Archive

Archive for December, 2009

Poor Design Decisions

December 19th, 2009
Comments Off

The recent news of the Predator UAV getting “hacked” highlights the importance of making the right decisions at design time. The article says “some” of the drones have this vulnerability; which leads me to believe that the ones affected are probably the first generation. I have to give General Atomics the benefit of the doubt that all of the Predator drones do not have this vulnerability. Even still, the thought of putting an aircraft into production without encrypting the video data link is just poor judgment.

As a result, people are wanting the cybersecurity czar position to be filled. There’s a really good reason why that position has not been filled…it’s a do-nothing position. How could a position with no budget and no statutory power have influenced a situation like this? Realistically the person would just be a fall guy waiting on the day for a huge breach that he had no ability to prevent. Again, another poor design decision.

Eric Politics

Feel Bad About Writing Bad Code?

December 3rd, 2009
Comments Off

If so, you can be absolved of your sins by buying bad code offsets! I’m not sure whether I should laugh at such a stupid idea or be envious because I didn’t think of it first. This is a phenomenal example of a stupid tax.

Here’s the group’s vision:

We envision a world where software runs cleanly and correctly as it simplifies, enhances and enriches our day to day work and home lives. Mitigating the scope and negative impact of bad code on our jobs, our lives and our world is our all–consuming passion. We foresee a time when bad coding practices and their rotten fruits have been eliminated from this earth and its server farms thereby heralding a new age of software brilliance and efficacy.

Nettlesome bugs and poorly written code have been constant impediments towards realizing our full potential as programmers and engineers. Bad Code Offsets provides the vehicle for balancing the scales of poor past practice while freeing us to pursue current excellence in code development. Until the dawn of the worldwide, bug free code base, each of us can take steps towards reducing our bad code footprint and remediate the bad code that we have each individually and collectively left behind on the desktops, servers and mainframes at school, at work and at home.

As much as I would like to think that we are progressing towards a time where software will ship bug free, reality says that it’s impossible. The best programmers in the world occasionally right bad code. We’ve all done it at some time in our lives. I recently opened some PHP code I wrote 5 years ago and was appalled.

I once worked with a group that was CMM-I level 5 certified. This group worked at least 2 years on a single project. Management dropped the project when they found out the group had written zero lines of code. They had a magnificent requirements document though! Moral of the story: bad code is a reality of life, get used to it.

To top the joke off, the group behind these offsets are donating the money to open source foundations who are  “carrying the fight against bad code on a daily basis.” The key word there is fight, and it’s not just the FOSS groups that are fighting it…we all are. If these groups write such good code, why do we hear about buffer overflow vulnerabilities in Apache HTTP Server or cross-site scripting in Drupal (both on the donor list)? Yeah they fix them when they are notified, but so do most other developers.

If developers feel so bad, let’s donate to something that will actually benefit someone other than the people running the scam. For every $400 that’s donated, I’ll sponsor a poor child’s food, clothes, toys, and education for a year. Clothing a kid for a year sounds much more appealing to me than pouring money into FreeBSD. In return, I’ll email you a certificate saying your coding sins are absolved and the world’s now a better place.

poor-child


Eric Funny, Software