Make it easy for administrators/force administrators to sandbox/chroot your application
If your applications needs to use server storage, consider DoS attacks (a user uploading lots of stuff)
Make sure all privileged actions hit the same authentication class/function; if you change your authentication code, this ensures that the changes are applied across the board <-- I catch newbie programmers making this mistake all the time!
If you do all of the above, your app might still not be "secure", but breaking it will be a PITA.
It really depends on the application. I recently went over this as we surveyed the network capabilities of 450 of our field reps in order to determine whether doing virtual meetings was feasible, i.e., something like WebEx. With an application like WebEx, once you meet the minimum bandwidth requirements (roughly 700Kbps down and 300Kbps up for the kinds of meetings we were looking to do), latency is indeed the most important factor. Call quality deteriorates fast when you're looking at 100ms or greater RTT. WebEx also will "fail" into using TCP if it cannot establish a UDP connection, which means that it suffers horribly on wireless connections, where dropped packets are common.
But other protocols, e.g., rsync, which was specifically designed to avoid RTT costs, perform quite well on high-latency network connections, by minimizing round-trip communication. In that case, bandwidth is the most important measure.
BTW, our survey showed Verizon coming out on top by a hefty margin. On average, FiOS users got about 15Mbit down, 7.5Mbit up, and under 10ms latency, with some being quite a bit higher. Of course, offices with Cogent fibre connections trashed everybody, but that's not really surprising-- our test site was running on Cogent, too.
I agree, as someone who has to ship a lot of stuff around as a part of my job, we've tried a number of couriers, and I think we have a pretty good fell for the quality (timeliness, damage, convenience) of many of them. Here's what we found:
FedEx, far and away the best, but expensive
USPS, not always on time, but mostly reliable; premium services don't compare with FedEx; tracking isn't great
UPS, usually on time, and has lots of premium services, but theft and damage are MAJOR problems. They will happily deliver a package to a wrong address (i.e., THEY got it wrong), and when that package is stolen, they will disclaim all responsibity. Their "insurance" is a fucking joke-- they have weaseled out of paying every claim we've filed.
DHL is pathetic. They once cheerfully delivered a package to me that had a hole straight through the package and the contents inside. We had to request one our suppliers never use them again.
Did you try ASR? We've found that Mac images are much easier to maintain than Windows ones, because the Mac deals with hardware changes at boot time much better than Windows. I was disappointed to learn the other day that Windows 7 is just as ugly as XP when you change hardware-- bluescreens. We never came across a kernel panic on our Macs, and we deployed the same image across Mac Minis, iMacs, and Mac Pros.
My family's from Salem, and I grew up in Newburyport, so I know the area very well. Did you even read what I wrote? Students are NOT being forced to buy laptops-- they can borrow them if they need to.
Usually, the start of a sentence has something to do with its ending, so it's natural that people would think there is some connection between a "well-regulated militia" and the "right to bear arms".
I find it ironic that the same people who complain about a lack of strict constitutionalism in the judiciary complain vehemently when historians suggest that the correct historical interpretation doesn't mean that you get to have a nice little weapons cache in your basement.
I'm pretty sure that any sufficiently large organization, say, one that has more than 20 members, behaves pathological. Humans don't agree by nature, but it's easier to keep the message coherent when you only need to knock a few heads together.
did Australia run out of beer or something? Why are they all up in each other's shit lately?
I knew that Australia has had a neoconservative movement somewhat like here in the U.S., but they seem to have taken the GWB concept and really run with it. Any Aussies care to inform us Merkins wtf is going on?
No, that's not true. Saturation with Internet protocols is extremely bad; likewise for radio signals. Many of you probably think that if you have a 100 Mbit connection that you should be able to use 100 Mbits. Sounds fair, right? Sadly, TCP suffers from something called "congestion collapse" when it hits roughly 40% of utilization, so a congestion-avoidance mechanism was introduced to constantly back-off your send rate (it's called "exponential backoff") to prevent this from happening. The only way to fix this is either to over-provision, or to impose heavy-handed QoS parameters. Not to mention-- what does "saturation" mean? If all of us get 5 Mbit plans, does that mean that our ISP needs 5n (where n is the number of customers) available bandwidth? What about upstream of them? What about upstream of that? Such a provisioning scheme is a fantasy.
Wireless is in a similar, but slightly different boat: wireless is sort of like our old hub infrastructure, before switches were affordable. That essentially means that the network is like a bus, and that clients themselves need to handle collisions, which are frequent. Because of TCP's congestion avoidance mechanism, it can't tell the difference between a packet lost due to a collision and one dropped because of network saturation, so it does the same thing, it backs off. In wireless, the data link layer tries to address this (at least in the 802.11 protocols), but it is not terribly successful, and that is because there are all other kinds of problems with radio transmission, like the "hidden terminal problem", etc, that don't exist in "well-behaved" networks.
Anyway, all of this means that as you add customers to a wireless network, your capacity may decrease. I'm not saying that telco prices are fair, but the economics of managing such a resource are not simple.
You can pay once for a data stream. It's called Internet service.
Telephone and television are services on top of those data plans, and as such, they are extras. You pay extra for more. In an ideal world, that extra work is easy (just provide the "television" and "telephone" services on top of IP transports), but actually, because of a mixture of legacy systems (e.g., analog television) and QoS requirements (your telephone-over-cable connection is only pretending to be POTS), running these services is not so straightforward. It's fair to pay more for more services. "More is better", remember, and we pay more for better.
Because TFA is filled with gems like:
You're paying multiple times for "unlimited" data? Isn't that like multiplying by zero? Either way, you lose.
which is obvious idiocy. So, translation: "we think we're paying too much".
And, we are paying too much. But her argument is stupid.
I can't agree enough. Exercise, unlike caffeine, also significantly reduces my stress level. Of course, I still drink the coffee, but exercise does most of the work.
It's amazing, though, how many people wouldn't bike to work (as I do) because they'll "get sweaty". So what? A little sweat never killed anybody.
Or that there really aren't any except withdrawal symptoms and slightly brownish teeth.
We're awash in chemicals all day. Why do we have to vilify certain ones? People have withdrawal symptoms when they break up with their girlfriends, too, but we don't go around trying to treat people for love addiction. I can assure you that the feelings are just a bunch of chemicals.
In real non-caffeine-addicted life, there is nothing you can do to make your brain go from 0-100 within a matter of a minute. With caffeine, you can do that.
When I come into work in the morning, I am my arshole-y, foggy, caffeine-withdrawal self. Totally useless. But then I have my cup over coffee as I work over something, and before you know it, my mind is racing along. I remember what it was like in those B.C. days ("before caffeine"). I was a thinking being back then, too, but I had no control over when. Becoming caffeine-addicted was a conscious choice.
Also, caffeine makes me like doing things that I would normally hate, like going to work. Totally worth the tradeoff.
There's nothing "special" about a person who writes code. They've simply learned how to adapt their minds around the way that a computer solves a problem. Sometimes, having to go through this exercise means that you get new insights into the problem. That's why I'm a professional programmer. Other times, it's just a dull drag to get'r'done.
Until I went to college, I was "self-taught" in programming. I learned a lot of cool, new things in college, and I learned a heck of a lot more when I started producing code for money. I have the "knack" for it. But you know what? When I look back at code I wrote even a few years ago, it sucked.
Why?
For one: programming is an art, and well, practice makes perfect. That said, everyone sucks when they start.
But the other one, and Joel Spolsky says this rather concisely: it's easier to write code than to read it.
Discouraging people from becoming programmers because you don't want to fix their bugs is just about the lamest argument I've ever heard. Bugs happen, man. If we had a magic formula for writing software, guess what? We'd write software to write software. No one gets it right.
Slashdot Mirror
I'm all for a legislative mandate that says porn producers must use .xxx. An 80% solution is better than a 0% solution.
The interesting thing will be whether you will be required to be porn-associated in order to get a domain. I would definitely get a [myname].xxx!
If you do all of the above, your app might still not be "secure", but breaking it will be a PITA.
It really depends on the application. I recently went over this as we surveyed the network capabilities of 450 of our field reps in order to determine whether doing virtual meetings was feasible, i.e., something like WebEx. With an application like WebEx, once you meet the minimum bandwidth requirements (roughly 700Kbps down and 300Kbps up for the kinds of meetings we were looking to do), latency is indeed the most important factor. Call quality deteriorates fast when you're looking at 100ms or greater RTT. WebEx also will "fail" into using TCP if it cannot establish a UDP connection, which means that it suffers horribly on wireless connections, where dropped packets are common.
But other protocols, e.g., rsync, which was specifically designed to avoid RTT costs, perform quite well on high-latency network connections, by minimizing round-trip communication. In that case, bandwidth is the most important measure.
BTW, our survey showed Verizon coming out on top by a hefty margin. On average, FiOS users got about 15Mbit down, 7.5Mbit up, and under 10ms latency, with some being quite a bit higher. Of course, offices with Cogent fibre connections trashed everybody, but that's not really surprising-- our test site was running on Cogent, too.
Do you have a reference for the hydropower mention? I've been wondering about this for awhile now.
What it's like to own an Apple product.
What are the better tools, if you don't mind me asking?
Did you try ASR? We've found that Mac images are much easier to maintain than Windows ones, because the Mac deals with hardware changes at boot time much better than Windows. I was disappointed to learn the other day that Windows 7 is just as ugly as XP when you change hardware-- bluescreens. We never came across a kernel panic on our Macs, and we deployed the same image across Mac Minis, iMacs, and Mac Pros.
Clearly we should ban homework instead.
Please identify the part of the article where it says students won't be able to do their homework without the computer.
It should be pointed out that nowhere in the article is it stated that homework assignments can only be done on school-provided laptops.
My family's from Salem, and I grew up in Newburyport, so I know the area very well. Did you even read what I wrote? Students are NOT being forced to buy laptops-- they can borrow them if they need to.
I'd wholeheartedly agree if it weren't for the fact that "the web" is a terrible platform.
Students who don't participate will be able to borrow a school-provided laptop during the day, but they won't be able to take it home, Hayes said.
Which essentially means that the program is voluntary. The school is hoping to be able to save money by not having to provide computer labs.
Discussing something substantive with your parents: oh, the horror!
They should just replace the sticker with "Just watch Dancing With The Stars. You'll be happier."
Usually, the start of a sentence has something to do with its ending, so it's natural that people would think there is some connection between a "well-regulated militia" and the "right to bear arms".
I find it ironic that the same people who complain about a lack of strict constitutionalism in the judiciary complain vehemently when historians suggest that the correct historical interpretation doesn't mean that you get to have a nice little weapons cache in your basement.
Did you actually RTFA or are you responding to the lame editorializing? The Guardian article is quite disturbing.
I'm pretty sure that any sufficiently large organization, say, one that has more than 20 members, behaves pathological. Humans don't agree by nature, but it's easier to keep the message coherent when you only need to knock a few heads together.
did Australia run out of beer or something? Why are they all up in each other's shit lately?
I knew that Australia has had a neoconservative movement somewhat like here in the U.S., but they seem to have taken the GWB concept and really run with it. Any Aussies care to inform us Merkins wtf is going on?
No, that's not true. Saturation with Internet protocols is extremely bad; likewise for radio signals. Many of you probably think that if you have a 100 Mbit connection that you should be able to use 100 Mbits. Sounds fair, right? Sadly, TCP suffers from something called "congestion collapse" when it hits roughly 40% of utilization, so a congestion-avoidance mechanism was introduced to constantly back-off your send rate (it's called "exponential backoff") to prevent this from happening. The only way to fix this is either to over-provision, or to impose heavy-handed QoS parameters. Not to mention-- what does "saturation" mean? If all of us get 5 Mbit plans, does that mean that our ISP needs 5n (where n is the number of customers) available bandwidth? What about upstream of them? What about upstream of that? Such a provisioning scheme is a fantasy.
Wireless is in a similar, but slightly different boat: wireless is sort of like our old hub infrastructure, before switches were affordable. That essentially means that the network is like a bus, and that clients themselves need to handle collisions, which are frequent. Because of TCP's congestion avoidance mechanism, it can't tell the difference between a packet lost due to a collision and one dropped because of network saturation, so it does the same thing, it backs off. In wireless, the data link layer tries to address this (at least in the 802.11 protocols), but it is not terribly successful, and that is because there are all other kinds of problems with radio transmission, like the "hidden terminal problem", etc, that don't exist in "well-behaved" networks.
Anyway, all of this means that as you add customers to a wireless network, your capacity may decrease. I'm not saying that telco prices are fair, but the economics of managing such a resource are not simple.
Telephone and television are services on top of those data plans, and as such, they are extras. You pay extra for more. In an ideal world, that extra work is easy (just provide the "television" and "telephone" services on top of IP transports), but actually, because of a mixture of legacy systems (e.g., analog television) and QoS requirements (your telephone-over-cable connection is only pretending to be POTS), running these services is not so straightforward. It's fair to pay more for more services. "More is better", remember, and we pay more for better.
Because TFA is filled with gems like:
You're paying multiple times for "unlimited" data? Isn't that like multiplying by zero? Either way, you lose.
which is obvious idiocy. So, translation: "we think we're paying too much".
And, we are paying too much. But her argument is stupid.
I can't agree enough. Exercise, unlike caffeine, also significantly reduces my stress level. Of course, I still drink the coffee, but exercise does most of the work.
It's amazing, though, how many people wouldn't bike to work (as I do) because they'll "get sweaty". So what? A little sweat never killed anybody.
The point is that people aren't just saying "this is bad for you", they're saying "this is morally wrong". Morals have nothing to do with it.
Or that there really aren't any except withdrawal symptoms and slightly brownish teeth.
We're awash in chemicals all day. Why do we have to vilify certain ones? People have withdrawal symptoms when they break up with their girlfriends, too, but we don't go around trying to treat people for love addiction. I can assure you that the feelings are just a bunch of chemicals.
In real non-caffeine-addicted life, there is nothing you can do to make your brain go from 0-100 within a matter of a minute. With caffeine, you can do that.
When I come into work in the morning, I am my arshole-y, foggy, caffeine-withdrawal self. Totally useless. But then I have my cup over coffee as I work over something, and before you know it, my mind is racing along. I remember what it was like in those B.C. days ("before caffeine"). I was a thinking being back then, too, but I had no control over when. Becoming caffeine-addicted was a conscious choice.
Also, caffeine makes me like doing things that I would normally hate, like going to work. Totally worth the tradeoff.
There's nothing "special" about a person who writes code. They've simply learned how to adapt their minds around the way that a computer solves a problem. Sometimes, having to go through this exercise means that you get new insights into the problem. That's why I'm a professional programmer. Other times, it's just a dull drag to get'r'done.
Until I went to college, I was "self-taught" in programming. I learned a lot of cool, new things in college, and I learned a heck of a lot more when I started producing code for money. I have the "knack" for it. But you know what? When I look back at code I wrote even a few years ago, it sucked.
Why?
For one: programming is an art, and well, practice makes perfect. That said, everyone sucks when they start.
But the other one, and Joel Spolsky says this rather concisely: it's easier to write code than to read it.
Discouraging people from becoming programmers because you don't want to fix their bugs is just about the lamest argument I've ever heard. Bugs happen, man. If we had a magic formula for writing software, guess what? We'd write software to write software. No one gets it right.