The IT Philosopher

Economics in Computer Security

2010-07-15T03:00:00.000-07:00

I read this article here for the university, and found very interesting. They approach the fact that even if the major of the user in the internet ignore even the basic security “best practices” (do you remember? Keep you antivirus and programs up to date, do not click in links that you do not know, do not execute javascript from unknown sources) the internet is still usable: it is still safe enough so you can buy on ebay, use internet banking and so on.

Why?

They defend that you have 2 possibilities of attacks: scalable attacks and non-scalable (after that they introduce briefly a third one, which is a hybrid type of both). In the scalable, you have a fixed cost, and it grows less than linearly when the number of potential victims increases, so it is easy to scale and the higher the number of attempts, the better. In the non-scalable, you have a cost that increases at least linearly with the number of attempts. This means that if you have a cost x to perform 1 attack, you will have a cost of at least 2x to perform 2 attacks.

Examples for the first type are easy to find: spam, phishing and so on. For the second one, it is a little less common: it is when the attacker has to get extra information about the victim to perform the attack, to personalize the attack. For instance, answering the secret question to get access to the email account.

Once they divided the attacks in these two groups, they show some calculations and use market rules to show that the scalable attack (which they call the attacker Carl) is much cheaper, so it doesn’t need a big gain from each victim, its goal is to reach as much as possible (to spread the cost) and get a reasonable amount of money. Klara, the attacker using non-scalable attacks, has a different situation: her attacks are not scalable, so the cost cannot be spread within the victims, so the return it needs is much higher than Carl. Which makes sense: imagine 2 companies that produce the same product, one does it in large quantities and the other produces it manually. The first one is scalable and gets the money in the quantity, not the price of the product, while the second has to get its money in the price, not quantity.

Regarding the scalable attacks, they claim that are very easy to be avoided, because they are simple. Regarding Klara’s attack, we have a problem. Assuming computers as they are today, it is just not possible to be 100% secure from attacks, so if Klara wants to attack you, she will succeed (and she is also a girl, girls always get what they want). But the fact is: you have to be worth her effort. You have to be some value for Klara. You have to be very rich, someone important or an ex-boyfriend that she is not very happy with. You can’t be just someone, for some reason, you have to be special to her. They get to some results that indicate less than 1% of the users of internet are special, so attacking the others 99% will only hurt Klara instead of helping her.

With this information, the conclude that: if you are in this less-than-1%-rate of the users (and for each attacker, this changes, because its personal reasons and “enemy circle” changes), you are in trouble: the attacker will be able to attack you and there isn’t anything you can do about it. But if you are not in this rate, you are happy because nobody cares about you: if you do not let you wallet on the table, they will not going to steal you. So they say that you have only to defend against the simple attacks, trying to defend against the complex attacks will require time/money/effort and you are probably not going to be victim of it. If you are, it will be useless, so they defend: “Do the minimum and hope for the best”.

I found the article very interesting, the way they get to the results and the logic they use to do that. The problem I have is with their conclusions, for me they are a little bit extreme: doing the minimum and hoping that someone “smart” will never want to attack you is not enough for me. Also, the attackers are not all high skilled, there may be some people that are beginners and using simple hacking-programs (imagine a co-worker that for some reason does not like you). These attacks can also be prevented. So I think it may be yes useful to invest time in some security improvements and knowledge.

Almost forgot: the paper is from Microsoft Research ;).

The Hero of the Day

2010-06-10T15:34:00.000-07:00

Hi!
Yes, I am not posting very often, I know. But the idea of this blog isn't to have frequently posts, but posts that I think are worth to be posted and read by some reason. I hope you understand and enjoy them.
If you also have some ideas of subjects for me to talk, or if you want me to publish something you wrote, so we can discuss it, please let me know, I would be very happy doing that!

And I hope you enjoy this new post,
Oscar

The Soccer World Championship is starting, and I’m getting prepared to it. While hearing about soccer 24 hours a day, something came to my mind, about something that is really bothering me for a long time.

I play in a small soccer team here in my city, we have training twice a week and we play an “official” game in the weekend. We are not professional players, so it is not rare to get tired during the match, it is completely natural and it doesn’t bother me. What bothers me is the way we handle with it: we ignore it, just like some IT companies. The team expects you to be a Hero. No! That doesn’t work this way! If I am tired during a match, I have to use the energy I have left in a clever way. Running the same way I was doing maybe is going to work for the next 10 minutes, but after that, I won’t be able to walk in the field. It doesn’t work!

The same thing happens in some companies: the project is delayed, that means you have to produce more, what do they do? Extra hours, working at night, on weekends. This may work in the first 2 weeks, but professionals are just like soccer players they get tired! In a second moment, the professionals are going to reduce the productivity, increase the number of errors, things are going to get (much) more time to get done and your project is going to get even slower. Your professionals are going to be more stressed each day, the chance of internal problems is going to increase, and your project is going to be every day slower. Not good, ha?

I would not be naïve enough to say that adding people to the team would solve the problem. It rarely does, unfortunately this is not how things happen in reality.

What I propose is: use your workforce as wise as possible. In a soccer team, it is relatively easy: if you can’t substitute a player, you can change the position of two players, so the tired one can perform tasks that need less energy. Unfortunately it is not so easy in a company. Changing tasks between professionals is rarely going to give you results and changing professionals is not feasible at all. But the main idea still stands: use your team as a team and try to perform the tasks using the least energy as possible. Extra work time is only a short term solution and should only be used as such, otherwise you are risking to ruin your team mentally and physically before having your project done. Also, try to motivate your team, not only offering bonus in money. Sometimes only a “Hey! Good job, thanks!” will help. Maybe a happy hour or a cake. Make the team feel they are important to the company and the company know they are under stress. This may help more than it seems: in a company I worked, the most expected day of the month was the one that we celebrated birthdays, it happened once a month and was a 30 minutes pause with cake. Nothing exceptional, but was very nice.

Being a Hero may look challenging and “cool” for junior professionals, but as soon as they have his experience for the first time, they just notice it is just not worth.

If you read this text until here, I just hope that you understood this:

You need your team to get your job done, take care of it!

My Clients Are All Girls

2010-04-16T06:26:00.000-07:00

I know that the „cliché“ IT worker is that guy who doesn’t talk to anyone, who doesn’t have any relationship and who doesn’t get along with people in the real life. I would say that it is not true, at least not for all. We are the only guys who have to flirt as part of our jobs.

You are in your bar, modeling, and then you see that girl, let’s call her Client. Client is a very beautiful girl, who attracted you the moment you saw it and you really want to know her. What do you have to do? You have to impress her. How can you do it? Talking and being interesting.

But almost everybody knows that the less you talk, the more interesting you become.
So you don’t really have to talk, you have to listen. You ask things about her life, her opinions, her ideas, and how SHE sees the world. He will tell you nice things about trips, movies and funny stories, but also very boring things about her aunt’s cat, how sweet it is, about why she gets very good along with her best friends, just because of their matching zodiac sign. But you pay attention! Every single detail is very important, Client, like every other girl, wants someone who understands her. If you can do it, she will trust you and enjoying being with you, and that is exactly what you want!

Now imagine that the first night worked out: you had a very nice conversation and arranged to drink a coffee next week. You had it started, every day that you spend together is really fine, and when you notice you are together. It doesn’t matter if nice guys try to date your girl, because she feels complete with you. You are the guy who understands her, you are the guy, and she is not going to change you for any new adventure.

With real clients, the ones we meet in our companies, it is not very different. The more you listen to him, the more you learn about him, the more you understand him. He is like a girl, he wants to feel understood. Once you understand what he is saying, what does he mean when he says (these are 2 different things!!!), he will trust you and respect your opinion and won’t want someone else to develop the software for him. He will want you because you know what he wants, you understand him.

Knowing him will also facilitate your job when making decisions, because you will know how he thinks and will be able to make better decision. Don’t forget: he is the client but you are the specialist. You can understand the client’s business, but he will never learn programming. Once you know what the client needs, you can mix both expertise (the IT knowledge and the client’s business logic knowledge) and give your work more value.

Being a developer does not mean “knowing how to create software”, but means “knowing how to create the right software”. So, pay attention to your client, treat him like the beautiful girl in the bar, and you have a big chance of success.

I hope you enjoyed this text as much as I enjoyed writing it. Please give me feedbacks if you have something to say. And thanks for reading it! :)

Code Race, Virtual Machine vs Native Execution

2010-03-28T10:45:00.001-07:00

For two reasons I wrote here much less than I expected, the first one is that I had a pretty stressing semester, the second, and more important, is that I want to have good texts and not many texts here, so I will only write when I have something to say.

For Easter I bought 2 books, Code Complete 2 and CLR via C# third edition. Since they are pretty different (the first is more general and high level than the second), I am reading them in parallel. Code Complete is extremely interesting, but I am at the beginning, so I (still) do not have too much to say about it, vie CLR via C# really get directly to the point, so I may have something to say.
I have always heard that code that uses virtual machines (like Java or C#) are slower than code that is directly compiled to native code (C++, for instance). Jeffrey Richter, the guy who wrote the CLR via C# book, may disagree, and he has some interesting points about it, but before I get to it, I would like to explain how the 2 phase compilation happens in the .NET Framework.

Once you write your code and click "Compile", the compiler will compile your code in IL code (Intermediate Language). This is a language that is used by the CLR to generate the native code at runtime. The generation of native code happens only once per execution, in the first time the method is called, then the native code is stored in memory and is used in all other method calls.
It is clear that in the first time a method is called, there will be a cost for runtime compiling. After that, it seems that the code generated by the CLR is the same as generated by a C++ compiler. But that is wrong. Because of the fact that the CLR compile happens on runtime, it has much more information about the hardware that the C++ compiler, it can make better tuning in the native code, taking advantage of this knowledge.

Some examples given in the book:

• The CLR Compiler (also called JIT – Just In Time – Compiler) can detect that the code is running on a specific CPU and use special instructions offered by this CPU.

• The compiler can detect that some tests are always true or always false and avoid doing it. For instance: if (numberOfCPUs > 1). It won’t change during execution, it doesn’t have to be tested, and if it is always false, the inner code of this if statement does not have to be compiled.

• The compiler can recompile the IL code into native code to correct some wrong branch predictions, depending on observed execution patterns. (The current version does not do that, but in the future they might).

I had never thought about it. For me, they seem very plausible and strong arguments to believe that code that uses VMs CAN have better performance than code compiled direct to native code, but it always depend on how well the VM is built, of course. The first argument is the most interesting, since a C++ compiler has to use the lowest-common-denominator CPU Instruction set, it cannot tune the native code, so knowing the CPU can bring a huge enhancement.

I am pretty convinced that it is true, that a VM execution can be at least as fast as a native code execution. Unfortunately testing that can be pretty hard, since many things can speed-up or slow-down an execution (for instance, how well the code is written).

And you, what had you ever thought about it?
Do you think it can be true or is it only marketing?

Ps: The .Net framework has a tool to generate native code in a separate file and to use it, to avoid compilation at runtime, called NGEN.exe. But it has its issues and you should use it only when you really need it. It will avoid the JIT compiler, but you will still need the CLR to execute your assembly.

Give away of data restore software

2010-01-24T03:49:00.000-08:00

I had a problem where I lost some data, for this reason I had to look for one of these softwares to restore it.
I found this give away of a payed software, I downloaded and it worked for me, I got all my data back! :)
For this reason I'm sharing it with you.

EASEUS Data Recovery Wizard
http://free-backup.info/data-recovery-software.htm

Will the Year of Linux ever happen?

2009-10-22T14:48:00.001-07:00

I don't know. If it does, it will take a long time to do so.
Let me present some information before we begin:
I am a Windows user and .NET programmer
I have already had my “adventures” in the Linux world, I've tried Suse, Ubuntu and Kubuntu (many versions), OpenSuse and maybe some other I do not remember.
My idea about Ubuntu 9.4, which I just installed: very good. I am really surprised about it.

I installed Ubuntu again 2 days ago, because I wanted to have some backup solution if my Windows failed. It started using it to configure it and I felt very comfortable with it, the only thing I miss is a mature environment to .NET development (I know about mono, but my past experiences with it weren't very good, I will wait some time to try it again. I wanted to try use Wine or Crossover to run Visual Studio, but they do not support it). If someone has any idea, I will be happy to try it.

To support my idea that the Linux year will take a long time to happen, I will try to show some scenarios to help you to understand it.

Users are stupid, but Linux doesn't know that.
Yes, they are. All a user knows is to click next, they can't even read what's written!
Linux usability improved a lot recently, Ubuntu is a very user friendly distribution, but it hasn't reached Windows level. I will give some examples:
“Synaptic Package Manager”, that is the name used in Linux to the feature named “Add/Remove Programs” in Windows. If my grandmother is using a computer, she will very easily understand what “Add/Remove programs” means, but what does a “Package Manager”?
Even if the user tries to use the package manager, he will have to download some things like that, in order to listen to mp3: gstreamer0.10-plugins-ugly; libxine-extracodes, etc. How will he discover it? (Remember, users do not google!)

The process “Question-Google-Answer-Do it” is pretty straightforward for people who work with computers and I, for instance, really enjoy using command line. But for non-experienced users, it is not like that, they just do not google and the command line scares them. Windows has a big advantage there: they have all kinds of wizards, making easier to the user to use them. They have a help system in a wizard form, it asks the user about what is going on, the user checks the checkboxes and some possible answer is given at the end. Yes, everybody knows that the answer will not help in 99% of the cases, but it makes the user feel better, more comfortable.

Linux is more secure.
Yes, indeed, there are much more viruses for windows than for Linux (if there is any). In my point of view, that only happens because Windows is running in more machines. Nobody wants to create a virus to target a SO that is running in only 7% of the computers all over the world, you want to catch the big fish.
The antivirus running in windows may give a sense of protection (event if it is not true). The user will feel safe using windows with an antivirus, they won't feel any need of changing their SO.

I feel comfortable with Windows, Linux scares me.
Yes, unfortunately.
Many users do not know Linux, but say that it is not good. They have a prejudgment about Linux and do not want to try, they have been using windows since it started, why change now?
Changing to something new requires that the user leaves the “comfort zone”, and that may be hard to many.

Distros, distros, distros.
Choosing a distro to install is the first problem of someone who wants to start using Linux. Imagine yourself entering a place to get a sword. You do not know anything about swords, and you have many options, all for free. You ask for help, but nobody can really help you, once “it depends on your needs”. Yes, they are right, it really depends on your needs, but nobody know your needs, neither do you. How to choose it?
That may disappoint the user: if choosing the distro to install is hard and frustrating, imagine how it is to use the system? He may give up trying without even starting.

Talking big!
Companies. Windows or Linux? That's even more complicated. (Let's talk about companies in general. Software companies may have others constraints)
For desktops you have a choice: you can install a Windows, and pay for it, but your employees will know how to use it (they have been using it for years) or you can install Linux, for free but the majority of your employees are going to need some time to get used to it.
I would choose Linux, specially if my company uses only one system, where the user won't see the desktop, but then we have some points:
The employees are all used to the office package, is open office an alternative? (This question I will let for you to answer: someone who learned Ms office for years will be able to start working with Open Office without problems?)
Old programs, they were not made to be used in Linux (probably they are not portable), they will have to be developed again. Is it worth?

For servers: for sure, if Linux is used, the company would have a third party support (like Red Hat) and that isn't for free. I don't know exactly the prices, but I imagine it is not very cheap, the price may match Microsoft or even be lower.
I think the server segment will be the first that Linux will beat Windows (if that happens). There the users are more experienced and have more knowledge. They are also not afraid of learning something new.

Conclusion
Linux really impressed me. Ubuntu 9.10 is coming next week and I will try it. But I think, in order to beat Windows, Linux will have to improve and get closer to the “next-next-finish” philosophy (which some Linux Users really hate). On the other hand, people will have to get used to Linux, and it will happen very slowly, but I think it is going to happen, since schools are using Linux in their info labs.

The only reason I would go back to windows would be the mature .NET Framework which doesn't exist until now in Linux, this is the why I have dual-bool ;). But this is just the beginning, I will have to use it more to be sure. I haven't tried to use Skype or play some MSN game with someone, let's see if it works.

Ps: thanks for visiting this blog. The first 3 days I got 15 visits and 1 follower, that's great! Thanks for the support. Please let me know if you have any ideas to make it better, and feel free to express your opinions on the comments.

Why Modeling should be done in a bar

2009-10-19T11:16:00.000-07:00

Modeling should be done in a bar. If I had a software company, I would have a big bar with free bier, so my analysts could work to create their models.

I think that modeling is one of the most abstracts and philosophical things in software development. It is not about coding, or data structures, compilers, metrics, numbers, it’s about the world and how you see it.

Between two different contexts, the same thing in the real world can be represented in different ways. In the same context, there is always more than one way to represent things, depending on how you understand the world, and none is better or worse.

I am having the opportunity to experience it here in Dresden. I lived in Brazil for 21 years, I graduated in informatics there, that means that I have the Brazilian culture and thinking in my background. Now I am in Germany, where I have colleagues from all over the world, I have a subject in the University where the Professor is German but lived for a long time in USA, working with ER modeling. When the whole class tries to model some scenario, we start a very big discussion. We have different background, different thinking and different way to see, comprehend and interpret the world, and these last things are the most important things when we model. What is a marriage? Is it an entity by itself? Is it a relation between a man and a woman? Is it a relation between a pair, independent of sex? Nobody knows, there isn’t an answer, and that if the beauty of it.

Last class the Professor brought a solution that he thinks was the best solution for the given scenario. My Professor in Brazil would have a heart attack if he saw it; it was everything that he told us not to do. After the class I went to talk to the Professor, I explained my feelings and my arguments against his approach, and he explained me what he thought when he developed that. I went out, thinking about that solution. I didn’t feel comfortable with that approach, I still do not and I think I will never do. I see the world in a different way as he does, and the solution just didn’t seem right to me, that is what motivated me to write this article.
Of course, you should be flexible to accept some things to help in the development/performance on you system. If you feel awkward with something, but it is going to improve the system somehow, it is completely fair to keep it as it is and get used to it. In the case above, there are some technical points that I think could be improved doing some other way.

The “ideal” development cycle should allow the analysts to begin from a very abstract model and, step-by-step, add more and more implementation details to it, and in this path that the technical improvements are important, and they also model how you are going to represent the data in your system.
There is a book about model driven development that I want to read. Probably I won’t in the next months, but if I do, I will write something about it, modeling is very interesting by the fact that is not a right or wrong, the analyst just draws what he sees, and how he understands it.

Making short: modeling is also a technical task, but it is much more philosophical and there is no better place to have a philosophical talk than a bar. This is the why I repeat: modeling should be done in a bar, with lots and lots of biers.

High Level Languages. Are they bad?

2009-10-19T07:42:00.001-07:00

„Many programmers have gone so far up the software stack, far from the actual hardware,
to such high levels that they have forgotten how computers work.

... so they make decisions that inevitably hamper systems performance“
Kode Vicious

Do I agree with this statement?
Yes.
Do I think it’s bad?
No.

Systems performance is indeed very important for computing, independent on what are you planning to do. Waiting for a response from the computer for too long is really annoying and the user will want to close the application, so performance is really important. But extreme fast computing sometime is not.
Google can execute your search, bringing a very large set of results in less than a second, and that’s awesome. But must it be always like that?
In project management, any decision has pros and cons. Going far in the software stack has its pros, like portability and productivity, but one of the cons is performance loss. There are many kinds of applications that do not need to be extremely fast. If the system used in the human resources department takes 1 second instead of 0.3 seconds to do a search in the employees database that contains 10000 rows, it will be ok, the user won’t even notice. And if it means lowering costs in the product development or developing faster, it means saving money, something that it good for the company.
Being a programmer that works far in the stack doesn’t mean that you are a bad programmer. If you do not learn about the computer architecture, you are going to learn about the architecture and the details of the framework you use to develop. The aim of high level programming languages is to decrease development time and costs removing the complexity of the development task. The developer does not need to think about low-level architectural details, he can focus on the application complexity. To achieve that, there are several layers that are responsible for taking care of it. Of course, once the developer can’t control it, they are not always optimal, and therefore there might be some performance problems. Being far from the hardware also might make the developer forget that there is a computer down there and every instruction takes time, so crappy algorithms are going to be slow, and these algorithms are much more common.
But sometimes being too high level might be bad. In some cases the developer is going to waste time to overcome abstractions to get the exact behavior he wants. If you have a very high level language, you might find some spots where it is just too high level for what you want, and that may be a problem once you are going to waste much more time to overcome this abstraction (because the language doesn’t expect you to do that) than building that spot yourself without any abstraction with another language.
The main point of this article is to make clear that there is no “universal truth” regarding software development. There is no good and bad, only best or worst fit to a scenario. Knowledge is like a toolbox, you need to have many tools and know when to use each of them, doing that is a very good start for a successful project.

I will have technical posts here, but also this kind of posts, where I just write my thoughts… You are welcome to comment it :).