate using the classical toolset : Middlegen and/or hbm2java and/or XDoclet. All the available techniques are presented in a very detailed, step-by-step manner.

Wait : don't close the book, there's more ! Ignore Appendix A (a short and rather uninteresting document about SQL fundamentals - that is, if you know SQL). Appendix B contains mildly un-fascinating ORM implementation strategies pour les connoisseurs (come on guys, I'm just a dumb user). But - Appendix C is a great collection of real-world stories and by all means read them all ! Especially the last one, a treasure of hard to find knowledge (no spoilers, please...).

In the end, I have to confess that there is something truly interesting about Hibernate In Action : albeit very technical, it reads astonishingly easy - and this kind of books is unfortunately very rare nowadays. My congratulations to the authors for this excellent piece of work - it was worth the wait.

As for you dear potential reader, if you already know all the information detailed in the book, I bow before you, great Hibernate wizard.

You can purchase Hibernate in Action from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Ben Rothke writes "As Henry David Thoreau observed 'The mass of men lead lives of quiet desperation.' That being the case, novels are written, to briefly take such men, out of that quiet desperation, even for a short while. Novels therefore require a certain melodrama and fantasy element. For if the novels lacked such exaggerated drama, it would suffice to read the New York Times, and not Tom Clancy. It is with such a backdrop that The Mezonic Agenda: Hacking the Presidency was written. The book is billed as an interactive techno-thriller novel." Read on for the rest. The Mezonic Agenda: Hacking the Presidency author Dr. Herbert Thompson, Spyros Nomikos pages 448 publisher Syngress rating 7 reviewer Ben Rothke ISBN 1931836833 summary A melodramatic exploration of the dangers of combining unscrupulous electronic voting system makers with a political machine willing to overlook the systems' flaws.

The book chronicles the final week before security expert Professor Chad Davis is to testify before Congress on the security of a commercial e-voting software product made by a fictitious company, Advice Software, Inc.

Davis' testimony will ultimately determine if the software will be implemented for use during the United States' 2004 presidential election, and therefore create a huge windfall for the company. The company will do anything and everything it can to ensure that Davis provides positive testimony. Advice will stop at nothing to complete their mission; that means they'll engage in multiple murders, kidnapping and a slew of other nefarious activities. All of this is addition to simultaneously attempting to corner the video chip market, and create video drivers that send subliminal messages about which candidate to vote for.

As Albert Einstein said, "Make everything as simple as possible, but not simpler." The plot could have been made much simpler to mimic reality and the current state of insecure e-voting systems. As in real life, the e-voting companies are getting away with providing insecure e-voting systems; under the nose of the Federal Election Commission (FEC) and an unsuspecting and apathetic voting public. The idea that an e-voting software company would resort to murder is where the book demonstrates it is a novel.

The reason e-voting companies and their insecure software can run roughshod through the FEC is that voting-system flaws do not have the same immediate tragic consequences that other product failures can. Plane crashes and adverse drug effects spur the FAA and FDA to take drastic actions and often overreact to an event; poorly written and insecure voting software is clearly not as newsworthy as a burning jet.

Combine this with a public that is utterly apathetic to voting in general and the situation is ripe for the situation where e-voting can have a near hypnotic effect on most people involved. Because voter turnout for U.S. presidential elections is quite low (60% of eligible voters cast their ballots in the November 2000 presidential election), and most people are completely unaware of the dangers of insecure voting applications, an under-funded federal agency can be manipulated by the e-voting vendors to roll out insecure voting software.

The international intrigue of the novel takes the reader to the RSA security conference in Amsterdam, where Davis is given a cryptic CD-ROM by Baff Lexicon, a notorious international hacker. Lexicon suggests there is serious problems with the software and will brief Davis at midnight that night at the Amsterdam Hard Rock Cafe on the details. Unfortunately, Lexicon is being trailed by undercover agents from Advice, and is murdered a few hours later by a Yugoslavian hit man that the company seems to have on retainer.

Davis now has the difficult job of unlocking the cryptic information on the CD-ROM on his own. That same CD-ROM is included with the book, and the reader is invited to join Davis in attempting to decrypt the contents of the CD and the conspiracy that Advice Software is attempting to perpetrate; namely the outcome of the 2004 election.

(If you are not interested in buying the book, anyone can download the software without having to buy the book. The software is actually part of a contest and the winner will receive a free pass to the BlackHat 2005 conference.)

A good section of the novel then details how Davis attempts to decipher the secrets that Baff Lexicon was attempting to convey to him. The two authors of The Mezonic Agenda have, respectively, a PhD in applied mathematics and a Master's in chemical engineering, and write in a someone choppy style representative of their technical backgrounds. Occasional errors in grammar and spelling are excused, save for the egregious misspelling of Learjet on page 154.

The story concludes with a moral dilemma that Davis faces: with his wife and daughter kidnapped by the Advice Software hit man, does he provide favorable, yet dishonest testimony about the software and watch his family set free; or tell the truth and watch them die?

The novel itself takes up 240 of the books 370 pages, with the last five parts dedicated to a history of voting, reverse engineering, cryptography, buffer overflows and steganography.

As a standalone novel, the book (while entertaining and enjoyably readable) is somewhat overpriced at $34.95, especially since the enclosed CD-ROM is freely downloadable and the plot is somewhat thin. The non-fiction final section, though, is quite informative and effectively complements the novel.

This novel does a good job of explaining how software can be cracked, and provides the reader with a good overview of security concepts such as buffer overflows, reverse engineering, cryptography, and more. It is hoped that the book will find itself in the hands of members of Congress and the FEC, who truly need to be educated in such fundamental security topics.

As a novel, The Mezonic Agenda will not compete with books from Tom Clancy or Robert Ludlum. But because insecure e-voting is one of the greatest threats to democracy today, it is a much needed title.

You can purchase The Mezonic Agenda: Hacking the Presidency from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Himanshu Rath writes "Computer Networking First-Step by Wendell Odom fills a long standing void for a truly introductory book which can be read and understood by anyone in less than a month. There are other excellent publications in Computer Networking (e.g. classics by Kurose and Ross, Stevens, Tannenbaum, Comer, and Cisco Press CCNA and CCNP companions, etc.) but they all embody different degrees of complexities and typically need at least one college semester to go over. What about those who do not have the time or inclination to spend a semester in a computer science class? Odom's book might be the answer." Read on for the rest of Rath's review. Computer Networking First-Step author Wendell Odom pages 515 publisher Cisco Press rating 8 reviewer Himanshu Rath ISBN 1587201011 summary A beginner's - no experience needed- guide to computer networking

When I am sitting in front of a computer in San Francisco and exchanging email with a friend in New Delhi, or we are chatting using MSN or the Yahoo! Messenger program, there is a mind-boggling array of data transformation between the sender and the receiver. All our analog data (speech, type face, etc) is transformed to digital data (binary digits of 0 and 1.) We are analog creatures, but the infrastructure for computer communication on which we are so hopelessly dependent is strictly digital. This infrastructure is responsible for various layers of encapsulation/decapsulations, encoding/decoding, etc to move the data through a 'cloud' of intermediary hubs, switches, and routers (the 'cloud' is a black box to us) and establish communication between the end users. The rules (or protocols) at different layers are complex enough, and to make matters worse, the rules inside a Telco network through which our data travels can be very different from the rules in our LAN data network (the Telco network is usually a black box to the data communication folks). Breaking this highly complex phenomenon into smaller, simpler constituent parts is what this book is about.

This book is 515 pages long and is divided into 18 chapters. Odom starts by defining a network in terms of its constituent elements, and goes on to explain how three blind guys -- the Server Guy, the Cabling Guy, and the Network Guy -- perceive the Network 'Elephant.' The authors and the editors have tried hard to explain abstract concepts with real life examples; for example, they tell us how to how to eat a dinosaur (OSI 7-layer model) versus how to eat an elephant (TCP/IP 4 layer model). The whole narration takes place in terms of the human experience of fictitious characters named Fred, Wilma, Barney, Betty, Keith, Conner, Larry, Archie, Bob, Hannah (etc.), who internalize the electronic data communication protocols into their own behavioral model. This tactic makes for easy reading by helping us understand the unfamiliar in terms of the familiar. Many newcomers to networking get discouraged by the learning curves for OSI and TCP/IP, and quit before getting to LAN and WAN. The author addresses this concern by strictly focusing on the concepts and leaving the details out for another day.

Odom's description of LAN as roadway and sharing of the local roadway through hub to find destinations is easy to follow. The rules to follow on the roadway cover wrecks, and also how to recover from the wrecks. His description of WAN as leasing hundreds of miles of network cable drives home the basic concepts. The hosts file is explained as a phone book, and AAA as a means to allow the right people and keep out the wrong people. Under the veneer of lightheartedness Odom manages to sneak in the concepts ranging from 4-wire WAN circuit to 802.1Q trunking, VLAN to VPN.

This book introduces many contemporary networking concepts, and would have been more complete with a chapter on wireless networking and VOIP. The diagrams are uncluttered and easy to follow for reinforcing the concepts. The index is manageably short but to the point. The best thing going for the book is its relaxed, you-can-do-it tone. However, this is not for everyone, certainly not enough for anyone seeking IT certifications. If you are looking for a conceptual understanding of computer networking to untangle the underlying mystery, read this book. I think this is a great text for high school students, home computer users, and even computer professionals who do not deal with networking in their daily work. If you are looking for details about networking standards (necessary for any certification test), find a more advanced text.

You can purchase Computer Networking First-Step from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

norburym writes "W. Jason Gilmore and Apress have put together an impressive volume, both in girth and content, in Beginning PHP 5 and MySQL, From Novice to Professional. At first glance, it appears that any technical manual that tries to approach such heady stuff such as PHP and MySQL for an audience ranging the span from beginner to the uber-geek is headed for failure. Happily, I can report that Gilmore and Apress have given the world one book that will replace many other PHP and MySQL volumes. This is one that the reader will consistently rely on and keep near to hand." Read on for the rest of Norbury-Glaser's review. Beginning PHP and MySQL: From Novice to Professional author W. Jason Gilmore pages 800 publisher Apress rating 9 reviewer Mary Norbury-Glaser ISBN 1893115518 summary PHP and MySQL

One key to the book's success is the manner in which Gilmore approaches his subjects. The text is split neatly into three sections: the first deals exclusively with PHP and comprises the bulk of the book's content, the second section goes into depth with MySQL and the final chapters deal with PHP/MySQL integration. This layout is where the promise of appealing to such a wide range of user abilities succeeds admirably. The beginner can read cover to cover and come out of the pipe with a solid, practical knowledge of PHP, MySQL and how to combine the two to build advanced web applications. An experienced MySQL or PHP guru can skip the area of his expertise and gain much from the chapters on the other. A more advanced user can use this book as reference material, skim the chapter outline, pick and choose topics of interest and quickly find the answers they seek. Everything is cleanly written, with little or no anecdotal filler or asides. Each chapter begins with a nice overview of what will be covered and ends with a brief but concise summary.

Gilmore begins with nine chapters specific to the PHP language and its many core features and extensions, taking particular care over installation and configuration issues (platform specific instructions are included for UNIX/Linux (Mac OS X users can swim in this pool very easily) and Windows), basics (data types, variables), functions, arrays, PHP's object-oriented functionality and expressions. The next ten chapters delve deeper into PHP's file and operating system functions, web form integration, http authentication, file upload management, LDAP, session management (one of the best aspects of PHP and incredibly easy to use), Web Services (SOAP, SimpleXML extensions as well as NuSOAP and MagpieRSS -- cool stuff!), security and PHP's SQLite database extension. SQLite is an exciting multi-platform database engine that will most likely prove to be hugely popular in the near future. It's interesting to note that Apple plans to integrate SQLite into their next release of OS X, Tiger. Also of note is Gilmore's well-written chapter on PHP and LDAP. He provides an extremely competent introduction to LDAP and PHP's LDAP extension. If you work in an enterprise environment, this knowledge will become an integral part of your mindset and vocabulary.

The SQL section of the book is compact and concise. Gilmore manages to take the reader through a fast but detailed introduction to MySQL. Installation and configuration, clients (the standard set and some GUI based administration clients), table structures and security/user management are all explained with precision and an eye toward practical expectations.

Chapters 26 through 30 stand out, with an integrated approach to both PHP and SQL. This is where Gilmore pulls it all together. The reader is introduced to PHP's MySQL functionality, creating MySQL database classes, indexing and searching, transactions and importing and exporting data. There are numerous excellent real-world examples throughout this section that will enable the reader to create elegant, advanced web applications.

Gilmore removes the complexity and ambiguity inherent in many technical books and gives the reader a detailed approach to these two wildly popular open source packages. Beginning PHP 5 and MySQL will definitely serve the novice, the professional and those in between. For anyone wondering what all the fuss is about with PHP or MySQL or for anyone who has wanted that one volume that will explain it all, this is definitely the book for you. It is at once an excellent tutorial and an indispensable reference manual.

You can purchase Beginning PHP and MySQL: From Novice to Professional from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

honestpuck writes "As someone who lives on the wrong side of the world from the best sources of information and shopping I seem to spend a large amount of time online, and a large part of that in a search engine. Web Search Garage promises to let me 'Find it faster with less junk, less hassle.'" Read on for honestpuck's review of Web Search Garage. Web Search Garage author Tara Calishain pages 227 publisher Prentice Hall rating 8 reviewer Tony Williams ISBN 0131471481 summary An excellent guide to search engines and searching for beginner to moderate level

For experienced net researchers and the search-engine savvy among us, the book may well not live up to the promise, though for a large number of 'net users out there it may be just the thing. Where Calishain's previous book, Google Hacks , covered one search engine in great depth in a fairly technical way, this book covers the entire topic of web research in a more friendly manner and language, leaving out the more technical topics of APIs and programming interfaces to spend more time covering advanced search syntaxes and off-the-beaten path search engines and directories.

Calishain has for quite a while written well-researched, informative articles on search engines and research for her weekly newsletter and website ResearchBuzz and the time she has spent on the topic and writing experience have informed this volume. She starts out with the absolute basics, the difference between a search engine (Google) and a searchable subject index (Yahoo) before going on to cover how to get the best out of each.

The book also covers a wide range of search related topics such as finding jobs, local information, multimedia or information about people and Genealogy. Almanacs, dictionaries and encyclopedia get covered. It's hard to think of something missing. Calishain has also taken a great deal of care with her topics. In the section on searching for drugs and medical information, for example, she stresses checking the reliability of your sources.

If you visit Calishain's site for the book at Web Search Garage (which redirects to the book's page at her ResearchBuzz site) there is a link to the table of contents and an example chapter. She also has two 'freebie' articles, 'Four Things Yahoo Can Do that Google Can't' and 'Seven Ways to Save Time Searching' that are further good examples of her writing and the usefulness of the content. She also has an offer for a free six-month subscription to ResearchBuzzExtra, her paid extension to ResearchBuzz.

This volume has gone for breadth instead of depth. That, and the low starting point should make it an ideal beginners book. Since I had on hand my daughter Jessica (a slightly tech-savvy twelve-year-old with a brand-new broadband connection), I lent her my review copy of the book. The response:

"This book is absolutely fantastic and I love it to death! I loved how Tara writes about Google and Yahoo and also about smaller search engines. By reading this book you find out how to find the exact information that you want. Also there are many websites in this book that are very helpful. To make the most of them I wrote them down then later checked them out on the internet. There are heaps of helpful sites for kids and heaps for all ages. Sites for fun and sites for information. I love that it is written as if Tara is talking to you and you are just reading instead of listening. It's a really cool book but if you are going to read it you need to know a little about searching the internet first. A really great book."

Jessica is correct about the language. Tara has written in a light, conversational style that lends itself to quick reading. At the same time either the writing or the editing has been quite tight, the information is packed in. This is a book that needs, indeed deserves, a second read.

The perfect book for the average web user who wants to improve his research skills. I'd put this one in the Christmas stocking for all those people who are getting a new computer or a new broadband connection. That's not to say that the more technical savvy will find nothing in this book, so if you give a copy to someone, either read it first or borrow it back -- you may find it worth enough to get your own copy.

You can purchase Web Search Garage from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Sarusa writes "Video games are big business. Movies are big business. I hear that people used read a lot of things called books: it seems like there would be a lot of money to be made from a successful merger of what makes books and movies compelling with what makes video games compelling, though we've been trying that for decades with little success. Interactive Storytelling: Techniques for 21st Century Fiction by Andrew Glassner takes a look at what we know about stories, what we know about games, how they work (or don't work) together now, and how they might work together in the future." Read on for the rest of Sarusa's review. Interactive Storytelling author Andrew Glassner pages 500 publisher A. K. Peters rating 7 of 10 reviewer Sarusa ISBN 1568812213 summary A solid look at the elusive merger of movies and video games.

First, this is a book that everybody who wants to make compelling games should read. That said, however, it isn't really a book you would read for fun -- it's more of a textbook. The first half of the text is a necessarily rather dry presentation of concepts: for example, nine pages on 'Narrative Devices.' Glassner uses copious examples from movies that you've probably seen and games that you've probably played, and the text is certainly an easy read and well written, but it's still a very step-by-step presentation. You can't hide the fact that you're supposed to be learning something here. The second half of the book does open up a bit as he goes beyond just priming you on story and game theory.

He starts out by assuming you know almost nothing about storytelling. You might think that this is too obvious, but if you've played enough storytelling abominations like 'Sudeki,' you will know that game creators usually don't make very compelling storywriters. So the first quarter of the book is a crash course on the fundamentals of writing stories -- characters, plot, and techniques. The second, slightly shorter, part of the book examines the mechanisms of games in general. Not video games in specific, but all types of games. The five types of games, scoring rules, structure, and theory.

We're now ready to actually tackle merging stories and games, and at this point our cunning vision falls apart. Glassner's strongly held opinion, which he argues quite coherently, is that a great story is the product of one (or a few) expert storytellers presenting a strong, consistent vision to you, the consumer. The fabled holy grail of gaming is letting the player do whatever they want -- full interactivity. And this is to a point fundamentally incompatible with telling a great story. Conflict drives most stories -- what if the player quite reasonably minimizes conflict? But there's a lot to be learned from where they do contradict each other, and some common ground to be found. In my favorite chapter in the book, 'Common Pitfalls,' he uses specific video games that blatantly demonstrate how to not apply even the simplest rules of good storytelling and user immersion.

Many of the fundamental insights in this part are 'obvious,' yet demonstrably unobvious to most video game designers. For example, that people gravitate toward the entertainment that has the highest fun-to-work ratio. Television is hugely popular since the fun is high to very low, but the work is near zero. They will do more work if it offers a lot more fun. Which means you shouldn't force your players to do stupid, boring, unnecessary work like running through a dozen screens again and again to get between important locations. "A game should offer the fastest and easiest possible way to do everything unless there is some entertaining or informative reason to prevent it." Preach on!

The last part of the book finally deals with the 'interactive storytelling,' slowly building up ever more ambitious plans till we're in the realm of the purely experimental. Several reasonably fleshed out examples are given, and some of them seem quite plausible even with today's technology. The balance between future technology (holograms and AI) and the reality of today is considered. Glassner is quite a skeptic about AI and the holodeck from Star Trek, but explores how tricks such as emergent behavior and setting expectations low and then beating them can work for you. For instance, if your AI is driving an animal (rather than a human), the players will be much more forgiving. Or if you give the user attractive, static graphics up front, they will be projected onto the cruder in-game graphics. Because of the conflict between a great story and complete interactivity, he suggests 'participatory storytelling' is a better goal than fully interactive storytelling.

Particularly interesting is the discussion of 'living masks.' Most people don't like to act, because they know it takes skill and that bad acting is very painful. But what if you could be 'in' a character that would take what you were doing at home and then do it in character on stage, so everyone involved could act to the best of their abilities but still 'be' a good actor? You'd have some control over the gross reactions, but the details would be up to the software. Obviously, we're nowhere near that level of sophistication, but there's a lot of time left in the 21st century. It does mean that a large portion of the book deals with techniques that are right now totally impractical.

My biggest disappointment with this part of the book is that it implicitly seems to assume that all games in the future will be multiplayer, as they're the focus of all the examples. And at this point Glassner has pretty much transcended mere 'games' for his vision of the future of entertainment. But it's easy to see how they could be adapted to the single-player games which will hopefully still be available in 2099.

To summarize, I think anyone with a serious interest in telling stories via video games or interactive fiction should read Interactive Storytelling. It's well written and does a good job of teaching concepts that most people making currently making video games could use a lot of help with. Furthermore, Glassner's vision of the future of storytelling is fascinating, even if it doesn't play out that way. However, I would not recommend that you pick this book up as a casual read. If you're looking for that, you might be better off with Creating Emotion in Games by David Freeman or perhaps The Art of Interactive Design by Chris Crawford. Or, though it somewhat destroys the rigorous chain of thought, skip the first half of Interactive Storytelling, then go back and digest it piece-by-piece later.

You can purchase Interactive Storytelling from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

William Nichols writes "With a couple of projects coming up that are going to require complete W3C CSS and XHTML validation (with 1 client requiring just a pure CSS layout) I thought it was time to brush up on some CSS knowledge, and maybe learn a new thing or two. I have spent the past week with a newly released book (and one of the smaller CSS books out there), the Web Standards Solutions The Markup and Style Handbook. The author, Dan Cederholm, has now become my right hand man, so to speak." Read on for the rest of Nichols' review. Web Standards Solutions: The Markup and Style Handbook author Dan Vederholm pages 253 publisher Friends of Ed rating 8.5 of 10 reviewer William Nichols ISBN 1590593812 summary A clear reference on designing with XHTML and CSS through a standards based approach

With the title Web Standard Solutions (which we will refer to as WSS from here on), you might expect this to be a book that is going to solve your problems, and without disappointment that is exactly what is does.

WSS takes a problem based approach instead of the commonly used project based approach to teaching you the value of designing to strict standards. I found this approach very refreshing, WSS kept my attention by presenting a problem, and then presenting 3-5 solutions on how to accomplish the task at hand. With each example Dan takes you through several ways to achieve the required result. Each of the methods shown are common patterns that different developers/designers would use, and the pros and cons of each are well articulated.

A lot of you may know Dan from his Simplebits. website. If you frequent Simplebits you will immediately recognize his style in the writing of WSS. Much like the mini quizzes that are used on his blog, this book is really a compilation of the hurdles that you are likely to face when trying to design to strict standards, and the solutions presented will get you over them.

WSS will also help the budding developer realize the business value of designing to standards. Once you start designing with standards, search engine rankings can jump, continued maintenance becomes a breeze, and the accessibility to screen readers (or other requirements) can be elegantly met.

One of my favorite parts of the book is the in-depth techniques used to style lists. WSS shows you how to take a regular non-formatted list and, using CSS, style it in several ways: as a vertical shopping list; without bullets and indenting; with custom bullets; and eventually as a horizontal navigation bar with changing bullets.

This book really stands out when covering the most basic foundations of layout such as paragraphs, lists, headers, titles and the like. The first half of the book really gets into the proper use of the most basic CSS techniques and proper selection of tags for headings, quotations, etc. While the second half of the book requires you to use what you have learned along the way to start building CSS based layouts.

If you are a regular at some of the advanced sites like CSS ZenGarden or A List Apart this book may be a little basic for you. Even still you will probably be able to take some techniques from it that you can use, this book is really more for the designer that is capable but not quite deadly with their CSS knowledge.

Overall I would give Web Standards Solutions the Markup and Style Handbook an 8.5 out of 10. I really think it does a fantastic job at keeping the reader interested in the subject (something that is often very hard to do in technical books) and will definitely be a great business tool for you. A quick read it is, but a valuable reference that has earned a spot next to my keyboard, my 3 bars of caffeinated soap, and the trusty case of bawls.

You can purchase Web Standards Solutions: The Markup and Style Handbook from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

vertigo writes "I am reasonably proficient in C and C++ as well as the more common scripting languages, but i always felt the lack of a sweet spot between the hard and fast low-level programming languages and the loosely typed scripting languages. Lately, my interest in the Mono project has been growing. The C# language appears to offer just that sweet spot between power and productivity I've been looking for, and its class libraries like Gtk# seem to provide the programmer with a very clean and intuitive API." Read on for vertigo's review of Mono: A Developer's Handbook from O'Reilly. Mono: A Developer's Handbook author Edd Dumbill and Niel M. Bornstein pages 278 publisher O'Reilly Media, Inc. rating 8 reviewer vertigo ISBN 0596007922 summary An introduction to programming with Mono

When learning a new language such as C#, or working with a new development environment such as Mono, it usually takes some time before you get up to speed in developing programs. Wading through the reference documentation and reading other people's source code often provides much-needed information on how to do certain things. Both, however, are very time consuming and tedious.

Enter Mono: A Developer's Notebook. This book provides a series of task-driven chapters which are thin on theory, but rich on practical content and example code. The featured code snippets are, in contrast to ones in books that teach theory and concepts, not solely designed to illustrate a specific theoretical aspect of programming. Each one is designed to perform a useful task that is essential in day-to-day application programming. What sets this book apart from the multitude of .NET books already available on the market? In order to answer this question it is neccesary to provide a short introduction on Mono.

Mono is essentially an open source cross-platform implementation of Microsoft's .NET development framework and implements the API's which are standardized by ECMA. It is, however, not an exact clone. Besides providing a (partially implemented) stack that provides compatibility with Microsoft's .NET API's, Mono adds a whole new API-stack of its own, consisting of open source technologies such as the Gtk+ toolkit and the Gecko HTML rendering engine. This makes it possible to develop cross-platform applications based on open source technology while (mostly) compiling from a single code-base. In contrast to most .NET books available on the market, which focus primarily on Microsoft's API's in the context of Visual Studio.NET, this book concentrates on the basic ECMA API's and Mono's own open source stack. A complete coverage of .NET and the Mono architecture is outside of this review's scope, so for more information you are advised to check the Mono Project's website.

Before we dive deeper into the content of the book, a short introduction on the Developer's Notebook series by O'Reilly may be useful. The books in this series are styled to resemble the kind of notebooks college students carry around during their classes in which to take notes or, more commonly, draw caricatures of their teachers. The 'notebook' theme persists throughout the look-and-feel of the book. The 278-page thick paperback has a glossy blue cover, complete with faux post-it note and coffee-stains. Inside, the pages are not clean white but lined like the pages found in math notebooks. In the margin, useful comments are scribbled in a font that resembles handwriting. At first I suspected that the 'busy' look would distract from the content, but in practice this was no problem, thanks to the thick black typewriter font in which the bulk of the text is printed.

The chapters in this book are referred to as labs. Each of them focuses on a specific set of tasks and/or features and is divided into several paragraphs. Most paragraphs consist of a number of standard sections following a rigid formula that help you understand a certain aspect of working with Mono. The most common sections are:

• How do I do that?: Often using a liberal amount of practical code, this section shows how to accomplish the task at hand, for example working with files.
• How it works: In this section, the code and concepts involved in the previous section are explained more in depth, step by step.
• What about...: Offers a short focus on more advanced topics or pitfalls.
• Where to learn more: If you are craving more information after reading the previous sections, you are often offered a helping hand on where to find more information, providing url's to relevant documentation such as MSDN and other websites.

The first chapter, Getting Mono Running, describes how to get Mono up and running on Linux, Windows or Mac OS X, and how to compile from source on other platforms. The installation instructions for Windows only describe how to install Mono and Gtk#. Integration of Gtk# only in an existing Visual Studio.Net installation falls outside of the scope of the book, but a recent blog entry offers some hints on how to accomplish this. Besides installation, the first chapter offers a short description of the individual tools that make up the mono development. After installation, you will want some kind of editor or IDE to work with. Both the MonoDevelop IDE and several other ways of integrating Mono into your existing environment as a Java or Windows developer are covered. Finally, the community is an important aspect of every open source project. Ways of interacting with the community as well as a guide on how to submit bugs and links to some working Mono/C# applications are part of this chapter.

The C# introduction in the second chapter, Getting Started with C#, is tailored towards people who have at least some proficiency in using an object-oriented language such as C++ or Java. Some differences between C#, Java and C++ are discussed, as well as the differences between value- and reference types, the basics of error handling, working with assemblies and more. Concepts such as classes, methods, inheritance and namespaces are assumed to be known territory. If you have no previous programming experience, Mono: A Developer's Notebook is only useful in combination with a book that teaches programming with C# such as The C# Programming Language by Anders Hejlsberg.

An important part of any modern language is its class libraries. The third chapter, Core .NET, provides an introduction to the standard Framework Library Classes, which describes essential everyday tasks that are part of every program, such as working with files, strings, searching for text patterns and handling collections of data. Besides those basic functions, the chapter also dives deeper into the internals of a compiled assembly, the handling of processes and easy multitasking using threads. Finally, the last paragraph explains how to use a .NET version of the JUnit Java Unit testing framework, Nunit, to test your code.

Developing Gtk-applications with Mono and C# is remarkably easy. Chapter 4, Gtk#, describes the basics of writing Gtk# applications. First, it's neccesary to remark that Gtk# might be a bit of a misnomer. Besides the raw Gtk+ toolkit functionality, Gtk# also includes most of the Gnome libraries like gconf, the gnome canvas, libglade and more. Chapter 4 describes functionality available in the Gtk namespace, the basic Gtk+ toolkit. Gtk+ is a constraints-based toolkit, which means that widgets are not positioned using absolute pixel coordinates but rather on basis of their logical relation to each other. This can be a bit confusing for novices, but this chapter provides a good introduction to the basic principles of writing layouts using Gtk#. The authors provide descriptions of essential operations that almost every application needs, such as creating menus and drawing pixmaps (or more advanced things like using the treeview widget and drag-and-drop), assisted by easy-to-read code snippets.

While chapter 4 introduces basic Gtk# functionality, chapter 5, Advanced Gtk#, delves deeper into more advanced features of the Gtk# library which also include functionality outside of the basic Gtk-namespace, such as the Gnome libraries. Working with Gnome button toolbars, the Glade user interface designer, storing your application settings in Gconf, setting up some preferences through the use of a wizard/druid, asynchronous operations and threading to increase responsiveness of your application while performing background tasks, rendering HTML in your application using the Gecko rendering engine and internationalisation and translation of applications are all described in this chapter.

The use of XML is tightly integrated throughout the Mono framework. It is, for example, the underlying format of the messages that web services use to communicate using the SOAP and XML-RPC protocols. The 6th chapter, Processing XML, describes the XML functionality available in Mono. It starts off by simple operations, reading and writing to an XML-file using relevant examples such as RSS and Dashboard clue-packets. It then proceeds to describe how to modify XML in memory, how to navigate and transform XML using Xpath and XSLT, how to constrain XML in several ways and how to serialize and deserialize objects into and from their XML representation. As in previous chapters, the information density is very high so it might take several reads to grok everything explained. The code examples and accompanying text however are very clear and concise.

The 7th chapter called Networking, Remoting, and Web Services describes the networking functionality available in Mono. The chapter starts off with ASP.NET. Mono's stand-alone XSP webserver and Apache integration with mod_mono are discussed, as well as the basics of writing a web application using ASP.NET's code-behind functionality which enables web applications to completely seperate presentation from the underlying code. Communication using plain tcp/ip, remoting using binary serialized objects and invoking remote procedures using XML-RPC as an alternative to SOAP are also described in this chapter. You might want to encrypt the data you send over the network, so a basic description of the Mono cryptographic API is provided. Finally, a short introduction to database handling using ADO.NET concludes chapter 7.

The 8th and last chapter titled Cutting Edge Mono starts off with an introduction on how to use the GNU Automake, Autoconf and the pkg-config tools to create an easy to build source package of your project. It then proceeds to describe various pitfalls and considerations in case you want to write cross-platform applications using Mono, such as filesystem layout, configuration storage and the calling of native code using p/invoke. A particularly cool project is IKVM, which translates Java bytecode into the Common Intermediate Language bytecode Mono uses. This enables Mono to run Java applications and allows Java and Mono code to inter-operate. A short introduction on the use of IKVM is provided, as well as some code examples on how to call Mono assemblies from Java and use the Java class libraries from within Mono applications. The chapter ends with some other cutting-edge functionality, like how to run a development version of Mono, a preview of the Generics (templates in c++) implementation available as featured in C# 2.0 and how to write Mono programs in Basic.

What is missing? The book doesn't contain a reference section on any of the described API's. If you need detailed information on the C# language specification or an API reference you will need to consult external resources such as the documentation provided with Mono, MSDN, or a separate book covering the topic to make optimal use of the information contained in this book. Fortunately, the book kindly provides pointers on where to find those. The information-density is much higher than you would expect from a book this size. This means the information contained in it is terse. Many topics are treated in a only a couple of pages and the book doesn't take time to explain a lot of programming concepts. The information gets you 'on the road' quickly however, which is exactly what this book is supposed to do.

The strength of this book is that it fills the gap between the earlier-mentioned reference documentation and the need to go out and try to read sourcecode to find out how a particular thing is done. The writing style is clear, concise and neutral. Some topics are clarified by the use of screenshots, which is especially useful in the chapters dealing with Gtk# widgets. All in all, if you are a developer with previous experience in object-oriented programming, Mono: A Developer's Notebook will provide you with an excellent introduction into many of the aspects of working with Mono, its associated libraries and programs.

More information and a sample chapter can be found at the book's homepage.

You can purchase Mono: A Developer's Handbook from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Sarusa writes "Simulations and the Future of Learning chronicles the attempt by one company -- convinced that the business e-Learning establishment has squandered its potential to build a 'leadership simulator' -- to actually create such a thing, and by doing so prove that simulation is a better educational tool than straight linear regurgitation. The sheer chutzpah of trying to simulate 'Leadership' may stagger you, 'but it means there's plenty of room for interest here. While not quite comparable to The Soul of a New Machine, as a breathless blurb suggests, it is a highly interesting read." Read on for the rest of Sarusa's review. An Innovative (and Perhaps Revolutionary) Approach to e-Learning author Clark Aldrich pages 280 publisher Pfeiffer rating 9 of 10 reviewer Sarusa ISBN 0787969621 summary The story of the creation of a 'leadership simulator' and an argument for simulation as the future of education.

This isn't really a technical book -- it's a manifesto aimed at the middle- to upper-level manager, and indeed the very first page is an executive summary that attempts to convince you to read this book while swilling martinis instead of playing another round of golf. But don't let that throw you -- it provides enough medium- to low-level meat to keep a geek happy (and after my review of > Shaggy Steed I think I can claim to be a huge nerd). You certainly won't find any code, but it's not a puff piece.

Clark Aldrich had a cushy job at the Gartner Group in charge of e-Learning coverage, but felt that the promise of e-Learning was being distressingly wasted by emphasis on the fast-food mentality of quantity over quality and churning out of tons of linear crud, just because it's so easy to do. The real promise of e-Learning isn't just as an online textbook, but as a simulator. And for life-or-death situations, it's the best way to teach people before letting them take a whack at the real thing. The U.S. military knows this. Airlines know this. Medical colleges know this. 'The organizations that care the most about training use simulations.' So he quit his sweet but corrupt job, and co-founded a company to teach leadership via a simulation: 'Virtual Leader.'

The sheer scope of the company's ambition had me shaking my head, convinced that this was going to end in brilliant failure. Especially as they decide one piece at a time that they need to write everything, including the graphics engine, from scratch. But finally, over time and budget, harsh reality sets in and they start distilling their huge collection of data on the nebulous concept of Leadership down to something workable. The meeting is the crucible where everything gets done in the world of the manager.

Virtual Leader places you in progressively higher-powered meetings and tracks their 'Three-to-One' model of leadership: good leadership is getting positive Work done in the short and long term, and levels of Power, Ideas, and Tension affect this. It's your task to try to ferret out good ideas and get them agreed to while heading off bad ideas. Of course, in later meetings you won't be the most powerful person in the room, so you have to carefully nudge things where they need to go by making alliances and building and spending your personal influence. At the end you're ranked on how you did on several metrics. And, of course, all this has to be simple enough for a computerphobe to use.

Simulations follows the project stage-by-stage from concept to finished product: what went wrong, what went right, what hard decisions and tradeoffs had to be made. Perhaps most fascinating is the dialogue system. It's not a script; the characters are all actually responding in real time to simulation variables from a library of 2500 voiced phrases. Thus it sounds slightly stilted and unnatural, but you can tell what's going on. And it isn't as mind-numbingly dull as the repeated generic approval/disapproval phrases they started with.

The book is a fast and easy read -- you could easily finish it in a night. The section on their failed dealings with supposed Leadership Gurus is extremely funny. And he dishes out the dirt on the e-Learning industry pretty well. What keeps Simulations from New Machine stature is the lack of any connection with members of the team -- there's no personal tension or pathos. The real star is the simulation itself. After all, his goal for the book isn't to provide you with human drama, but to sell the corporate world on simulations and demonstrate the process of building one from scratch.

And in the end, Aldrich makes a strong argument that simulations are the real future of learning. I had fun reading this book: it didn't take too much time, and I learned a few things (including some guilty glances into the minds of mid-level managers). Two polygonal thumbs up. You can see movies of the product in action at simulearn.net, though unfortunately there's no demo -- they want you to cough up for the seminars. Or you could just read the book!

You can purchase Simulations and the Future of Learning from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

jmweeks writes "It comes in a black edition and a white edition, and I suppose this symbolizes the two schools of thought warring within. If you've been in any chain book store this month, you've seen its emblem--the raven in flight, the big swirling ampersand. Susanna Clarke's Jonathan Strange & Mr Norrell is something extraordinary: many adult fantasy novels are taken seriously by their readers, the nerds among us; Strange & Norrell is taken seriously by its publisher and its critics as well. It is a small complaint, then, to say that it is taken perhaps a bit too seriously by its author." Read on for the rest of Weeks' review. Jonathan Strange & Mr Norrell author Susanna Clarke pages 780 publisher Bloomsbury Publishing rating 7 reviewer Jose M. Weeks ISBN 1582344167 summary A serious novel of fantasy and magic.

It is one of the great themes of fantasy, maybe even the theme: that some art or technology of incredible power has been lost, lost for ages--and just now, just in the present, it has been resurrected. We seek awakening, we seek renewal--I don't know, we seek something, because from The Lord of the Rings to The Wheel of Time to Stargate, this theme resonates.

In Jonathan Strange & Mr Norrel, the lost art is magic. This is England as the Nineteenth Century opens, and magic--founded in this country by a king who was once its strongest practitioner, a king who reigned three hundred years--is not practiced any longer. Oh, hundreds of magicians still argue vigilantly over its customs and methods and history, but the casting of actual spells is beyond them.

Enter Gilbert Norrell, a strange little recluse of a man, who hoards books and does his damnedest to end the career of any magician he can find. Who is also, by the way, the first Englishman to do magic in centuries. Mr. Norrell's purpose is to restore magic to England, provided it is studied and practiced under his terms, and preferably by no one but him.

Jonathan Strange, a young man who stumbles upon magic on a whim, who is to become Norrell's colleague, student, and adversary, has something slightly different in mind.

The subject here is not good versus evil, but a clash of ego and philosophy. The novel's villains are driven by fear, weakness, and self interest; its heroes by ambition and wonder. This complexity is what makes the novel a work of serious fiction, what prevents it from being an epic. Epics are fate-driven and rarely concerned with shades of motivation. Characters act because they must act, they must save the world or all is lost, etc., etc. Strange and Norrell want with everything they have to restore magic to England, to found a school of thought, to--well, many other things that I won't spoil--and even if the whole story has been foretold, even if it is fated, it is a story that stems from their intentions.

This is not my complaint. That it is not epic I find refreshing. That it is character-driven I find engaging. In a book about magic, about the re-awakening of mysticism, my complaint is that there is so very little that is spellbinding. Jonathan Strange in particular seems to be driven by his own imagination, and yet he seems limited and his spells tend to do little more that move things about.

The novel takes place during the Napoleonic Wars, and not long after the magicians present themselves to society, they become employed in fighting back the French. This leads to a scene suggesting great imagination, a port blockaded by ships, sails, and even a crew, all made of mist. Yet once on the ground, Mr. Strange finds himself mostly occupied by making roads and then tearing them up again. This may be useful, but for a magician it seems petty.

That said, Clarke handles the particulars of spell-casting rather well. As a matter of plot, the novel's magic must follow certain rules: Spells must have limitations, bad results must be possible and irreversible, there must be no "take-backs." This is why, in the classic short story "The Monkey's Paw," the father isn't allowed to wish never to have made any wishes--we as readers don't accept stories that "cheat" that way. In Jonathan Strange & Mr. Norrell, Clarke skirts on the edge of cheating (she allows resurrection), but never really falls in. There is also the danger that spell-casting will devolve into a game of Mornington Crescent, which is to say a conspiracy among the magicians to pretend each isn't speaking complete gibberish. This Clarke nearly overdoes.

You may have heard that this novel is, well, Harry Potter for adults. Don't believe it. It's true that Clarke shares a publisher with J.K. Rowling, and that Rowling's success almost certainly affected the publisher's interest in pushing this novel, but the two authors share very little in terms of style. Clarke's work is witty but cold, while Rowling's prose is anything but subtle and a great deal warmer. I'm not the first, I'm sure, to make this comparison: I can think of few writers Clarke's work more clearly resembles than Jane Austen. Considering the setting of this novel, however, that's probably deliberate.

The main task of a writer of fantasy is to construct a new and different world, and in this Clarke has succeeded. Her overwhelming footnotes, the dozens of side tales told by one character or another, the books and customs and politics of an England not quite as it is, but wholly consistent unto itself--these build a believable whole, they tell an engrossing story, they suggest perhaps something more.

There is talent here, a great deal of it. I believe, on the evidence of Jonathan Strange & Mr Norrell, that Susanna Clarke does have some great books in her. But for the time being, with this, her first novel, we'll have to settle for simply "good."

You can purchase Jonathan Strange & Mr Norrell from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Peter Wayner writes "For most open source software users, there are few things as easy to understand or follow as an open source license. If you share your code and follow a few basic steps, you're in the clear. This simplicity is a bit deceiving because the licenses are really quite complicated if step off the well-beaten path. And if you happen to be accused of something odd like SCO's claim that IBM donated SCO-owned code, well, the normally simple rules turns into a thicket of brambles with three-inch-long thorns. Lawrence Rosen, a hacker turned lawyer, has stepped forward with a deep and important exploration of the law. Curious programmers will enjoy it, but it's indispensable for businesses trying to honor the rules while still closing off some of their code." Open Source Licensing: Software Freedom and Intellectual Property Law author Lawrence Rosen pages 400 publisher Prentice Hall rating 9 reviewer Peter Wayner ISBN 0131487876 summary Major open source licenses are dissected and compared; invaluable anti-FUD for businesses and enlightening for all free software enthusiasts. The tricky part of following the GPL and even the BSD license comes when you want to keep some of the code private. This isn't as nefarious as it sounds. Many people write their own software, keep it secret, yet run it on top of Linux. Others write proprietary web applications and run them with a BSD-protected version of Apache running on top of a GPL-protected version of Linux. If you stay on the right side of the lines, you're still Richard Stallman's best friend. If you link the code together in the wrong way, though, you're toast.

This has been a particular headache for embedded systems manufacturers. If the engineers take advantage of the openness of Linux and make some tweaks to the part that is officially Linux, the company must to distribute their changes too. If they merely create software that works like a regular program, then there's no need to distribute anything. (Notice the ASP in the URL!) I know at least one very sharp businessman who explained to me how he carefully made sure the proprietary code in his system would only be dynamically linked to the GPL-protected code. If he left things statically linked, he would be legally bound to release all of his code and his investors wouldn't allow that.

"You had to work with developers. We had to create a build process that very carefully keeps things separate. If we weren't able to do that, we wouldn't have been acquired," he told me.

Rosen's book is a guide for anyone who's trying to walk that line. It dissects the major (GPL, BSD, Netscape, Apache, etc.) as a lawyer would: this kind of legal writing is always eye opening for me ,because the courts often make decisions differently from programmers. They value abstract issues like damages and pay attention to the often nebulous concept of who "owns" a piece of code. Thanks to the hard work of the lawyers at SCO, the distinctions will continue to be important to everyone experimenting with open source.

There are a surprisingly large number of distinctions, both big and small, between the different licenses. For most of us, the differences don't matter. But it's fascinating to watch a lawyer take them apart and compare and contrast them. The BSD license and the Apache license aren't the same, even though they're close cousins. Who would have known?

This book is a wonderful start on the topic. But by the end, it's clear that it's only just the beginning. There are deep philosophical questions awaiting the movement. The distinction between statically and dynamically linked code was easier to define in the past, long before modern languages like Java and the emergence of the Internet. Are web services specified by a hard-coded WSDL file, an example of dynamic or static linking? Can the DNS service change a static IP address into a dynamic link? Enquiring minds want to know. Rosen's book is a great way to begin the exploration of these topics.

You can purchase Open Source Licensing: Software Freedom and Intellectual Property Law from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Martin Ecker writes "With the advent of powerful, programmable GPUs in consumer graphics hardware, an increasing number of shading languages to program these GPUs has become available. One quite interesting language that - in many ways - has a very different approach than other mainstream shading languages (such as Cg or the OpenGL Shading Language) is Sh. The recently released book "Metaprogramming GPUs with Sh" by Michael McCool and Stefanus Du Toit, both major contributors to the Sh project, explains the basics of the Sh high-level shading language and the corresponding API and also goes into some of the details of the implementation. The book is intended for an audience that is already familiar with traditional shader development for programmable GPUs. Also, a firm background in 3D graphics programming and C++ is a must for the interested reader." Read on for the rest. Metaprogramming GPUs with Sh author Michael McCool, Stefanus Du Toit pages 308 publisher A K Peters rating 7/10 reviewer Martin Ecker ISBN 0321197895 summary A book that describes an interesting shading language and accompanying API to program GPUs.

Before discussing the book in more detail, I will try to give a basic overview of Sh, since most readers will not be familiar with it. For a more in-depth look at Sh, I recommend taking a look at a recently posted Gamasutra article by Michael McCool (http://www.gamasutra.com/features/20040716/mccool _01.shtml), the paper on Sh from the authors presented at the recently held SIGGRAPH 2004 conference (http://www.cgl.uwaterloo.ca/Projects/rendering/Pa pers/#algebra), and of course the Sh homepage at http://www.libsh.org.

Sh started out as a research project at the University of Waterloo (http://www.cgl.uwaterloo.ca), and it is both a shading language and a runtime API to use the Sh shaders. As a shading language Sh is embedded into C++ as a domain-specific language, which is made possible by using C++ operator overloading and by defining special tuple and matrix types that are used extensively in shader code. So instead of defining its own language that requires a full compiler, like other shading languages do, Sh uses regular C++ syntax to describe shader code, which is then dynamically (at runtime) compiled to a specific backend, such as a GPU or possibly even the CPU. In addition to compiling to a specific GPU or CPU target, Sh can also be used in a special stream mode where a shader is applied to a stream of input tuples. This is very useful for general purpose GPU programming where the GPU is basically used as an additional processor to the host CPU (see http://www.gpgpu.org for more information on the subject). Finally, Sh code can also be executed in an immediate mode where every Sh statement is directly executed on the host CPU (without being compiled into a shader program), which makes it very easy to debug shaders with any host debugger running on the CPU.

Due to the way Sh is embedded into C++, the full range of abstraction mechanisms offered by C++ can be used to structure and modularize shader code. Abstract base classes, regular functions, templates, and any other features offered by C++ can be used to develop shaders. This is an interesting consequence of the metaprogramming approach of Sh that also allows the use of software engineering principles in shader development, such as object orientation, that other shading languages currently cannot offer.
This kind of metaprogramming in C++ is used by an increasing number of libraries. For example, the Spirit parser framework (see http://spirit.sourceforge.net) uses a similar approach to describe and generate parsers directly in C++ instead of using traditional external tools, such as yacc or bison.

One of the most fascinating features of the Sh toolkit is the possibility to combine and connect shader programs to form new shader programs, which allows one to easily build complex shaders out of simple shader fragments. In a more general sense, Sh provides what can be called a shader algebra (see also the aforementioned SIGGRAPH 2004 paper), where shader programs are the objects on which special operators to combine and connect them are defined. An interesting application of this shader algebra is to specifically bind certain varying shader inputs to uniform variables and the other way around (this is what functional programming languages usually call currying). Also combining a matrix palette skinning shader with any light model shader (or any shaders that perform specific tasks, for that matter) is easily possible.

After this short introduction to the Sh toolkit, we shall now take a closer look at the book "Metaprogramming GPUs with Sh".
The book is split into three parts, an introduction, a reference, and an engineering overview.

The introduction consists of the first five chapters and discusses the basics of the Sh shading language and the API. In particular, the tuple and matrix types and the operators defined on them are presented. The way shader programs are defined and how parameters and attributes are handled is discussed, followed by the way textures are represented. Finally, the stream and channel concept used to feed data into shader programs is discussed. These introductory chapters contain a number of examples that demonstrate the presented concepts. Chapter three contains a quite interesting sample shader that uses constructive solid geometry techniques and metaprogramming in Sh to render text. While not the most useful use case, the shader shows some interesting capabilities of Sh, in particular the shader algebra operators. Chapter four on textures has some more nice sample shaders for doing shiny bump mapping, rendering wood and marble, and using Worley noise.

The second part of the book is a reference on Sh. Unlike references in many other computer books, this is not just a technical listing of the available features of Sh but is written in regular prose (with the occasional reference-like table here and there). The six chapters of the reference section describe how to setup and use the Sh library, and then discuss the available types, operators, and standard library functions more thoroughly than in the introduction. Additionally, the available backends are mentioned in the last chapter of this part of the book. A draft of the reference manual can also be found online at http://www.libsh.org/ref/online.

The final part of the book deals with engineering aspects of Sh. These final five chapters of the book discuss the details of the current implementation. The intermediate representation for shaders that is used by Sh is presented as well as how streams and textures are managed and stored internally. The interface between the Sh frontend and the various specific backends is discussed, as well as the current state of the optimizer including some further improvements that are planned in the future.

The images in the book are all in black and white except for 14 color plates in the middle of the book. The color plates and other images usually show teapots or animals, so they aren't all that exciting, but do demonstrate what the sample shaders presented in the book look like.

The book does not come with a CD-ROM, but with such a young library that is still under heavy development, putting a snapshot of the library's source code base on a CD-ROM would be a waste of resources. Sh itself as well as all sample shaders presented in the book can be downloaded from the Sh homepage at http://www.libsh.org. This website also has additional documentation, including some papers and the API reference documentation generated with Doxygen from the sources. Sh is distributed under a very liberal open source license (based on the zlib/libpng license) that also allows commercial use.

For the reader with enough expertise in 3D and shader programming, this book provides a concise and well-written introduction to Sh. The book will definitely contribute to enlarging the currently relative small user base of Sh and hopefully help the library grow and get more refined in the near future. Everyone familiar with "regular" high-level shading languages, such as Cg or the OpenGL Shading Language, should take a look at this book to see a new and interesting way of programming GPUs that the aforementioned languages do not offer.

About the review author:
The author has been involved in real-time graphics programming for more than 9 years and works as a games developer for arcade games. In his rare spare time he works on a graphics-related open source project called XEngine http://xengine.sourceforge.net.

You can purchase Metaprogramming GPUs with Sh from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

jnazario writes "As a computer security professional, one of the things I notice is that for our proposals to be effective, they often require the participation of the vast majority of computer users out there. Almost all of them are not computer security professionals, so it's imperative that our methods be usable by the non-professionals. What makes this even worse is that most computer users are not terribly savvy about what they're using. Terms like hard drives and memory don't mean anything to them, and a browser is just a window to the internet. A computer is a tool for information use, not an end in itself. So, a book like Security Alert: Stories of Real People Protecting Themselves from Identity Theft, Scams and Viruses sounded like it had real promise." Read on for Nazario's review of the book. Security Alert: Stories of Real People Protecting Themselves from Identity Theft, Scams and Viruses author Becky Worley pages 266 publisher Pearson Education rating 3/10 reviewer Jose Nazario ISBN 0735713529 summary Real world tips for regular people to protect themselvs online

If it can communicate threats and solutions effectively to the average computer user, then we're making real progress. After all, even computer security professionals often fail to employ basic measures to protect themselves from typical attacks, we'll have to make sure this stuff is understandable by the general population. Not that they're the "great unwashed" -- hardly. They're just not focusing on this stuff. Hence, we have a challenge: make this stuff understandable by your mom if you want everyone to just get it.

Becky Worley is (was? I haven't watched TechTV in a while) a TechTV on-air personality. She's reported news and events for TechTV for a number of years, and has often done so clearly and at a level you'd expect for a general TV station devoted to technology issues. So, you'd think she'd be a in a great position to collect information and know how to present it. Sadly, Worley's book doesn't fit that niche; it's not going to educate the large masses. In putting myself in the shoes of an average computer user, I found it fails in a number of ways.

The first and foremost failure of the book is right from the beginning. Worley opens up by saying that you're not a target of hackers, yet the rest of the book goes on to discuss how you are. While you're probably not going to be attacked by the same people who try and break in to Pentagon computer networks, virus writers and con artists fall into the same category for most purposes. All of these sorts of people, and what they can do, is described in chapter 1.

There's no discussion of phishing in the chapter on identity theft, which is chapter 2. Identity theft is a large, complicated subject, yet Worley only focuses on credit card number theft. While she talks about social security numbers, she doesn't demonstrate how they have been used to destroy victims' lives. Some advice is given as to how to react to credit card theft, but little information is given here about how to protect yourself to begin with, aside from being careful about whom you give your SSN to.

The book repeats itself often, covering similar material in several places. Chapter 3, which covers online purchasing, covers credit card info theft and email scams again. What it doesn't cover very well is how to spot a legitimate website, how to really use an escrow service, if and how you can get eBay or a shipper to help you out of a scam auction, and the like. Useful information about verifying who owns a certificate for an SSL server, or even making sure you're using an SSL server, is not given. Examples of false websites and auctions would have been useful. After all, after telling us how scammers operate and look so legitimate, illustrating the points about how to spot them would be valuable.

The book is full of anecdotes but few useful pieces of information are placed where they need to be. Chapter 4, which covers viruses, is one of these examples. It spends most of its time covering typical viruses and the usual, but doesn't get into anything beyond "use antivirus software." Never mind that the biggest threat in recent years has been from automated worms and that personal firewalls are useful; that's covered later. We hope you remember the quick tutorial on viruses from before.

The book's organization is poor, with material scattered throughout the book in a fashion that doesn't progress well or develop the information seamlessly. More virus and scam information is placd in Chapter 5, along with virus hoaxes. Several websites are refered to, but little in the way of really spotting a virus hoax or the common scam. Since they still abound, and people still fall prey to them, couldn't a better job have been done to describe what people are looking at have been offered?

In short, the book is a decent collection of links and material but is so poorly organized or so thinly presented it's hard to get what's going on. Take chapters 6 and 7, "Safe and Sane Online Interactions" and "Protecting the Family." Lots of information, somewhat poorly organized, and very skimpy on content. It seems to me that worrying about who is pestering my kids is more important than hearing about someone's EverQuest addiction, so that was a wasted page.

Finally, Chapters 8 and 9 should have been moved up front more. The topic of chapter 8, "Privacy," is perfect for the topics in chapter 2, where worley talks about identity theft. The topics covered here, including spyware and key loggers, are far more germane to the threat against your privacy and bank account information, and have been a growing trend for at least a couple of years. Chapter 9, differentiating being safe and being paranoid, should have been placed up front to help temper the arguments given in the rest of the book. It does a decent job of articulating the threats, what's to fear, and what's at stake.

The book is laden with plenty of anecdotes about online activitis gone awry. What's missing are solid examples of how to do it right, how to use your credit card on trusted sites safely and ensure that you're using services you know are worthwhile. While the book has some useful information in it, it's buried under poor organization, unclear language and presentation, and finally repetition in all the wrong places.

While the world needs a book or two to help every day people understand online security, this isn't the one. If you're looking for something for your kids, your spouse, or your parents, keep looking. This book wont help them make sense of what's going on. I don't think that's too much to ask for, especially from an organization like TechTV which has access to lots of material, people, and motive to produce a solid book.

You can purchase Security Alert: Stories of Real People Protecting Themselves from Identity Theft, Scams and Viruses from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

maximino (Shawn Stewart) writes "Due to a shipping error at Amazon.com, I received my copy of this book early. I like everything Stephenson has written, but this one, although well written, just leaves me cold. Anyone who is contemplating reading this book has either already read Quicksilver and The Confusion, or is entering a world of confusion and pain. The System of the World holds up all right under its own substantial weight, but is simply incapable of shoring up the whole trilogy. I think it reads better than the first book, but cannot stand up to the second for sheer manic joy. As far as the whole work, I find it disappointing at the last." Read on for the rest of Stewart's review. The System of the World author Neal Stephenson pages 892 publisher William Morrow rating 7, 5 for the trilogy overall reviewer Shawn Stewart ISBN 0060523875 summary The Baroque Cycle crosses the finish line, but like all of Stephenson's books, finishes ugly.

The third book in Neal Stephenson's epic Baroque Cycle shares its name with the third volume in Isaac Newton's Principia Mathematica; this is no coincidence, as a large part of this book deals with Newton himself. The vast majority of this volume follows Daniel Waterhouse, aging Fellow of the Royal Society, occasional foil and possibly the only friend of Newton, as he attempts to complete the charge assigned to him by Princess Caroline, his future monarch. Of course, Waterhouse doesn't really believe in the monarchy, but he has an agenda of his own, and can see the wisdom in trying to reconcile Newton and Leibniz.

The System of the World is the most chronologically compact of the trilogy. Quicksilver took place over a sixty-year time period and The Confusion over a decade and a half. Most of the action in this book takes place in the middle of 1714, as the ailing Queen Anne nears death, and the question of who should be the next monarch brings England near to another civil war. On one side of the debate are the Whigs, supporters of the Hanoverian succession, free trade, and industry. On the other side are the Tories, who would undo the effects of the Glorious Revolution and bring back the Catholic James III from exile in France -- supporters of landed aristocracy, unlimited monarchy, and slavery.

The Tories seem to be winning, due in no small part to the machinations of Louis XIV, whose support has allowed "Half-Cocked" Jack Shaftoe to build himself into the most powerful counterfeiter and criminal mastermind in London. Shaftoe has matured, though, and gained a powerful gravitas. Waterhouse also is not the indecisive young man or even the uncertain old man of Quicksilver; he has accepted his old age and his mortality and for once in his life shapes events rather than being borne along by them.

There is real pathos in Waterhouse's character. The choices that he has made will lead England toward steam and industrialization, and in two powerful scenes he has the chance to see the downside of the future he has made. At one point he visits a large-scale industrial operation that has left the earth around it poisoned and wasted, finding nothing to compare the scene to except Hell. At the other he witnesses workers toiling around a machine that might explode at any point, and wonders how many other dangers will be created by inventors simply trying to get things done a little faster. Still, he perseveres; for as near as the Baroque Cycle has one point, it is to explore how the nation-state, modern banking, and modern scientific method arose from the chaos of the 17th century.

In Stephenson's world, this is accomplished by plots, dueling, daring escapes, bribery, and the occasional disruption of orchestral concerts. As always, when writing a thrilling action scene, he is second to none. When this book is moving, it moves really well.

Stephenson's writing style is essentially the same as in the first two novels, although he does seem to be engaging in more deliberate anachronisms here (I counted two Monty Python references, and what I'm fairly certain is a scripting language joke). This makes his constant use of Inappropriate Capitalization and Barock Spelling somewhat more tedious to me, but I phant'sy any reader that has gotten this far will probably be able to overlook it. He still has the ability to make the reader smile once per page, and his meticulous attention to detail shows. It's clear that Stephenson is fascinated by the period, and indicative of a good writer that he actually got me to care about it as well -- his books motivated me to read some of his references, and others besides. There are also some classic hilarious scenes, chief among them a duel fought with naval artillery.

The typical flaws of a Stephenson novel are also present, unfortunately. A rather large number of characters are built up for dozens of pages and are then abruptly killed, never to be mentioned again -- and a fair number of established characters meet the same fate. This volume also contains the worst sex scene Stephenson has ever written, which is saying something. And, as is typical of Stephenson, the book goes until the end, and then just stops, after another Deus Ex Aurum ending. This time he's included a few short codas as a postscript, but be warned now: there are many unanswered questions left at the end.

In fact, the ending of the book made me somewhat angry. Fully explaining why would spoil everything, so I will tread lightly. Let me instead go back to Isaac Newton. Newton is a tragic figure because he was a bridge between two eras; he possessed one of the finest rational minds the world has ever known, and yet he spent the majority of his long life with alchemical and mystical researches. Stephenson is too lenient on Newton with regards to his paranoia and murderous rage, but curiously lessens him by suggesting that Newton simply failed to accomplish some of the things he set out to do.

I have been an avid reader of each Neal Stephenson book, and I will probably read the next book he writes. Still, I hope that his editor cracks down on him in his next endeavor, and that he doesn't allow his fondness for some characters to override the point he's trying to make.

You can purchase The System of the World from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Alex Moskalyuk writes "'Open source is great, but where do we start?' This is probably one of the most frequently asked questions in the corporate world when CIOs are faced with the need to choose between open and proprietary solutions. How do you figure out when it's feasible to implement an open source solution? Are there any support or training options if the solution does get approved, or if the project chosen was an alpha version developed by some student, who's away for the summer? Bernard Golden from NavicaSoft has probably heard the same questions too often, and then decided to write the book." Read on for prostoalex's review. Succeeding with open source author Bernard Golden pages 272 publisher Addison-Wesley Professional rating 7 reviewer Alex Moskalyuk ISBN 0321268539 summary IT manager's guide into implementing an open-source solution

Implementing an open source solution requires a different approach from the buyer's point of view: There is no salesperson you'll get a call from, there are no license agreements to sign and no serial numbers to enter. Access to the software is simplified, but sometimes there are few pointers about what to do next.

Golden takes the reader through different aspects of dealing with open source technologies. As one can see from the table of contents, the information is presented from the business professional's point of view. This title is for an IT manager, not developers or IT personnel who might be using open source products already and feel strongly about them. The basic question that the book explores is this: When does it make sense for an organization to implement an open source product? How do you evaluate the product's maturity, functionality, ease of use, support infrastructure and documentation quality so that running open source within the organization starts making sense?

Golden's answer is the Open Source Maturity Model (OSMM), which the author developed himself. The model asks the IT manager to evaluate the software, support, training options, documentation, integration and professional services on 10-point scale. If the technology ranking reaches a certain score (which highly depends on the userbase), then it will make sense to implement it.

For example, on page 144, when the author discusses software support options, he suggests assigning 6 points for excellent community support, 3 points for available paid support and 1 point for availability of self-support (i.e., an employee who understands the product). So on the next page JBoss gets 6 points for community support (very helpful and respectful forums), 2 points for commercial support (since it was e-mail and phone only, and no on-site support) and 0 points for self-support (since no one within the organization stepped up to claim herself as JBoss expert).

JBoss is the prime example used by the author throughout the chapters, and turns out to be quite a convenient choice -- the company offers commercial support, training and documentation for an open-source product. Golden's model is supposed to help IT managers distinguish high-quality open source projects from 0.0.1 version, so widely available on SourceForge.

The book's primary market is business professionals and IT managers who would probably benefit from having a formal evaluation model instead of relying on pure gut feeling. Despite the book's ambiguous title, it's not a manual on how to create your own business with open-source products. Some chapters will be helpful for figuring that out (Chapter 2 talks about business models in the open source world), but it's mostly for people who are implementing rather than developing open source products. The language is somewhat dry, but if your weekly reading requires CIO Magazine, you're probably used to that.

Something I think the author would have done well to include is a collection of in-depth case studies on open source implementations. There's some data on Sabre and Charles Schwab running successful businesses on open-source infrastructure, but the details are not there. While certain companies publish hundreds of case studies to prove that their products will either save money or allow the customer to make more, the success stories are not that frequently publicized in the open source world. Having such material in the book would provide a confidence booster for an IT manager, I think.

The last chapter or the first appendix is where I would expect to find information on solid open-source products suitable for corporate deployment. I mean, if the evaluation model is introduced, why not list the most prominent projects out there for quick reference? The highest-ranked open-source operating system, office suite, corporate messaging system, accounting and tax package, etc.?

Overall the book is pretty good for a manager who has heard of open source, but has not read too much into it. Chapter 1 in PDF format is available from Addison Wesley site. Golden also wrote an article for OreillyNet that deals with bringing open source into the organization. There's also an interview with the author on TechTarget.

You can purchase Succeeding With Open Source from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Alec Kryten writes "Here is a book that introduces and teaches a fascinating new sport for the hacking hobbyist which doesn't necessarily involve computers. Steel bolt hacking is the art of competition lock picking that is beginning to make its mark on computer people and other geeks around the world. At DefCon this year I picked up a book titled Steel Bolt Hacking, which teaches the basics of lock picking. I bought it because I watched the lock-picking contest during the DefCon Convention and thought that I might want to participate in next year's lock-picking events." Read on for Alec's review of the book. Steel Bolt Hacking author Douglas Chick pages 114 publisher TheNetworkAdministrator.com rating 8 out of 10 reviewer Alec Kryten ISBN 0974463019 summary How to pick locks, crack combinations for LP sports groups

The beginning of the book discusses the origins of lock-picking sporting groups, crews in the U.S and Europe, competition around the country, and how to become a part of a lock-picking group. One of the groups out of Colorado Springs, DC719, are a bunch of computer geeks that have taken up the art of lock picking and sponsor a lock-picking contest every year at DefCon. According to Mr. Chick, computer people are the fastest group to pick up the art of lock picking. (I must warn you though, there are also a lot of disclaimers about the author not being responsible for the misuses of the information contained in this book.)

The book is fully illustrated with pictures of different types of lock picking instruments, tools to make your own picks as well as padlocks, deadbolt, and combination locks. There are pictures of locks that have been cut open and even how to crack push-button combination locks. (You know, the kind you find on the door to a server room.) I have to say, for a little book, (114 pages) it is brimming with valuable information for a beginner. What I didn't realize was that software isn't the only thing that has security vulnerabilities; mechanical things like padlocks and deadbolts do as well. What was scary to learn is how easy cheap locks can be picked, and that 80 percent of all locks used are cheap locks. Expensive locks are just likely to take a little longer.

I liked that the book didn't exaggerate. It didn't tell me that I was going to be a master lock picker after only a few tries. It took a little time, practice and sore fingers, but after a couple weeks of practice, I could pick every lock in my house. And as a computer person, I liked all of the jargon that was used to explain locksmith techniques. There was also enough humor to keep the book interesting; it's difficult to read any type of textbook and still maintain a reasonable interest. The illustrations are good and there is a resource section to purchase the tools you need from the Internet.

What I didn't like about the book: The most annoying point, I felt, is the considerable redundancy in methods between different types of locks to be picked. Also, the book suggests that there might be a lock-picking group in every city in the U.S., when in fact I am having a difficult time finding one in my are. And I live near D.C. -- You'd think there would be one on every corner around here. I think that the sport is still in its infancy and Mr. Chick is hoping his book will draw more people to it. The author put his e-mail address on the back of the book. He hasn't responded to my e-mail yet, but I suppose that he's probably a busy man.

All in all, I found the book informative, entertaining and worth the purchase price of 19.99.

You can purchase Steel Bolt Hacking from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Sarusa writes "The Shaggy Steed is an Irish folk tale about a prince whose kingdom has fallen into chaos. A druid provides him a small shaggy horse which guides the prince on his quest through great trials and tribulations to a magical realm where he can obtain the necessary powers with which to bring peace to his land. (You can find more detail here.) For David Oliver, the Shaggy Steed of Physics is the two-body problem: the motion of two bodies bound together by the inverse square law." Read on for the rest of Sarusa's review of Oliver's book The Shaggy Steed of Physics. Fair warning: the review is lengthy, because the book demands it. The Shaggy Steed of Physics: Mathematical Beauty in the Physical World author David Oliver pages 300 publisher Springer rating 8 of 10 (if you have the required math skills) reviewer Sarusa ISBN 0387403078 summary Beautiful but demanding examination of the two-body problem.

The force on each body, whether gravitational or electric, is proportional to the square of the distance between the bodies. An isolated sun and planet form such a system, and a hydrogen atom, which is just a proton and electron, can be simplistically modeled as such. This may seem a trivial problem: you can sum it up in half a page in a physics book. But that's because all the detail work has been done for you. Furthermore, anything more complex than the two-body problem is chaotic and incapable of exact solution, so it's up to the two-body problem to carry us along. This is a complex problem, so this review is rather lengthy.

Let me warn you right off the bat that this is not a book for the faint of heart. It kicked my ass. The concepts are fast and furious, and the math is dense. Equations festoon the pages, daring you to ignore them. But you may not, they're fundamental to the discussion. Mr. Oliver opines that anyone with basic undergraduate math should be able to handle it. I had calculus, differential equations, and a good dose of physics in college and I still found the book tough going, mostly due to the whirlwind of notation and sheer number of variables introduced. I ended up keeping a cheat sheet of key definitions which ended up being four pages long, and took almost two weeks to process it. It reads like an advanced college physics book, except without extra examples or redundant explanation -- he expects you to be smart or motivated enough to keep up.

As an example: 'Using Hamilton's equations to eliminate p' and q', the total rate of change may be compactly expressed as df/dt = df/dt + [f,H] where [f,g] is the Poisson bracket of any two functions of the motion: [f,g] = (df/dqi*dg/dpi - dg/dqi * df/dpi)' I've reformatted this slightly for text limitations; he of course doesn't use * for multiplication, and you should read all 'i's as subscript i. This is fairly simple math in the context of the book.

So now that I've scared you off, what's the payoff? Well, unlike my college physics books which just lead me from factoid to factoid there are moments where the hard work pays off in big "oooh" moments. Your book might give you Kepler's second law: a planet sweeps out equal areas of its ellipse in equal times. But why? We'll just call it 'conservation of angular momentum'; that should hold you plebes. But in Shaggy Steed you'll find the equations like this that you might have thought were fundamental falling out of the woodwork, built up from the real fundamentals.

We start out by defining coordinate spaces and deciding that we're interested in Newtonian/Galilean rather than Einsteinian physics for the moment, since our subjects travel slowly enough and relativity makes things nastier. We start with a particle that has two vectors -- position and velocity. Turn this into two ensembles of rigid body particles exerting force upon each other. From this we build up the laws of motion, arriving at the total energy H of the system, and the 'gene of motion,' the Lagrangian: the difference between the kinetic and potential energy. 'Gene of motion' is a pretty bold claim, so we are shown how every mechanical quantity of the system may be derived from the Lagrangian. From there it's on to the 'action' principle, which is basically the integral of the Lagrangian over time - the key being that of any path the particles may take, they act in a way to minimize the action. Every other law of motion (including Newton's) follows from this, though to explain why it's the case we need general relativity. This was my first 'oooh' moment.

Chapter 3 really sets the pace for the rest of the book. If you're thrown off here, you're not going to make it out alive. To summarize: "Motion consists of the trajectory flow of particles in phase space. Each isolating invariant introduces a degeneracy into the motion in which the full phase space available to the trajectories degenerates into a submanifold. Increasing numbers of isolating invariants correspond to increasing degeneracies of the motion which restrict the trajectories to increasingly restricted submanifolds of phase space." This is more or less the programme of the entire book. Dig out as much complexity as required, then simplify to solvability.

Oliver introduces each new concept, so if you're following along carefully, you can follow along. This is all done half in equations, so we're diving so deep into math that you (okay, I) may be several pages in and forget where you were coming from and where you were going. Then suddenly you're out the back end and he nails it all with a beautiful concrete application or insight. For Chapter 3 it's Hooke motion, which you can think of as approximating two weights connected by a spring. Now if you've ever taken differential equations, or dynamics, you're probably uncomfortably familiar with this system. Now here it is all laid out for you, everything explained, and boy those resultant equations look mighty familiar. So that's where that all comes from, and why they use those particular symbols. The linear central force and the inverse-square forces of our two-body problem turn out to be closely related as well.

To be crushingly brief, Chapter 4 finally gets down to the (relatively) practical matter of classical planetary (Keplerian) mechanics, and why four dimensional spheres are special. Chapter 5 dives into quantum mechanics, and the hydrogen atom loosely simulated as a two body problem, since it has only the nucleus and one electron. And let's derive the fundamentals of quantum physics and the periodic table while we're here. Though I've neglected to mention it till now, Oliver doesn't neglect the human side of all this. He doesn't linger on it, but he does provide context. It's amusing to see how many of these inexorable equations were originally derived by geniuses like P. Dirac, only to be disowned because the implications were too outlandish.

In Chapter 6, it's time to step out of Newtonian/Galilean space and into Einsteinian space. We've made a lot of assumptions, such as the infinitely fast propagation of forces. This is no longer the case; time is no longer separate from space. In fact, we learn how to rotate space into time through imaginary rotation angles (known as 'boosts'). e=mc^2 falls out. But our shaggy steed eventually breaks down on the precession of Mercury. In the land of general relativity, even a simple two-body problem is really a many-body problem - forces are no longer instantaneous, they require force particles. The steed is of no more use.

But wait! Chapter 7, The Manifold Universe, takes on many-body motion like Don Quixote tilting bravely at a windmill, and tries to pull some order from the chaos. KAM theory is introduced and our many-body problem turns out to be not absolutely chaotic, but a mixture of regular and chaotic motion. You may have noticed that our many-body solar system doesn't just fly apart. We can model it more or less as a set of two-body problems with minor perturbations (minor being the key). And of course we can model fluids even though the internal motion is chaotic. Order emerges. Our shaggy steed is revived, transformed.

The back of the book contains the Notes, which are compact digressions into the hard (yes ...) math. I have to admit some of them completely lost me. But they're not required, just extra reading for those of you who eat this stuff up.

This all leaves me with a bit of a quandary. It's a beautiful book if you're a graduate-level student of math or physics, smarter than me (your best bet), or willing to put a lot of effort into it. Otherwise I can't recommend it -- the book is gibberish if you can't follow the math. I can't help but think that it would make a fantastic course in the hands of a skilled practical math teacher like Dr. Gary Sherman at RHIT; I certainly could have used his help with this. So, it's to teachers like him that I'd really suggest this book, for eventual dissemination to their students. Or if you dig physics and have the math skills, you might want to try riding "The Shaggy Steed of Physics" alone. If it throws you, there's no shame.

You can purchase The Shaggy Steed of Physics: Mathematical Beauty in the Physical World from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

ppanon writes "When Larry Niven's Ringworld's Children came out in June, I picked up a copy and it's been sitting on my shelf since. I had been hesitating to read it because I didn't want to be disappointed by it as I had been by some of his other solo novels in the last decade (Destiny's Road, The Ringworld Throne). But being home with a virus this weekend, and having run out of new Anime DVDs to watch, I thought it was time to catch up on some reading. I looked at Niven's book and thought, 'Might as well, I can't feel much worse.' As I got further into the novel, my problem wasn't that of feeling worse, it was forcing myself to put the book down when I felt I needed to rest again." Read on for the rest. Ringworld's Children author Larry Niven pages 284 publisher TOR rating 8.5 reviewer Paul-Andre Panon ISBN 0765301679 summary excellent page turner

The Ringworld is like a small slice of a Dyson Sphere, a massive ring with radius slightly larger than 1 AU, spun to simulate gravity on the inside with thousand mile-high side walls to hold atmosphere. In the second Ringworld novel, The Ringworld Engineers, it was revealed that the Ringworld was probably created by Pak protectors, a species cousin to humans with three phases in their life cycle: juvenile, breeders, and protectors. Protectors are extremely territorial, competitive, and intelligent, and will go to any lengths they can to protect and provide competitive advantage for their descendants, as identified by a keen sense of smell. While protectors normally cull out any significant genetic divergence from normal (picked up by changes in smell), a failure in the food supply caused all protectors in the Earth Pak colony to die. Breeders evolved sapience and became homo sapiens.

Something similar has somehow happened on Ringworld and, in the third book, after decades exploring the Ringworld, our hero, Louis Wu, decides to replace the current insane master of the Ringworld, Bram, a protector created from a vampirical species also evolved from the original Pak breeders. Even insane, Bram is still many times smarter, stronger, faster, and tougher than any human, so Louis and his cohorts don't have much of a chance taking him on. Humans and all Pak-descended Ringworld species can still turn into (misshapen/modified) protectors if exposed to tree-of-life root, but Louis is too old to make the transition to protector himself (besides, he likes breeding). He carefully creates another protector, Tunesmith, and, with the help of others, they manage to kill Bram.

Ringworld's Children picks up a few months after the end of the Ringworld Throne. Louis comes out of the autodoc that has been repairing the severe damage he suffered in the fight against Bram. He's also young again, thanks to Carlos Wu's one-of-a-kind nanotech autodoc, after tinkering by the hyper-intelligent Tunesmith. Tunesmith has been busy soaking up all Known Space knowledge, including advanced Puppeteer knowledge from the completely intimidated Hindmost, the former leader of the Puppeteer race and Louis' erstwhile employer. He's also been working on cleaning up some of the mess left by Bram (tens of centuries or more of overdue Ringworld repairs - Bram was a lousy housekeeper, too). More urgent however is the Fringe War, a cold war in the remote asteroid belt at the far edges of the Ringworld system (similar to our Oort Belt). Most of the major species of Known Space have at least a few ships there. The ARM (the UN's police/military forces) and the Kzin have substantial war fleets. All the factions want to learn the Ringworld's secrets. Those fleets have antimatter weapons that could destroy the Ringworld as collateral damage and, for perhaps decades, they've been in a Mexican standoff, but deployments and movement patterns indicate all antimatter hell could break loose in the near future.

Louis' puppet strings are now held by Tunesmith, and since Tunesmith takes some pretty big calculated risks without explaining their rationale, Louis likes it maybe even less than when those strings were held by the Hindmost. Even if they get past the immediate emergency, Tunesmith's likely long-term plans for Louis are far from appealing. He has to figure out how to permanently escape from Tunesmith and the Ringworld without getting blown up by the Fringe War or triggering an apocalyptic attack on the Ringworld. His only chance at escape from Tunesmith's vastly superior intelligence is that Tunesmith is heavily distracted planning on how to deal with the Fringe War.

In earlier ringworld novels, when Louis and his co-explorers made first contact with native Ringworld population groups, they would play the "God Game," first getting their story straight and consistent before conning the natives to obtain knowledge or food. That dialogue technique is used here again, including when Louis uses it by himself to figure out scenarios he can use against Tunesmith. Part of my mind was a little distracted, thinking "Is this how Niven works out the plot outline of novels, before fleshing out individual scenes or chapters?" But the rest of my (virus-addled) brain was racing along trying to figure all the possibilities where Niven or his characters might be going. Even so, Niven still managed to completely surprise me once near the end, because I'd let myself get distracted and miss a couple of the better hidden clues.

Along the way, Niven ties up a lot of loose ends and answers a lot of questions, about the Ringworld and about some other phenomena in the Known Space universe. The plot has few slow points, and almost none in the second half of the book, hiding fairly well Niven's slightly-less-than-usual weakness at character development. This novel should earn Niven another Hugo nomination

If you're a recent SF reader and can't handle the lack of ubiquitous computers or the ESP/Psionics that dates some of Niven's more famous and popular 60's and 70's era stories (when the Amazing Randi hadn't yet debunked Uri Geller and most others of his ilk), you may find his Ringworld stories more palatable. Pak don't need or want computers on the ringworld, and there's passing mention of psionics only because of the conventions established in other Known Space series. If you like older 60's or 70's-vintage Niven stories because of the imaginative aliens, environments, or inventions, you'll almost certainly enjoy reading this book. Finally, if you've liked any of the other stories in the Ringworld or Known Space series and were left wanting more, you need to read this book.

You can purchase Ringworld's Children from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Ben Rothke writes "There is a very simple albeit unscientific two-step test to see if a book about security assessments is for the serious security practitioner or for the script kiddie. Step one: Does the book use the term bulletproof or hacker-proof? Such nebulous terms are utterly meaningless. Especially since bulletproof deals with physical objects, and nothing, not anything, can ever be made hacker-proof. The second step is to see the books discussion and placement of the nmap tool within the book. While nmap is a invaluable and important security tool; it is nonetheless but one tool in a large security toolbox. Books that place the bulk of their discussion of nmap at the beginning of a book are generally focused on the blind running of tools without insight or analysis. Those that place nmap towards the latter parts of the book generally focus on the big picture." Rothke reviews below Chris McNab's book Network Security Assessment; read on to see how it handles his assessment. Network Security Assessment author Chris McNab pages 396 publisher O'Reilly rating 8 reviewer Ben Rothke ISBN 059600611X summary To-the-point and practical book for testing your own network, an important tool in the fight to keep out malicious electronic visitors.

With those two tests in mind, Network Security Assessment (NSA) passes with honors. The terms bulletproof or hacker-proof are not found at all. And at 355 pages in length, the book's discussion of nmap starts on page 324; a good sign indeed. NSA is written for a person who needs a thorough introduction to performing network assessments, but does not need the elaborate background that the Hacking Exposed series offers. The book's technical requirements are not that extensive; a basic understanding of security, IP networks, and generic networking is enough to understand the core concepts of the book.

The book's preface starts out with a simple fact, one that is not always obvious to many: It is never impossible for a hacker to break into a computer system, only improbable. When designing and security a network, it is the job of the security architect to maximize that level of improbability as much as possible. Anyone who makes their network even a little bit more security resilient will quickly find a drop in the number of security breaches.

The publication of Hacking Exposed a few years ago started a new era in books about network scanning. Hacking Exposed was the first popular book that detailed how to go about performing a penetration test. In a similar vein, NSA is comparable to Hacking Exposed in that it provides a framework for doing security assessments. The big difference is that NSA provides a much more structured approach to performing the assessment, whereas Hacking Exposed lacked that formal approach. Hacking Exposed also goes into more details in many areas, and its initial title has morphed into many other different titles.

This more formal approach is manifest in the books 14 chapters. The first two chapters of NSA start out with the fundamental need and requirements for performing a network security assessment, and then details the tools and methodologies required to bring that assessment to fruition.

Chapter 3 details the ins and outs of network enumeration and also shows how to use standard utilities such as whois and nmap for network enumeration. Perhaps one of the most beneficial features of the book is the selection of countermeasures that are found at the end of each chapter. These countermeasures are very useful in ensuring that any vulnerabilities are appropriately fixed.

Besides listing methods which an intruder might use to elude common security applications, the book also goes into numerous hacking tools. While some may see this as providing fuel to the fire, it is clear that the tools are readily available (and have been for years). Listing of such tools won't make hacking easier for miscreants and script kiddies; rather it provides a level playing field for systems administrators who need to defend against such hackers.

After network and host enumeration, NSA steps forward into topics such as dealing with web servers and CGI, remote access issues, and ftp and database security issues. Chapter 9 does a good job of focusing on Microsoft Windows security issues. While entire books have been written about weak Windows security protocols such as NetBIOS, SMB and CIFS, NSA does a good job encapsulating ways to keep vulnerabilities here in check. Readers are highly advised to put the Windows networks services countermeasures listed at the end of the chapter into use.

Chapters 10-12 deal with the myriad security issues with email, VPN and RPC issues. While most of the information in these chapters (and the book as a whole) has been elucidated elsewhere, there is nonetheless a lot of valuable information contained in the chapters.

Chapter 13, "Application-Level Risks," is important in that many organizations put far too much emphasis on security the perimeter and forgetting about the application. The need for more emphasis on application-level security is eloquently put by Marcus Ranum when he notes that "these days, with the kind of plug-ins that come in your typical browser, combined with all the bizarre undocumented protocols used by new Internet applications, make it highly unlikely that a firewall is doing anything more complex than a thin layer of policy atop routing. As such, the applications behind the firewall are now more critical to security than the firewall itself. Which should scare the holey moley out of you."

Chapter 14 closes the book with a methodology for running a network security assessment. The author notes that running an assessment requires more thought than simply running security tools in a haphazard manner.

Overall, Network Security Assessment provides a good framework for anyone who is serious about running network security scans to security his perimeter and interior networks. The book is written in a style that is readable and understandable style; while more of an introductory text, it does not treat the reader as a dummy.

When it comes to running a network security assessment, the methodology is often more important than the running of the tools. While there is nothing radically new detailed in NSA, it does provide an effective and comprehensive overview of the issues involved in only 355 pages. If you are looking for a to-the-point book that does not get bogged down with screen prints and meaningless hacker stories and myths, Network Security Assessment is a good place to start.

You can purchase Network Security Assessment from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

AccordionGuy writes "If you've ever spent an afternoon in the "Computers" section of a bookstore going through the programming language books, you've probably noticed that most of them seem to exist only to boost a publishing company's fortunes by capitalizing on the hot new programming language of the moment. These books -- essentially glorified bookends -- seem to follow the same format, cover the same subjects and aside from the tiny flourishes that are part of each author's particular writing style, are indistinguishable from each other. Reading them, one gets the feeling that its primary purpose is to allow the author to make some payments on a car or mortgage. I have a few of these books and they're gathering dust on the bookshelf farthest away from my desk." For deVilla's review of Dive Into Python, a book that inhabits a completely different category, read on below. Dive Into Python author Mark Pilgrim pages 432 publisher Apress rating 9 reviewer Joey deVilla ISBN 1590593561 summary The "desert island" Python book

However, from time to time, you can find a programming language book that stands apart. You can tell from the way the author writes, the topics s/he covers, the unique presentation style and insight that s/he brings that the book is a labor of love. These books enjoy placement on the shelf closest to my desk -- that is, if they're not propped open beside my computer. Dive Into Python is such a book.

One thing that sets Dive Into Python apart from many other programming language books is that its author, Mark Pilgrim, didn't originally plan to make any money from it. As we often say in Open Source circles, he simply had an itch and decided to scratch it. Mark explains this in a story on his weblog in the form of a dialog between him and his manager after showing him a rough 20-page draft:

Manager: "This is really good. You could probably make some money off this someday."
Mark: "Maybe, but I'm not going to. I'm giving it away for free."
Manager: "Why would you do that?"
Mark: "Because this is the way I want the world to work."
Manager: "But the world doesn't work that way."
Mark: "Mine does."

First released in late October 2000 and published in online and downloadable forms under the GNU Free Documentation License, Dive Into Python had grown in fits and starts until 2003, when Mark declared the project closed. Even as an unfinished work, it was held in such high regard by the Python community that developers consistently recommended it; it was also included with ActiveState's Python and FreeBSD's ports distributions. When Mark announced that Apress had decided to pay him to finish the book and publish it, it became the most-anticipated book on Python ever. Even better, Apress has been gracious enough to allow Mark's world to work way it always has: Dive Into Python is still available for free download and is still under the GNU FDL.

What's in Dive Into Python

Many programming language books follow what I like to call the "Computer Science 101 Format", with the first few chapters devoted to covering basic concepts that any moderately experienced programmer already knows. Whenever I leaf through such a book and encounter a chapter that tries to reintroduce me to data types, looping or branching, I feel cheated; I'm essentially paying for a big chunk of book that I'll never read. If you've ever been annoyed by such filler, you'll find Dive Into Python a refreshing change. Rather than wasting time and trees devoting whole chapters to rehashing Computer Science 101, Mark chose to build each chapter after the first around a program that illustrates a number of Python features and programming techniques.

The programs upon which Dive Into Python's chapters are based strike a carefully-maintained balance. They are rich enough to illustrate a number of points and be the basis for some "real world" code, yet small enough to be comprehensible tutorials. For example, chapters 2 and 3 are based on "Your First Python Program", which is a mere six lines of code. However, in those six lines, you are introduced to function declarations, documentation strings, objects and their attributes, importing modules, Python's indentation rules, the "if __name__" idiom, dictionaries, lists, tuples, string formatting and list comprehensions. Within the first hundred pages, a point where many books are re-acquainting you with the "else" keyword, Dive Into Python covers the aforementioned topics as well as Python's reflection capabilities, list filtering, the "and-or trick", lambda functions, OOP and exception handling, all with enough thoroughness to be useful. After reading Dive Into Python, you may have trouble reading other programming language books because they'll seem glacially slow and fluff-laden in comparison.

For the first two-thirds of the book, Mark continues with this approach, presenting a program and then analyzing it to see what makes it tick, teaching Python and oftentimes a programming technique along the way. Each program covers useful tasks that you're likely to run into while programming and does so in an interesting way. At the same time, concepts are introduced in a way that makes sense. For instance, chapter 4 covers two topics that mesh together quite well -- exceptions and file handling -- and it does this by exploring an interesting application: a program that displays the ID3 tag information about each file in your MP3 collection. Later chapters explore regular expressions, HTML and XML processing and Web services. By the time you've finished the first two-thirds of Dive Into Python, you'll have been introduced to enough Python to start writing a wide array of "real world" applications. The book might have benefited from having a chapter covering database access, a task that's at least as common or as useful as accessing Web services, but that's a minor complaint.

While the first two-thirds of the book concerns itself with helping the reader become a Python programmer, the final third is about elevating Python programmers above mere competence. It covers useful topics (albeit rarely-covered in language books) such as refactoring and performance optimization as well as ones that may be new to even some experienced programmers: unit testing, functional programming and dynamic functions. Each chapter in this section is still based on an example program, but rather than analyzing a completed program, its evolution is traced. Although you can get by as a Python programmer without ever reading the material in this section, you'll be a much better one for having done so.

In keeping with the spirit of Python, Mark writes the chapters to present the material as completely and clearly as possible without extra clutter. If there's any additional material that doesn't apply directly to what he's trying to explain, he provides references or links to that material rather than attempting to "fatten up" the book.

The book's long gestation period, assisted by years of reader feedback and James Cox's editing has paid off. It doesn't have the rushed feel that many language-of-the-moment books have (especially the ones written by an army of authors, each one taking a chapter). As far as I know, there isn't any of the sloppiness that pervades many programming books these days, save one instance of the popular typo "teh" (and really, what truly 1337 book doesn't have one of these?).

Mark is aware that Python is likely not to be the reader's first programming language; it's more likely to be some descendant of ALGOL (or more precisely, a language that borrows heavily from either C or BASIC). He also knows that many programmers tend to misapply techniques from the languages with which they're familiar to the language they're learning. With these in mind, he's taken great care to introduce Python idioms as soon as possible. If you follow his advice, you'll be writing "real" Python and taking advantage of what the language has to offer rather than just writing Python-flavored version of whatever programming language you're most comfortable with.

Dive Into Python's Audience

The "user level" specified on the back cover of this book says "Beginner - Intermediate", which I feel is a little misleading. As I mentioned earlier, the book takes great care not to rehash topics with which programmers with some experience are already familiar and is written with the assumption that the reader is proficient in at least one object-oriented programming language. I think many programming novices would be overwhelmed with the speed with which Python features are introduced.

Experienced programmers, whether they are new to Python or are fluent with the language will benefit the most from the book. One programmer I know works with Python daily and and even submitted a patch to wxPython; even he said that Dive Into Python showed him things about Python that he never knew. If you're tired of books aimed at "Introduction to Computer Science" students, you're going to love this book. This doesn't mean that people who don't normally program can't benefit from the book: Joi Ito, who is a tech entrepreneur and not a programmer, learned enough from Dive Into Python to put together jibot, a bot for the IRC channel that bears his name. If you're new to programming, you might want to make Dive Into Python your second book or supplement it with an introductory text such as Apress' own Practical Python, O'Reilly's Learning Python or the free online book How To Think Like a Computer Scientist (the Python edition).

Conclusion

Dive Into Python may be one of the thinnest programming language books on my shelf, but it's also one of the best. Whether you're an experienced programmer looking to get into Python or grizzled Python veteran who remembers the days when you had to import the string module, Dive Into Python is your "desert island" Python book. If you're new to programming but have heard all the wonderful things about Python, make sure that this is the second programming book you read. My congratulations to Mark Pilgrim on an excellent book and authorial debut!

(Remember, you don't have to just listen to my effusive praise. Dive Into Python is available for free at diveintopython.org. Read it for yourself and if you like it, vote with your dollar!)

You can purchase Dive Into Python from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Chris Acheson writes "John Taylor Gatto is a former New York City school teacher. During his 30-year career, he has taught at 5 different public schools, has had his teaching license suspended twice for insubordination, and was once covertly terminated while on medical leave. He has also won the New York City Teacher of the Year award three times and the New York State Teacher of the Year award once during the final year of his career. The whole time he has been an outspoken critic of the school system. Nine years after leaving his career, he published The Underground History of American Education (full text available here), in which he puts forth his insider's vision of what is wrong with American schooling. His verdict is not what you'd expect: the school system cannot be fixed, Gatto asserts, because it has been designed not to educate. Skeptical? So was I." Read on for the rest of Acheson's review. The Underground History of American Education author John Taylor Gatto pages 700 publisher Oxford Village Press rating 9 reviewer Chris Acheson ISBN 0945700040 summary A damning look at the institution of modern compulsory schooling and the factors which brought it about.

The true purpose of schooling, according to Gatto, is to produce an easily manageable workforce to serve employers in a mass-production economy. Actual education is a secondary and even counterproductive result since educated people tend to be more difficult to control.

Over the course of the book, Gatto exposes many of the individuals, organizations, and crises (both real and manufactured) that helped to make our public school system what it is today. Such architects as Rockefeller, Carnegie, Ford, and a handful of teaching and management experts sought to benefit directly from a dumbed-down citizenry. Others contributed in a naive attempt at Utopian social engineering, mostly unaware of the harm that they were doing. There was never any master plan, though. The author puts it best:

With conspiracy so close to the surface of the American imagination and American reality, I can only approach with trepidation the task of discouraging you in advance from thinking my book the chronicle of some vast diabolical conspiracy to seize all our children for the personal ends of a small, elite minority.

Don't get me wrong, American schooling has been replete with chicanery from its very beginnings: indeed, it isn't difficult to find various conspirators boasting in public about what they pulled off. But if you take that tack you'll miss the real horror of what I'm trying to describe, that what has happened to our schools was inherent in the original design for a planned economy and a planned society laid down so proudly at the end of the nineteenth century. I think what happened would have happened anyway-without the legions of venal, half-mad men and women who schemed so hard to make it as it is. If I'm correct, we're in a much worse position than we would be if we were merely victims of an evil genius or two.

Gatto maintains throughout the book that all individuals have an innate curiosity and desire to learn. Examples are given in the first chapter of prominent historical figures who prospered with little or no formal schooling. But I found the examples of desire for substantive education on the part of "the masses" to be most compelling:

When a Colorado coalminer testified before authorities in 1871 that eight hours underground was long enough for any man because "he has no time to improve his intellect if he works more," the coaldigger could hardly have realized his very deficiency was value added to the market equation.

The real function of the school system is not to empower people by giving them knowledge, but to crush this instinct toward self-improvement before it makes the workers too independent and troublesome. Another compelling example is the "Jewish Student Riots" described in chapter 9:

Thousands of mothers milled around schools in Yorkville, a German immigrant section, and in East Harlem, complaining angrily that their children had been put on "half-rations" of education. They meant that mental exercise had been removed from the center of things.

The book does have a few problems. Gatto is by his own admission somewhat casual about citing his sources. This is important because there are some assertions made that many will find dubious. For example:

Looking back, abundant data exist from states like Connecticut and Massachusetts to show that by 1840 the incidence of complex literacy in the United States was between 93 and 100 percent wherever such a thing mattered.

This would be a great fact to toss out when trying to convince someone that schooling is unnecessary. But where does this statistic come from? What does "wherever such a thing mattered" mean? Some readers may be willing to simply take Gatto's word for it and accept this assertion, but skeptics will be left unsatisfied. According to historical census data from 1840, the national average literacy rate for white adults was indeed approximately 93%, and the literacy rate for white adults living in Connecticut was 99.67%. Why not simply say that the statistic refers to white adults? The omission hurts the author's credibility in the eyes of a skeptical reader.

The other thing that I found disappointing is that Gatto doesn't discuss solutions to the schooling problem as thoroughly as I wanted. Throughout the book examples are shown of educational methods which have worked well. As I read, I mulled these over, and anticipated that the final chapter (titled "Breaking Out Of The Trap") would be a comprehensive look at these methods and ways to promote their implementation. But that final chapter is mostly a collection of anecdotes. Gatto does provide a short list of positive suggestions and a promise to cover solutions more fully in a future book.

The picture that Gatto paints for us of our school system and society is frightening, but I also found it comforting to see evidence that ignorance and apathy are not the natural state of humanity. I found hope in the fact that things were once different. Having a clearly defined problem that can be solved is preferable to having a vague suspicion that something is wrong, but no clear idea what it is.

The ideas presented in Gatto's Underground History have the potential to change our society and our individual lives for the better. Even when we are trapped within the system, knowing how it works and what it is really up to can help us retain our wit and our humanity. If you are a student, if you are a parent, if you know or care about anyone who is in school, or even if you are just concerned about corporate and government control versus individual freedom, you need to read this book.

You can purchase The Underground History of American Education from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Daniel Jolley writes "I spend basically every waking hour online, and I have seen all kinds of crazy things on the Web over the years, yet I was amazed by some of the incredible things author Greg Holden describes in Internet Babylon: Secrets, Scandals, and Shocks on the Information Superhighway . This guy has gone where many fear to tread, digging up the goods on some of the Internet's most questionable, fascinating, oftentimes disturbing oddities. He has put all of this knowledge to a higher purpose, using it to describe the all-pervasive social change the Internet has wrought." Read on for the rest of Jolley's review. Internet Babylon: Secrets, Scandals, and Shocks on the Information Superhighway author Greg Holden pages 472 publisher APress rating 9 reviewer Daniel Jolley ISBN 1590592999 summary A guided tour of the wild, surprising, and oftentimes dark underbelly of the World Wide Web

Along with all the incredible things I somehow missed over the last few years (e.g., the Amazing Mahir), Holden brought to mind a number of wonderful yet somehow forgotten memories (e.g., All Your Base Are Belong To Us). Then there's all the great stuff that, like so much on the Internet, no longer exists but which provided tons of laughs at the time (e.g., Evil Bert). And I never tire of the great web creations that keep on giving, such as the phenomenal Star Wars Kid parodies.

Unlike most of us, Holden didn't just wander willy-nilly all over the Internet -- well, maybe he did, but he put together a well-organized book that breaks his subject down into six parts spread across twenty chapters. First up is "The Rich and (In)famous." Here you can read all about the online doings of celebrities, serial killers, has-beens and wannabes. Holden will lead you to the Partridge Family Temple, introduce you to the unique musical stylings of Star Trek actors, and even point you to refreshers on Manson Family Values.

Next up is "The Afterlife." On the Internet, nothing truly dies. You can explore the mysterious deaths of Elvis and other celebrities, become a knowledgeable amateur sleuth hot on the trail of Jack the Ripper, the Zodiac killer, and other inhuman monsters, help look for ghosts via webcam in haunted buildings, and even watch a body decompose inside a coffin. (Actually, that last idea fell through, but it's sure to happen eventually.) Of course, you might want to get religion before you take your own one step beyond, and the Internet puts a wide variety of "religions" at your fingertips. With the good comes the bad, and the Internet does, unfortunately, have a dark underbelly of criminality and evil; in the section "Bad Boys and Naughty Girls," Holden gives you the scoop on famous hackers and their exploits, viruses and their creators, and the cretins who curse us all with unwanted spam. He basically takes you on a guided tour of the dark side of the World Wide Web.

As we all know, the Internet has revolutionized politics, and Holden devotes three fascinating chapters to political intrigue, scandals, and government secrets online. In the past, politicians could keep their perverted behavior secret from the public, but the Internet has changed all that -- just ask Bill Clinton. In this online age, rumors and scandals can be spread across the entire world in a matter of minutes, and Holden shows us how the Internet has at times shaped the content of traditional journalism (as well as supplying us with some of the funniest jokes and parodies known to man).

Anyone who browses the Internet soon learns that there are people out there who will do anything to get attention, and those with some sort of self-styled mission will stop at nothing to get their points across. This is the realm of flame wars, denial of service attacks, as well as really, really silly web sites you can't believe anyone would ever think of creating. The unlikeliest of Internet heroes are honored in this section: the Amazing Mahir of "I Kiss You!!!!!" fame, the Star Wars Kid (one of my personal favorites), and even one of the little guys - the man who invented the Smiley symbol. It all wraps up with a look at "Big (And Not So Big) Business." Remember the Pets.com Sock Puppet, who enjoyed much more success than Pets.com ever did? That's just one dot-com disaster story; here, you will learn about some of the worst Internet business plans ever put together.

Believe me, I have only scratched the surface of the material covered in this book. Internet Babylon is chock full of fascinating, oftentimes hilarious stories (and pictures) of the continually surprising sites and sounds the Internet has brought to life. You'll learn a little bit about the creation and evolution of the Internet, but mostly you'll revel in all the crazy online manifestations Holden holds under the microscope.

Let me close with a word of warning. I'm a big horror fan, and I've seen some pretty disgusting things in my life; I like to think I'm tough enough to stand anything. Thus, I ignored Holden's warnings about some of the more disturbing web content that can be found out there and rushed right off to one aptly-described shocking site. Let's just say I'll never be able to watch weight lifting again. I know you will want to take a gander at many of the sites Holden refers to throughout this book, so I just want to advise you to proceed carefully: as this fascinating book proves, you can find absolutely anything out there online, and some of it ain't pretty.

You can purchase Internet Babylon: Secrets, Scandals, and Shocks on the Information Superhighway from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Gianluca writes "If security is not a concern, installing the Apache web server is a simple task even for an inexperienced system administrator. The problem is that security should always be a concern, and in case of Apache the information about making it secure can be sparse and fragmented. This is probably the reason why many web administrators are pretty clueless when it comes to Apache security. Needless to say, this creates a worrisome situation (to say the least): many web servers are vulnerable and exposed to thousands of potential attackers." Read on for Gianluca's review of Hardening Apache, a book intended to consolidate and clarify that information. Hardening Apache author Tony Mobily pages 270 publisher Apress rating 9 reviewer Gianluca Insolvibile ISBN 1590593782 summary A thorough guide through the intricacies and gotchas involved in securing an Apache installation

Hardening Apache fills a huge gap in this sense, providing web administrators with a complete and yet concise book aimed to guide them from the very beginning of the installation process to the final steps of the server configuration. The author, Tony Mobily, is also the mind behind Professional Apache Security, a book published by Wrox Press which I reviewed on Slashdot about 17 months ago. Since Wrox's unfortunate closure, some of the material from that book has been moved into Hardening Apache. More specifically:

• The excellent chapter on "jailing" Apache is exactly the same;
• The chapter on XSS attacks has been slightly improved;
• The chapter on logging, which was nothing remarkable, has been greatly improved. It now includes a complete architecture to log on a remote host using encryption and a TCP/IP connection.

The first chapter of the book deals with deploying a clean and safe base installation, which will then be the grounds for adding extra functionality. Unfortunately, this task is often underestimated. What I liked in this chapter is the step-by-step guide to correctly downloading the source distribution and verifying its integrity (by checking its digital signature), as well as the clean approach to the creation of a lean, easily readable configuration file, which grants a painless maintenance. A highlight of this section is the use of Nikto to analyse and explain common weaknesses and to show how to fix them.

Chapter 2 presents some vulnerabilities and explains how to exploit them. The chapter doesn't have any "pearls of wisdom" (but it's nevertheless important to show that Apache can be vulnerable), and presents some important reference sites every web administrator should be aware of.

Chapter 3 definitely deserves a special mention: after introducing the "common" ways of logging and syslogd's architecture, the author describes a rational approach to realizing a complete logging solution which entails remote log servers, encryption of logs, and the use of a MySQL database to better organize them.

Chapter 4 is the only one which deals with the "programming" side of web security. It is not a comprehensive guide on how to write safe programs for the web, as it focuses on cross-site scripting attacks; it shows how to secure a simple and vulnerable message board written in PHP.

The following chapter talks about security modules: it presents an interesting overview of the most useful modules related to security, which will help administrators understand the importance of third-party modules and explains how to install and use some of them. I also liked Chapter 6, which deals with the installation of Apache in a secure, chrooted environment: the chapter does a great job in guiding the reader through the non-trivial steps required to get Apache, Perl and PHP working correctly in such a restricted environment.

The last chapter presents a number of powerful and well-written scripts which anybody can use to automate security and keep an eye on their web server (monitoring log growth, Apache's responsiveness, and so on).

What's to like Information throughout the book is very well focused and presented with a clean and friendly writing style. The book provides a clear and detailed walkthrough of the process of securing an Apache installation, covering both versions 1.3.x and 2.x and thus providing long lasting information. The book has lots of references and pointers to resources on the web, and - what's more important - instructions on how to read them. I also liked the "checkpoints" at the end of each chapter.

What's to consider Apart from chapter 4 on cross-site scripting attacks, the book does not cover secure web programming at all. It doesn't cover OS hardening either, which is out of scope but part of the game anyway. Going through the book requires some familiarity with Unix and Apache; otherwise you will have to resort to other books for the very basic steps.

All in all, I found this sort of "new edition" of the book by Apress to be greatly enhanced, more homogeneous and better focused than the previous book: I had been happy with Wrox's version, but I am enthusiastic about this one. This is a book which should definitely be included in any serious Apache administrator's bookshelf.

You can purchase Hardening Apache from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

twelve71 (Alan Francis) writes "Apologies in advance for overuse of the word 'pragmatic,' but Dave Thomas and Andy Hunt together form a company called The Pragmatic Programmers, and published a book I'm sure many of you have read, titled The Pragmatic Programmer: from Journeyman to Master. The Pragmatic Programmer (or 'PragProg' as it is usually referred to) is a wonderful grab bag of 'good old common sense,' but its main strength (covering a very broad range of subjects) means that the authors have left a few holes around some important details. To plug some of these holes, and provide a good grounding for those just starting out, they have recently published 'The Pragmatic Starter Kit' - a set of books covering in detail some of the basics mentioned in PragProg." Read on for Alan's review of the latest book in the kit. Pragmatic Project Automation author Mike Clark pages http://www.pragmaticprogrammer.com/bookshelf/index.html publisher Pragmatic Bookshelf rating 9 reviewer Alan Francis ISBN 0974514039 summary Learn to use common, freely available tools to automate build, test, and release procedures.

The first 2 (or possibly 3) books are Pragmatic Version Control with CVS and Pragmatic Unit Testing (which is available in Java and .NET flavours).

Pragmatic Project Automation is the latest book in the series and, interestingly, this book wasn't actually written by either Dave Thomas or Andy Hunt, but by Mike Clark (contributor to the 'Bitter EJB' book, editor of the JUnit FAQ, and responsible for the JUnitPerf and JDepend tools). Mike does a great job of ensuring this book fits in with the overall style of the other books in the series.

Up front, in case you're a "cut to the chase kind of guy," this book (and the others in the series) are must-haves and as a consultant with ThoughtWorks I'll have a set ready to distribute whenever I start working with a new client team.

Content The book helps the reader build a Java project slowly over the chapters, starting with a manual build-and-deploy process and automating a new aspect of it, chapter by chapter, until by the end of the book the software compiles, archives, deploys and configures itself multiple times a day. In addition, the build tools notify you of success or failure in a variety of interesting ways including email, SMS messages and different colored lava lamps.

The first chapter provides a good introduction to the different types of automation available to projects. It also introduces the acronym 'CRISP' to help the reader remember the desirable characteristics of an ideal build process: Complete, Repeatable, Informative, Scheduled and Portable.

Chapter 2 gets you Repeatable by using ANT to bring together all the various steps you currently perform on your project into a single, one-click build. Chapter 3 works to turn the one-click build into a no-click build using tools as simple as cron as well as more complicated tools like the ANT scheduling tool CruiseControl. By the end of these two chapters your software can be compiling and testing itself automatically each time changes are checked into the version control system. But this is only the beginning.

Chapters 4 and 5 address the "Complete" and "Portable" portions of the CRISP model discussing how to include packaging, release management and deployment into your scheduled build. The last chapter addresses "Informative." How to monitor the build for success or failure, how to notify members of the project team using email, SMS, RSS or even the red and green Lava Lamps I mentioned above.

Summary This book, and the others in the series, provide a much needed set of manuals for getting a good set of basic practices up and running at the start of a project. Unlike the Unit Testing book, there's not a lot of programming in this one, but it's a worthwhile read for any programmer, regardless of experience level.

Many people are becoming interested in eXtreme Programming and Agile methods for software development. These books help to support some of the key ideas of those methods - extensive unit testing and continuous integration.

The main flaw in the book doesn't affect its usefulness, only its readability. Of all the files used in the sample project, the only one covered in any detail is the build file. The source and manifest files that we're writing the ANT file to build are never discussed or described - we are left to guess at what the sample project might contain (unless we download the code from the website). While this didn't change what I was learning (how to manipulate the project files with ANT), I like to understand all the details and this omission did occasionally leave me a little irritated.

You can purchase Pragmatic Project Automation from bn.com. Slashdot welcomes readers' book reviews. To see your own review here, carefully read the book review guidelines, then visit the submission page. If you are interested in the Pragmatic Programmers, see also this interview linked earlier from Slashdot.

Sarusa writes "The title of the book, Facts and Fallacies of Software Engineering, is nice and controversial, and so is the content. Robert Glass is a long-time software engineer and researcher into what software practices work, which don't, and why. You'll find his name all over the literature along with names like Yourdon and Brooks, and he's got a long list of professional credits. In other words, he's an experienced, cranky, opinionated old coot who pulls no punches and writes a very readable and useful book. And he's on your side, having deliberately passed up a more lucrative career in management for a technical track." Read on for the rest of Sarusa's review. Facts and Fallacies of Software Engineering author Robert L. Glass pages 190 publisher Addison-Wesley rating 8 out of 10 reviewer Sarusa ISBN 0321117425 summary 40 years of software engineering research in a nutshell.

The Layout

Facts and Fallacies is not a technically demanding book; it's a very easy and compelling read. There are 55 Facts (and 5+5 fallacies) grouped into logical sections such as Management, Life Cycle, and Quality.

First, each Fact is stated succinctly. (For instance, Fact 1: The most important factor in software work is not the tools or techniques used by the programmers, but rather the quality of the programmers themselves.) Then the point is fleshed out more fully -- in this case, that even with all the periodic hype for some hot new methodology that promises orders of magnitude greater productivity, the quality of your programmers matters far more than anything else (and even the best new methods only offer 5-35% increases).

Next, the level of controversy about this Fact is discussed. For Fact 1, it's that even though everyone pays lip service to the idea of people being more important than processes, we all still act like it's not true. Maybe this new hot methodology can turn all your lousy programmers into great ones! Perhaps it's because people are a harder problem to address than tools, techniques, and process. And, of course, hot new methodologies sell a lot of books.

Finally comes a list of sources and references, which can lead you to more in-depth great reading like Peopleware and Software Runaways. This all works out to about one to two pages per item.

The Facts and Fallacies

The Facts and Fallacies fall into several groups. Some are not well known (or just met with stunned disbelief) such as Fact 31: Error removal is the most time-consuming phase of the life cycle. Some that are pretty well accepted, but are mostly ignored, like Fact 1 above. Some that are accepted, but nobody can agree on what to do about (if anything), like Fact 9 (paraphrased) #150: Project estimates are done at the beginning of the project when you have insufficient understanding of the requirements and scope, which makes it a very bad time to do an estimate for the entire project.

Some Facts Glass acknowledges many people will flat out disagree with (and for a few people, very loudly), like Fact 30: COBOL is a very bad language, but all the others (for business data processing) are so much worse. These are the Facts where he really has an axe to grind, and make for amusing reading. In this case what he's really saying is that there is a use for domain-specific languages intended to do one specific thing and do it well, rather than languages like C and Java which attempt to be "good enough" for any use under the sun. But everyone hates COBOL, including me, so it's controversial.

What's Good?

Again, this is a good (and fast) Read. Even if you don't agree with everything, Glass is a skilled writer with strong opinions and a sense of humor. And you might end up agreeing more than you expected. I was pretty skeptical when I started reading. After all, I'm a long time software engineer with strong opinions too, and how often do you get opinionated geeks to agree on even what soda or text editor to use? But most of the Facts resonated with my experience, and of course for most of them Glass has substantial research reference for. The best Facts are those that you knew but might never have expressed explicitly, like Fact 41: Maintenance typically consumes 40 to 80 percent (average, 60 percent) of software costs. Therefore, it is probably the most important life cycle phase of software.

Or consider Fact 18: There are two 'rules of three' in reuse: (a) it is three times as difficult to build reusable components as single use components, and (b) a reusable component should be tried out in three different applications before it will be sufficiently general to accept into a reuse library. I knew this generally, and you probably did too, but I didn't know the specific reference for "Biggerstaff's Rules of Three," which give you a ballpark figure.

The book was written in 2002, when eXtreme Programming was hot, and it's very interesting that the predictions Glass made in this book about the strengths and weaknesses of XP were, in retrospect, pretty much on target, and this sort of predictive success helps confirm more viscerally that he knows his subject.

What's Bad?

There are a few Facts in here that Glass included just because he feels strongly about them (or even about specific people) and he doesn't really back them up very strongly except with "well golly, this is so obvious." Like Fallacy 5: Programming can and should be egoless. Note that this is a Fallacy, so he opposes it. I happen to agree with him, but his arguments are mostly personal ox-goring even if they're based on his extensive experience. Still, it's an interesting read.

A few of the Fallacies he feels are so obvious that he doesn't even really bother providing sources or references for them, and this somewhat diminishes the overall feel of rigor.

Really, the worst thing about this book is that it doesn't come with a poster of just a bullet-pointed list of facts and fallacies that you can nail to your office wall (or your boss's).

A Few More Facts

Just to whet your appetite:

Fact 21: For every 25% increase in problem complexity, there is a 100% increase in solution complexity.

Fact 37: Rigorous inspections [code reviews] can remove up to 90% of errors before the first test case is run. [But are so mentally and emotionally exhausting that we rarely do them.]

Fallacy 10: You teach people how to program by showing them how to write programs. Why don't we teach them to read programs first? Good question (and he has a few possible answers).

In Conclusion

I wouldn't say this Facts and Fallacies of Software Engineering is quite as powerful as The Mythical Man Month, Peopleware or Death March on their own, but if you program (or manage programmers) and want to be more than just a code pig, this will give you the condensed version of 40 years of research in a very readable package. Even if you don't agree with everything he says, it's well worth considering it.

You can purchase Facts and Fallacies of Software Engineering from bn.com. Slashdot welcomes readers' book reviews. To see your own review here, carefully read the book review guidelines, then visit the submission page.

Anton Chuvakin writes "Here is a really cool security book that made me lose half a night's sleep when I first got it. Richard Bejtlich's Tao of Network Security Monitoring (Tao of NSM) covers the process, tools and analysis techniques for monitoring your network using intrusion detection, session data, traffic statistical information and other data." Read on for Chuvakin's review of the book. Tao of Security Monitoring author Richard Bejtlich pages 798 publisher AWL rating 10 reviewer Anton Chuvakin ISBN 0321246772 summary Awesome and novel book on monitoring security

The book starts with an fun, exciting background section introducing security, addressing both risks and the need to monitor networks and systems. Topics such as the classic "threat x vulnerability x value = risk" formula to threat modeling and limitation of attack prevention technologies are included. A nice thing on the process side is the "assess -> protect -> detect -> respond" loop, defining at a high level a reasonable security process for an organization. The threat-analysis material seems to have military origins, but is enlightening for other types of organizations as well.

The concept of network security monitoring, as in the book's title, is introduced as being 'beyond IDS' -- with some coverage on why IDS deployments fail and what else is needed (NSM process and tools, that is).

Bejtlich makes the important, rarely appreciated point that intruders are often smarter than defenders. It presents a stark contrast to the "staying ahead of the hackers" theme of many security books, an approach which makes no sense in many cases as the attackers are in fact far ahead to start with. The NSM approach will indeed work against advanced attackers, albeit (as the author admits) at a high resource cost to the defending organization. Such 'worst case' scenario preparations are extremely rare in other security books. Detecting such intruders is covered as part of a breakdown of the compromise process into five phases (from reconnaissance to using/abusing the system).

Another gem is the idea of a "defensible network": not "secure" or "protected," but defensible. A defensible network is one that can be watched, is configured to limit possible intruder actions, can be kept up to date, and runs only the minimum necessary services. A network so configured assures that if bad things happen there, they can be handled effectively.

I liked how the tools are covered in the book. The explanation of each tool is not simply a rephrasing of that tool's manual, but rather presents the tool's best use in the context of the entire system. While the paradigm "products perform collection, people perform analysis" might grow stale as the products get smarter, having training analysts still is one of the best investments in security. On the process side, the book covers complete analyst training. People are indeed the critical component of NSM, since most of the decision-making relies on trained analysts and their investigation, classification and escalation of alerts.

A chapter on netflow and other types of session/connectivity data presents considerable interest to those monitoring networks. Example case studies show how such data helped identify intrusion action that did not directly produce IDS alerts. Same applies to traffic visualization and statistical tools that enrich the IDS data and can sometimes provide early anomaly indications as well.

NSM event-driven analysis in Tao of NSM is centered on Sguil - a new GUI frontend to NIDS, session and other context data, facilitating easy and effective event classification and escalation (if needed).

Emergency NSM vs ongoing monitoring NSM procedures are also covered in the book. Even if an organization does not maintain an ongoing security monitoring program, it can still benefit from NSM that is deployed after a suspected intrusion.

Attacks against NSM processes and technologies also fill a dedicated section. Such attacks include intruder tools as well as attacks against the human (such as simply attempting to overwhelm the analysts) and process components of the NSM.

The book should be required reading for any security professional, and for those wishing to enter the field. It helps to broaden the horizons of seasoned professionals as well as educate the beginners in monitoring techniques. While the value of NSM as an approach can be debated in modern organizations (where tuned sensors and skilled analysts are an exception rather than the rule), the book is a superb security resource even for those who do not choose to implement NSM at the moment.

info-secure.org maintainer Anton Chuvakin, Ph.D., GCIA, GCIH is a security strategist and author of Security Warrior . You can purchase Tao of Security Monitoring from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Daniel Shefer writes "If you want to make money by selling your software, it has to be marketed, promoted and then sold to the customer. Doing this is not as easy as it may sound. The Product Marketing Handbook, 4th Edition details the ins and outs of the aspects of software product marketing needed to make this happen." According to Shefer, "this is a great book if you want to market your product and get it sold"; read on for the rest of his review. Even if your software is free (as in speech, or as in beer), this book may offer insights in persuading people to try it out. The Product Marketing Handbook, 4th Edition author Merrill R. Chapman pages 690 publisher Aegis Resources rating 9/10 reviewer Daniel Shefer ISBN 0967200865 summary A great guide to marketing, promoting and selling software.

Rick Chapman is also the author of In Search of Stupidity: Over Twenty Years of High-Tech Marketing Disasters (previously reviewed on Slashdot.) He is also the publisher and editor of Soft*Letter and the Software Success Newsletter. The Handbook presents today's best practices based on Chapman's extensive experience, and includes up-to-date information on everything from advertising to OEM agreements, pricing to visual identity.

The book offers practical insights into vexing product marketing-problems. Throughout the book, Chapman gives relevant, down-to-earth descriptions of how to (and how not to) plan and deliver product-marketing efforts. There are case studies from every aspect of the high-tech industry, as well as detailed lists of dos and don'ts.

This is a great, safe place to learn about marketing, distributing and selling software before putting your own time and money at risk; the Handbook includes comprehensive checklists to help manage the product-marketing process. (These lists are also provided on a CD that accompanies the book.)

The text starts with an overview of some changes the software market has seen since the book's first edition. Chapman focuses on one of the most significant changes since then and discusses the rise of open source computing and Linux. He then continues to the book's raison d'être with a brief discussion of why software companies fail.

The first chapter covers market research. Before spending resources on writing code, it is always best to know if there is a real need for the product, and what other companies are up to in the intended market space. The chapter starts with an overview of several research techniques such as conjoint analysis, focus groups and competitive intelligence.

The next chapter discusses some of the hardest issues in marketing software: positioning, pricing and naming. A great example, the OS/2 debacle is a classic study in how not to name or position a product.

These chapters detail how to position a product, how to brand it, and how to price it so both you and your sales channels can make money off of it.

Chapter 3 discusses channel distribution. Channels are the organizations that move a product to the customer. First, you have to decide if you will provide the product as an ASP or shrink wrapped. In the latter case, selling the software requires a logistics backbone that small independent software vendors (ISVs) may not be able to afford. While some software packages can be successfully sold using online channels exclusively, these are the exceptions. Other ISVs have to utilize distributors, VARs, store chains and catalogs to move their products. Getting these channels to distribute the product is not as easy as sending them a copy and expecting them to "see the light." It takes a good understanding of the channels' business models and capabilities (as well as hard work on your part) to get to the point where a customer sees your product in a CompUSA or a printed catalog. Channels have to be located, contacted, convinced, trained and constantly supported to make this happen. This chapter also covers OEM and international distribution issues.

The next chapters discuss collateral advertising (brochures, white papers etc.), PR, advertising and sales promotions respectively. While none of these are rocket science, getting them wrong is a costly proposition. In addition to the effort involved and their cost, there are legal implications as well. For example, not properly estimating the return rate of a rebate coupon or making an inaccurate claim in a piece of collateral can land a company in hot water. Most ISVs outsource these activities to experts, but even doing that successfully requires at least a general understanding of these topics.

Chapter 8 discusses direct marketing. Some of the topics covered in this chapter are direct mailings, infomercials, telemarketing, mailing lists and fulfillment.

Chapter 9 covers software bundling. Bundling is where companies offer two or more products as a bundle. You're almostly certainly familiar with this from the way companies like Amazon offer two related products for a slightly better price then their combined prices. How and why to bundle are explained in this chapter.

Chapter 10 discusses the topics Internet marketing. In theory, the easiest way to market a product these days is over the web. One creates a website, submits it to Google and Overture (Yahoo!), and presto, there are visitors who buy the product. It's not so simple,though: The problem is luring potential customers to the website, keeping them there, and leading them to purchase the product. This chapter covers designing and optimizing websites as well as managing discussion groups, list servers and online ad campaigns. Another important topic is search engine optimization (in simple English, getting your website to the top of the Google and Overture Results pages). The text includes many dos and don'ts on how this is done.

Chapter 11 discusses trade shows. I don't think highly of tradeshows (see the rightful demise of Comdex) but if you decide to go down this road, here's how to do it properly.

Chapter 12 discusses sales methodologies and strategies. It opens with the trick question that most people get wrong: What is the number one reason that software companies fail? The correct answer, of course, is "not enough sales."

There are inherent reasons that you are a developer writing code or a sales rep doing sales. There are the basic character traits that make each of you good at what you do. I'm not saying that as a developer you can't sell. You may be able to -- but probably not as well as a seasoned sales rep. As with other issues, you will need to understand the dynamics of the sales process so you can create a product that makes it easier to sell. This chapter will introduce you to basic concepts such as the pipeline, prospecting and, the software selling cycle. It will also take you through the multiple steps of complex sales cycles which are a painful part of selling large systems. But, as bank-robber Willie Sutton supposedly said, that's where the money is. No less important is the discussion of negotiation and presentation techniques.

The last chapter in the book gives a brief overview of product management and the processes involved. While relevant and accurate, I would defer to other texts on the subject for a more thorough discussion of product management. See, for instance, Software Product Management Essentials by Alyssa S. Dver, or The Product Manager's Handbook by Linda Gorchels.

The book includes three appendices: A product marketing cost matrix, a product marketing resource directory and a product marketing timeline, and ends with a glossary and index. Attached to the book is a CD which includes all the checklists that are dispersed throughout the book as well as several sample files.

The Handbook's depth and breadth as well as the author's experience make it the best book on product marketing I've encountered.

Reviewer Daniel Shefer is a Software Product Management expert and has written numerous articles on this topic. The Product Marketing Handbook, 4th Edition is available only through the author's website. For more about product marketing see: www.ProductMarketing. com.

Raymond Lodato writes "Where do I begin? Oh yes! If you are a teenager who uses computers, or the parent or guardian of a teenager who does, buy Always Use Protection, by Dan Appleman! Let me take a little time to explain why." Read on for the rest of Lodato's review. Always Use Protection: A Teen's Guide to Safe Computing author Dan Appleman pages 288 publisher Apress rating 10/10 reviewer Raymond Lodato ISBN 159059326X summary An excellent and realistic reference for teens and their parents/guardians about the potential hazards of computing.

Dan Appleman knows how to talk to teenagers. He's made the presentation very logical, he keeps the chapters a reasonable length so a teenager won't feel overwhelmed, and he had a crew of teenagers review this book before it was published so that he knew they would understand it. Those adults who aren't technically adept will find it an easy read, too.

Always Use Protection is broken up into three main parts: Protecting Your Machine, Protecting Your Privacy, and Protecting Yourself. There is a fourth part with useful appendixes, also.

Protecting Your Machine goes through all of the gremlins that can bother your computer, how to get rid of them and how to prevent them from coming back. Viruses, Trojan horse programs, and worms are covered clearly. Not too much depth involved, but not too little either. Dan covers the ins and outs of the three main preventive measures: anti-virus programs, firewalls, and system configuration and updates. He makes sure that his discussions relate to the types of programs that teenagers are likely to run: P2P software, online games, Instant Message clients, e-mail programs, and web browsers. He's careful to include other avenues of attack besides the Internet, such as infected floppies and CDs cut by well-meaning friends.

Always Use Protection explains how to determine which type of anti-virus programs are available and how to run them (using McAfee's VirusScan as an example), but puts the responsibility for deciding which one to use squarely in the reader's lap. Dan has made sure that he's not pushing any particular product over another. In fact, there were one or two places where I wished he'd just come right out and say I'd recommend blah-blah software, but he always said the reader should check the pros and cons of the possibilities and make their own decision.

Firewalls are discussed in detail, as well as their possibly unintended consequences (an online game refuses to run because a critical port is being blocked by the firewall, for example). He does state that if you're on a network behind a router, you may not need a firewall. This is my only disagreement with Dan. I believe a personal firewall should be on each and every machine, regardless of how it connects. It will protect not only the machine itself, but make it harder for the machine to attack others.

Software updates are probably one of the most under-utilized options in the home. News items in papers and on the web speak frequently about how such-and-such a virus got into machines mainly because security updates available from the manufacturer for months were simply not installed. Dan makes sure that the reader understands how shortsighted that approach really is. The updates are usually free, and just take a little time to download and install. Always Use Protection explains exactly how to do that and why it's a good thing.

The configuration chapter describes many little tweaks available to harden your browser and e-mail reader. Many people are not aware of the number of 'dials' they can play with (and if they were, they'd probably be overwhelmed), but this chapter zeroes in on the most important ones.

If this book was only chapter 9 - What to Do When You've Been Hit - it would still be worth the cover price. In this chapter, Dan gives a careful, step-by-step menu of what you can and should do to recover as much as you possibly can, eradicate the malware that is causing the problem, and get your system back to a usable state. It's the one chapter he says you shouldn't read front-to-back, but follow the links (if you see this, go to this section) like one of those make-your-own-ending books. I have this one bookmarked for future reference.

The next four chapters form Part II - Protecting Your Privacy. In here, Dan explains the various ways your personal information can be gleaned, mostly from a user innocently filling in a form supplied by a con artist. He talks about identity theft and what it means to a teenager. The need for good passwords is clearly discussed, but he acknowledges that most people won't use strong enough ones. Therefore, he promotes a simple plan with three passwords (high, medium, and low-security) that will work in most cases. He ends off this part with a good treatise on cookies of all forms, and how to turn off the worst ones.

Finally, he talks about protecting yourself in chat rooms and from common scams. While there is a lot of press about teenagers being lured by scoundrels in chat rooms, Dan notices that the actual statistics are very low. Regardless of the statistics, he gives extremely good advice about how to use a chat room safely (mostly involving lying about almost any bit of personal information you might be asked for).

The appendixes have good summary information for teens and adults, and have a special appendix just for the parents. It give good advice to make sure your teenager is willing to come to you for question without worrying about losing online privileges.

All in all, Always Use Protection should be read by every parent and, hopefully, by their kids. I'm going to try to get my 15- and 13-year old to read it (Good luck to me! You should have seen the arguments to get them to finish their summer reading!) I liked the approach, the content, and the presentation so well, I had to rate this a 10.

You can purchase Always use Protection: A Teen's Guide to Safe Computing from bn.com. Slashdot welcomes readers' book reviews. To see your own review here, carefully read the book review guidelines, then visit the submission page.

prostoalex writes "Wireless LANs seem to be enjoying the tremendous amount of interest lately, if you judge by the number of book covers and articles written on the topic. It's no wonder that this year the sales of WLAN equipment will grow 20% and generate $2.1 billion - everyone seems to be installing a wireless network in their office, their apartment complex or their own backyard. With extending the network into the radio world one is always extending the opportunities for unwelcome visitors to become part of the network. This book is a hands-on guide on hacking wireless networks followed by the recipes and principles to protect WLANs." Read on for the rest of prostoalex's review of Wi-Foo . Wi-Foo: The Secrets of Wireless Hacking author Andrew Vladimirov, Konstantin V. Gavrilenko, Andrei A. Mikhailovsky pages 608 publisher Addison-Wesley rating 9 reviewer Alex Moskalyuk ISBN 0321202171 summary Complete guide to wireless attack and defense

Wi-Foo requires a certain level of expertise, and it's unlikely that the book will be sold left and right or that everyone will want a copy. First of all, to do anything substantial you need to have Linux or FreeBSD operating system installed and know your way around it. Second of all, some knowledge of Perl is required to go through the script source code and enjoy occasional tools that appear on the Internet. The third required bit of knowledge is some familiarity with how wireless networks work and how one can gain advantage of those radio waves that seem to contain pieces of data.

The authors claim that one has little knowledge of wireless security unless he's done some war-driving. So, skipping the first two chapters (which talk about security in general), chapters 3, 4 and 5 take the reader through the hassle of setting up the Linux laptop with all the hardware and software needed to do successful war-driving. The last time I reviewed a book on getting wireless to work with Linux, you guys kept asking what card would work the best with a Linux laptop. To quote p. 28 of Wi-Foo, "if you're serious about 802.11 penetration testing, you should get a decent Prism chipset card. If you plan to base your security audit effort around the BSD platform, you probably cannot do without it. Prism chipset CF and PCMCIA cards are known to be produced by Addtron, Asante, Asus, Belkin, Buffalo, Compaq, Demark, D-Link, Linksys, Netgate, Netgear, Proxim, Senao, SMC, Teletronics, US Robotics, Zcomax and ZoomAir."

What follows could essentially be condensed into a single Web site with links to various Linux tools for network discovery, traffic analysis, encryption cracking, 802.1x cracking, frame generation and traffic injection. Kudos to the authors for providing sometimes detailed instructions on setting up the utility and getting the successful results out of it -- it's obvious that they did not just peruse the Web in search of what's available and provided a list of URLs; they installed, tested and reviewed all the Linux network security utilities listed in the table of contents. As much as many of the products and tools listed complement one another, it was useful for me to see the professionals' take on advantages and disadvantages of free tools out there. Wherever possible, the authors try to stick with free software, which makes the book a pretty useful guide for most enthusiasts out there.

The authors are serious about getting the reader to war-drive at some point, and chapter 8 specifically talks about generating wireless denial-of-service attacks as a last resort for a cracker, who seems to be in the bad mood when other methods of wireless penetration do not work. The books talks about antenna amplifiers and some hardware you might buy to be more successful in wireless hacking. They also discuss the possibilities of war-biking, war-walking and riding a hot air balloon.

By the time you're finished with the chapter 9, if your title includes words like "security" or "administrator," you will probably find yourself quite perplexed. That's where Part 3 (Defense) kicks in, as the authors discuss counter-measures against wireless cracking and possible steps one can take to secure the wireless network. It's not a typical don't-use-WEP-don't-broadcast-your-ID-don't-rely-o n-MAC-filtering preaching one can find in security manuals created for the home user (I am not saying those are bad -- for a home user they do provide necessary guidance in securing a WLAN). This is mostly industrial-level security, which might include multiple levels of protection, such as 802.11i implementation, implementing encryption around the wireless networks, creating hardware Linux-based gateways, deploying VPNs and intrusion detection systems. Setting up honeypots is missing from this list, although one can debate whether this could be considered a worthwhile project outside of academic world.

The book uses clear language and is easy to read. At the same time it takes a while to go through it, as you keep trying out the presented solution on your Linux laptop. The chapters that talk about the philosophical decisions when securing wireless LANs are helpful as well -- the authors occasionally get away from hands-on approach and talk about general principles to consider. Code examples are easy to follow, and every tool that's presented in the title is accompanied by the URL (for some reason Addison-Wesley did not include a CD with Wi-Foo); a large number of them point to sourceforge.net. All the links are available on the book's Web site; see the attack and defense sections.

If you should decide to take up a career as a wireless security consultant, Appendix G includes a variety of checklists and templates that the authors recommend for the corporate environment. Chapter 8 -- Breaking Through is available for free in PDF format. Overall I liked this book a lot. It seemed to concentrate on what's necessary without going into fluff and chapters like "History of radio" or "Linux on laptops for beginners." It's informative and easy to read; if you're an enthusiast, try out the free chapter and see if you like the authors' style, but if you're network admin or security professional, this book is almost a must. It's a combo of Exploiting Software and Hacking Exposed with specialization on wireless LANs.

You can purchase Wi-Foo from bn.com. Slashdot welcomes readers' book reviews. To see your own review here, carefully read the book review guidelines, then visit the submission page.