Tools for software developers

Diomidis Spinellis is starting a new column in IEEE Software on "Tools of the Trade." It's well worth pondering.

"This new column aims to explore the interplay between software development and the tools we apply to the problem. Skilled craftsmen set themselves apart from amateurs by the tools they use and they way they employ them. As a professional, I feel I'm getting a tremendous boost in my productivity by appropriately applying tools to the software construction problems I face every day."

"So, how do the tools of our trade measure up? Pathetically, by many measures. Although the software industry is large and, dare I say it, mature, the software tool industry is still in its infancy."

"Economists track capital expenditures as a way to judge a country or sector's economic future. On the radar screen of these statistics, the cost of software development tools wouldn't amount to a single blip."

New NAS Report on Basic Research at DOD

DOD basic research has become less basic and has declined in both absolute dollars and as a percentage of the overall DOD science and technology budget.

The Computing Research Policy Blog gives an overview and summary of the report's recommendations that is well worth reading.

"The National Academies have released their long-awaited report, Assessment of Department of Defense Basic Research. This is the study that was requested by the Senate Armed Services Committee in the FY 2004 Defense Authorization Act after they raised questions about the state of DOD basic research ('6.1' research in defense parlance) as part of the hearings leading up to the bill."

New York Fights Against Identity Theft

WSJ.com: "The effort by a major metropolitan district attorney comes as law-enforcement and industry experts agree that specialized training is needed to combat a problem that affects about 10 million Americans annually. Critics, including many victims, say not enough cases are prosecuted and there is little deterrence or risk for those who steal identities.
Assistant District Attorney Antonia Merzon, co-chief of the new unit, says authorities have been hampered in the past by criminals who switch to new scams as soon as old ones have been detected. 'This type of crime is historically a cat-and-mouse game between criminals and law enforcement,' she says. 'There's a lot of ingenuity on the part of the criminal doing this, basically because the financial gain is so massive.'
In a 2003 survey, the Federal Trade Commission estimated that businesses had lost $48 billion and consumers $5 billion in the course of one year as a result of identity theft."

The figures for 2004, when compiled, are bound to be much higher. "Phishing" was barely on the radar at the end of 2003.

My wife's book

Cover

This is hard to find in stores, but available at Amazon or used book sellers.

EPIC Top Ten Privacy Resolutions for 2005

How to Protect Your Privacy in The New Year.

If you are one of the minority of Americans who still care enough about personal privacy to be willing to invest a little effort in protecting it, the Electronic Privacy Information Center has a list of ten New Year's Resolutions you might consider.

Or you could consider how much trouble it would be and tell yourself, in Scott McNealy's memorable words: "You already have zero privacy. Get over it."

Don Norman: Why adding more security measures may make systems less secure

The Risks Digest Volume 23: Issue 63
"Many attempts by both experts and amateurs in the world of security and safety actually weaken their systems."

"When attempting to increase security and safety of systems, it is essential that the psychology of the people be considered to be of equal or greater importance than the purely technical analysis. Note, the most obvious response of security and safety people is 'more training is necessary.' Yes, proper training is always useful, but don't count on it solving these problems. These issues happen despite training. They often are present in the best, most well motivated, most effective people in the organization. Indeed, professionals in the security and safety industry have succumbed to just these issues. ("I know my home computer isn't secure, but it was absolutely essential that I finish this report, ..."). The correct solution lies in ensuring that the security and safety measures take into account both the technical and the psychological factors."

Software Engineering for Secure Systems

SESS05: Building Trustworthy Applications
May 15-16, 2005
St. Louis, Missouri, USA
An ICSE 2005 workshop.

This workshop will provide a venue to discuss techniques that enable the building and validation of secure applications. We are especially interested in
(1) design and implementation approaches that make it easier to deal with security requirements, and
(2) program analysis techniques that enhance the trustworthiness of applications.

Areas of interest include, but are not limited to:
o Security requirements management
o Architecture and design of trustworthy systems
o Architecture and design of protection systems
o Separation of the security concern in complex systems
o Secure programming
o Black box components trustworthiness
o Security testing
o Trustworthiness verification and clearance
o Defining and supporting the process of building secure software
o Deployment of secure applications

** Submission of 7-page-max workshop papers 21 Feb 2005

[Excerpted from RISKS DIGEST 23.63]

Concerning PowerPoint

If you've never been required/tempted to use PowerPoint, and never been subjected to a PowerPoint presentation, you can just skip this post.

Edward R. Tufte's polemic, The Cognitive Style of PowerPoint, argues fairly convincingly that the style encouraged by PowerPoint reduces the information transmitted by presentations.

Tufte, of course, is the demi-god of information presentation, a Yale Emeritus Professor, known for such classics as The Visual Display of Quantitative Information, Envisioning Information, and Visual Explanations: Images and Quantities, Evidence and Narrative. Or, as the New York Times put it, "The Leonardo da Vinci of data."

Cognitive Style is a brief pamphlet, just 27 pages, but there are at least 10 pages worth of material that I'm tempted to quote here. However, since I think you really ought to read the whole thing, I'll just throw out a few morsels:

"Slideware often reduces the analytical quality of presentations. In particular, the popular PowerPoint templates (ready-made designs) usually weaken verbal and spatial reasoning, and almost always corrupt statistical analysis. What is the problem with PowerPoint? And how can we improve our presentations?"

"PP convenience for the speaker can be costly to both content and audience."

"'The Board views the endemic use of PowerPoint briefing slides instead of technical papers as an illustration of the problematic methods of technical communication at NASA.'--Columbia Accident Investigation Board, Report."

"The Harvard Business Review study of corporate planning found that the widely used bullet outlines did not bring intellectual discipline to planning--instead the bullets accommodated the generic, superficial, and simplistic. PowerPoint will not do for serious presentations. Serious problems require serious tools."

"The PP cognitive style is propagated by the templates, textbooks, style-sheets, and complete pitches available for purchase. Some corporations and government agencies require employees to use designated PPhluff and presentation logo-wear. With their strict generic formats, these designer stylesheets serve only to enforce the limitations of PowerPoint, compromising the presenter, the content, and, ultimately, the audience."

"Imagine a widely used and expensive prescription drug that claimed to make us beautiful but didn't. Instead the drug had frequent, serious side effects: making us stupid, degrading the quality and credibility of our communication, turning us into bores, wasting our colleagues' time. These side effects, and the resulting unsatisfactory cost/benefit ratio, would rightly lead to a worldwide product recall."

"Presentations largely stand or fall depending on the quality, relevance, and integrity of the content. The way to make big improvements in a presentation is to get better content. Designer formats will not salvage weak content. If your numbers are boring, then you've got the wrong numbers. If your words or images are not on point, making them dance in color won't make them relevant. Audience boredom is usually a content failure, not a decoration failure."

"The practical conclusions are clear. PowerPoint is a competent slide manager and projector for low-resolution materials. And that's about it. PP has some occasionally useful low-end design tools and way too many PPhluff tools. No matter how beautiful your PP ready-made template is, it would be better if there were less of it. Never use PP templates for arraying words or numbers. Avoid elaborate hierarchies of bullet lists. Never read aloud from slides. Never use PP templates to format paper reports or web screens. Use PP as a projector for showing low-resolution color images, graphics, and videos that cannot be reproduced as printed handouts at a presentation."

Of course, I've just quoted some of the striking bits, not the extensive analysis, visual examples, and careful reasoning supporting them.

The six-slide Gettysburg PowerPoint Presentation on pages 14-15 is not to be missed. It's also available at norvig.com, together with information on how (and why) it was made and how it has been received.

Warning: Reading Cognitive Style is likely to increase your temptation to run screaming from the room when faced with corporate and military PowerPoint presentations. But if it helps you to prepare presentations that don't tempt your audiences to run screaming from the room, the sacrifice will be worth it.

Google Desktop Security flaw

Dan Wallach's group at Rice University has found another security flaw.

"We found that the Google Desktop personal search engine contained a serious security flaw that would allow a third party to read the search result summaries that are embedded in normal Google web searches by the local search engine.

"An attacker would not be able to read your files directly, but the search results often contain snippets of your files. If you had a file with a list of web passwords, for example, an attacker might be able to read some of those passwords."

This appears to be yet another example of "emergent" security vulnerabilities, which arise when components are combined or used in ways not anticipated by their designers.

Grand Research Challenges in Computing

This is not a brand-new topic, but because of the time scale, still quite relevant.

What are the grand research challenges in computing? The Computing Research Association has sponsored two Grand Challenges workshops. The first was Grand Research Challenges in Computer Science and Engineering in 2002. I submitted a position paper, and the workshop produced a summary report. The second was Grand Research Challenges in Information Security & Assurance in 2003. I submitted another position paper, and workshop results are summarized in briefing slides. A third workshop is planned for 2005.

The United Kingdom has a related Grand Challenges project, described here. Its working party produced these criteria for Grand Challenges. Their 2004 workshop is described here.

Call to action: Innovate or abdicate

A new 68-page report by the Council on Competitiveness makes a large number of thoughtful recommendations on keeping the country competitive.

"Innovation will be the single most important factor in determining America's success through the 21st Century."

"Today, America finds itself at a unique and delicate historical juncture, shaped by two unprecedented shifts – one in the nature of global competition, the other in the nature of innovation itself:
1. The world is becoming dramatically more interconnected and competitive...
2. Where, how and why innovation occurs are in flux – across geography and industries, in speed and scope of impact, and even in terms of who is innovating... To thrive in this new world, it will not be enough – indeed, it will be counterproductive – simply to intensify current stimuli, policies, management strategies and to make incremental improvements to organizational structures and curricula."

The report recommends action in several areas: education strategy, catalyzing a new generation of innovators, empowering workers to succeed in the global economy, revitalizing frontier and multidisciplinary research, energizing the entrepreneurial environment, reinforcing risk-taking and long-term investment, creating a national consensus for innovation growth strategies, creating a 21st century intellectual property regime, strengthening America's manufacturing capacity, and building 21st century innovation infrastructures (particularly a health care test bed).

A significant increase in support for basic research is one of the primary recommendations.

The list of authors reads like a Who's Who of American technology, including the chairmen and/or CEOs of 10 major corporations (IBM, General Motors, Verizon, AMD, ...) and the presidents of 8 major universities (Stanford, MIT, Columbia, Michigan, ...).

Another missile defence shield test fails

According to BBC NEWS, "The first test in almost two years of the planned multi-billion dollar US anti-missile shield has failed. The Pentagon said an interceptor missile did not take off and was automatically shut down on its launch pad in the central Pacific...The Missile Defence Agency said an 'unknown anomaly' was to blame for the system shutting down... Wednesday's trial had been put off four times because of bad weather at launch sites and, on Sunday, because a radio transmitter failed. A Pentagon spokesman told Reuters news agency the test had not been tied to the question of when the national missile defence system would be declared operational."

Golly, I sure hope that terrorists and rogue nations have the consideration to only launch ballistic missiles at us when our weather is good, our radios are working, and we're not suffering any unknown anomalies.

FDIC seeks an end to account-hijacking identity theft

An FDIC study provides suggestions to financial institutions for reducing the prevalence and effectiveness of "phishing."

"Fraudsters are taking advantage of the reliance on single-factor authentication for remote access to online banking, and the lack of e-mail and Web site authentication, to perpetrate account hijacking. Financial institutions and government should consider a number of steps to reduce online fraud, including:
1. Upgrading existing password-based single-factor customer authentication systems to two-factor authentication.
2. Using scanning software to proactively identify and defend against phishing attacks. The further development and use of fraud detection software to identify account hijacking, similar to existing software that detects credit card fraud, could also help to reduce account hijacking.
3. Strengthening educational programs to help consumers avoid online scams, such as phishing, that can lead to account hijacking and other forms of identity theft and take appropriate action to limit their liability.
4. Placing a continuing emphasis on information sharing among the financial services industry, government, and technology providers."

Ex-CIA Directors warn of cyberterrorism

A press release from mi2g highlights public statements by George Tenet and Robert Gates in the last ten days.

"Cyber terrorism could be the most devastating weapon of mass destruction yet and could cripple the US economy according to the former CIA Director, Robert Gates who was speaking at the cyber terrorism conference held at Rice University... The CIA and National Security Agency (NSA) had conducted an exercise six years ago, assigning 50 computer specialists to see how hard it would be to shut down the nation's electric grid. It took only two days for the group to put itself in a position to do so, Mr Gates said."

"'The internet,' Tenet claimed at a recent security conference in Washington DC, 'represents a potential Achilles heel for our financial stability and physical security if the networks we are creating are not protected.' 'The thinking enemy that we confront is going to school on our network vulnerabilities.' He said that there were 'known adversaries conducting research on information attacks,' including 'intelligence services, military organisations and non-state actors.'"

Could An Appropriations Reorganization Help U.S. Science?

The Computing Research Policy Blog has a thought-provoking article by Peter Harsha.

"As the FY 05 appropriations process demonstrated, the current organization of congressional appropriations subcommittees (and thus, appropriations bills) is a mess that puts science agencies at a disadvantage in the competition for federal dollars. The current structure is a mish-mash of jurisdictions that forces agencies that have little or nothing to do with each other to compete for the limited funds within each bill -- one bill pits the National Science Foundation and NASA against the Veteran's Administration and federal housing programs, for example, and in another, it's NIST and NOAA against the State Department. More often than not, in that competition the science agencies get the short end of the stick. But there's an interesting proposal floating around DC to recast the appropriations panels to make their jurisdictions more sensible. "

Ex-CIA Chief Gates Warns on Cyberterror

Yahoo! News: "Cyberterrorism could be the most devastating weapon of mass destruction yet and could cripple the U.S. economy, former CIA Director Robert Gates said at a terrorism conference Saturday.

"Gates, who became Texas A&M University's president in 2002 about a decade after he left the CIA, cited as an example the 'love bug' virus that overwhelmed computer systems around the world in 2000. 'When a teenage hacker in the Philippines overnight can wreak $10 billion in damage to the U.S. economy by implanting a virus, imagine what a sophisticated, well-funded effort to attack the computer base of our economy could accomplish,' said Gates."

The Most Powerful Man in Congress?

Computing Research Policy Blog: "The Washington Post has an interesting article about House Majority Leader Tom Delay's (R-TX) successful efforts to singlehandedly secure a large increase for the President's Moon/Mars Space Initiative in the FY 2005 Omnibus Appropriations bill. In a bill that included some significant cuts to science, most notably a cut of $105 million to the National Science Foundation, Delay, who counts among his constituents a large number of NASA's Johnson Space Center employees, was able to use his clout to ensure NASA got the extra $800 million the President requested.

"As the increase arguably came at the expense of NSF, let's hope the House and Senate hold at least one hearing in the 109th Congress on whether the benefit of this significant re-prioritization exceeds the costs to the Nation incurred by cutting fundamental research support."

The Undressed Art:A Passion for Meaningful Lines

The New York Times Book Review has just listed a book by my next-door neighbor, Peter Steinhart, as one of its "100 Notable Books of the Year."

The Undressed Art: A Passion for Meaningful Lines: "Peter Steinhart reminds us there is something 'innate and human' about the impulse to draw what we see. Steinhart wants us to know that a renaissance of drawing has arrived, not only here but around the world."

Former cybersecurity czar: Code-checking tools needed

Computerworld story

"Software vendors need automated tools that look for bugs in their code, but it may be a decade before many of those tools are mature and widely used, said the former director of cybersecurity for the U.S. Department of Homeland Security.

Creating software assurance tools was one long-term focus of the DHS National Cybersecurity Division during Amit Yoran's tenure there, Yoran said today during the E-Gov Institute Homeland Security and Information Assurance Conferences in Washington.

About 95% of software bugs come from 19 'common, well-understood' programming mistakes, Yoran said, and his division pushed for automation tools that comb software code for those mistakes. "

Is integrity in voting as important as in gambling?

Las Vegas City Life explains the rationale for the recounts requested by the Green and Libertarian parties.

"Sabatini further argues that electronic voting machines must be held to the same standards as electronic gambling machines. Gambling regulators have full access to the software in slot machines, and are empowered to open up any machine on the spot and check the software and hardware. Nevada regulators test the gaming machines to their own rigid standards, and have broad power to investigate customer complaints."

Congressional Rush Tramples NSF

It's well known that end-of-session omnibus bills tend to fill with "pork." But sometimes their collateral damage is more serious, as detailed in this New York Times editorial [free registration required to access].

"The science foundation may have helped to pay for research on Web browsers and search engines, among countless innovations, but it doesn't seem to be holding its own against Punxsutawney Phil."

Looming

Ever have a nightmare about a big airplane and a freeway?

Lost e-votes in N.C. county prompt new local election

A story in Computerworld describes one place where the bullet wasn't dodged.

Voting: DRE and Voter Verified Audit Trails

Many people have written eloquently and passionately on this topic, e.g., VerifiedVoting.org and EVoting-Experts.com. Yet I still often read that we dodged the bullet this year, and DRE systems worked without problems. All I can say is that DRE systems generally did not make it possible to determine whether there were any problems. For examples of election anomalies that were detected, see this list.

Not me, Mulla Nasrudin

Searching the Web, I find the following quote widely attributed to me:

Good judgment comes from experience.

Experience comes from bad judgment.

It's a quote that I really like, but it's far from original with me. The earliest credible source I can find is from at least 600 years ago--the great Sufi sage/fool Mulla Nasrudin.

So I'm new to blogging

I've gotten so much of value by reading other blogs, it seemed time to try it.

About me: I've been hooked on computers and computing for 45 years, and currently work as Chief Scientist of McAfee Research. More about me at my home page.