Live data from Hacker News

Recommended Security Reading

dfir.org

21–30 of 51 posts

Re: Recommended Security Reading

#21
post #20
post #17

Earlier quoted context omitted.

I agree that _Design Patterns_ has little to do with security, but I think you are being a bit hard on it from a programming perspective. Certainly the book is tremendously useful for ObjC programmers because Apple incorporated most of these patterns into Cocoa and Cocoa Touch. And as someone who has done code review with junior Android developers, I wish that more devs read it. When a security researcher refers to a…

(To save you some explaining time:) I'm excruciatingly familiar with the GoF patterns and much of the broader pattern movement (I'm a recovering C++ programmer). So: Of the original GoF patterns, which specific ones make it easier to discuss SQL injection?

"Of the original GoF patterns, which specific ones make it easier to discuss SQL injection?"

That doesn't seem to be the claim made in the parent comment. I read it as a far weaker, "In much the same way that security researchers label antipatterns that enable attacks and that makes it easier to talk about security, the GOF label patterns that make it easier to talk about design."

I don't know that the parent comment makes a good case for relevance of this claim, though, since - as you've been more focused on - this list is supposed to be more specifically for (FTA) "topics within computer security, digital forensics, incident response, malware analysis, and reverse engineering." I suppose if the system you're reverse engineering made substantial use of GoF design patterns, familiarity with them would probably help, but that seems a little bit of a stretch.

Re: Recommended Security Reading

#22
post #17
post #16

Earlier quoted context omitted.

_Design Patterns_ is one of those books that nerds of a certain vintage all have on their bookshelves. The lucky ones --- most of them! --- haven't read it carefully. It's a book about software architecture, and, more specifically, about turning C++ into Smalltalk. It has absolutely no relevance to software security, even in terms of background material about computer science. (It's actually of dubious relevance to p…

I agree that _Design Patterns_ has little to do with security, but I think you are being a bit hard on it from a programming perspective. Certainly the book is tremendously useful for ObjC programmers because Apple incorporated most of these patterns into Cocoa and Cocoa Touch. And as someone who has done code review with junior Android developers, I wish that more devs read it. When a security researcher refers to a…

Apple incorporated most of these patterns into Cocoa and Cocoa Touch.

Great! That means I could just learn to work with Cocoa and Cocoa Touch and skip the tedious exposition.

I would try to explain why I've never been able to pick up a patterns book without eventually throwing it against a wall, and why I prefer to encounter my patterns in the wild as I work on actual code, where I can poke and prod them and watch how they behave in practice, but it's already been throughly explained and even given a name, The Monad Tutorial Fallacy:

http://byorgey.wordpress.com/2009/01/12/abstraction-intuitio...

Sounds to me like your junior Android developers might be learning patterns just fine: They trip over one in practice, and then they learn about it with the help of their teacher. This is how learning works. There is no royal road to geometry, and beginners don't become experts overnight just by reading the right book.

Re: Recommended Security Reading

#24
post #17

Earlier quoted context omitted.

I agree that _Design Patterns_ has little to do with security, but I think you are being a bit hard on it from a programming perspective. Certainly the book is tremendously useful for ObjC programmers because Apple incorporated most of these patterns into Cocoa and Cocoa Touch. And as someone who has done code review with junior Android developers, I wish that more devs read it. When a security researcher refers to a…

Apple incorporated most of these patterns into Cocoa and Cocoa Touch. Great! That means I could just learn to work with Cocoa and Cocoa Touch and skip the tedious exposition. I would try to explain why I've never been able to pick up a patterns book without eventually throwing it against a wall, and why I prefer to encounter my patterns in the wild as I work on actual code, where I can poke and prod them and watch ho…

A better way to learn the GoF patterns is through Norvig's presentation on why they aren't necessary in better programming languages.

Google for [Norvig patterns] or [Norvig GoF].

Re: Recommended Security Reading

#25
post #14

Avoid _Applied Cryptography_. You probably won't get too much value from _Introduction to Modern Cryptography_, either. The only cryptography book I can recommend is _Cryptography Engineering_ (nee _Practical Cryptography_, which is virtually identical). You would be surprised how few professional security people know anything about cryptography. It certainly isn't a qualifier. I generally have a hard time with any b…

Hey Tom,

I have now heard from several people about applied crypto being outdated and replaced with crypto engineering. I have since ordered the engineering book and based on initial reading will likely replace applied with crypto engineering once I am done (I only post books I have fully read).

I am not sure about the criticism of intro to modern crypto and design patterns though. I learned alot from both of them in my computer science classses that used them and the information is still vaulable and useful to me.

Re: Recommended Security Reading

#26
post #10

Modern Operating Systems - The classic dinosaur book from Tanenbaum. Wrong. The dinosaur book is written by Silberschatz, Galvin and Gagne and is called "Operating System Concepts"

FWIW, Modern Operating Systems is the classic book by Tanenbaum. You are correct, however, that my edition has a circus on the cover, not a dinosaur.

Seems like the author did not put too much care into this list.

Re: Recommended Security Reading

#27
post #10

Modern Operating Systems - The classic dinosaur book from Tanenbaum. Wrong. The dinosaur book is written by Silberschatz, Galvin and Gagne and is called "Operating System Concepts"

Thanks for catching this. I will fix it when I get back from this conference.

Re: Recommended Security Reading

#28
post #2

A quick review showed a lack of : Reflections on Trusting Trust Ken Thompson ( http://cm.bell-labs.com/who/ken/trust.html ) Any list without it, is a list without it.

I only posted books to the list in order to keep it managable. If I tried posting blogs, journal articles, etc. then the list would go on forever and be impossible to ever finish.

Re: Recommended Security Reading

#29
post #10

Modern Operating Systems - The classic dinosaur book from Tanenbaum. Wrong. The dinosaur book is written by Silberschatz, Galvin and Gagne and is called "Operating System Concepts"

FWIW, Modern Operating Systems is the classic book by Tanenbaum. You are correct, however, that my edition has a circus on the cover, not a dinosaur. Seems like the author did not put too much care into this list.

One typo in a huge list shows "not too much care"?

Re: Recommended Security Reading

#30
post #20

Earlier quoted context omitted.

(To save you some explaining time:) I'm excruciatingly familiar with the GoF patterns and much of the broader pattern movement (I'm a recovering C++ programmer). So: Of the original GoF patterns, which specific ones make it easier to discuss SQL injection?

"Of the original GoF patterns, which specific ones make it easier to discuss SQL injection?" That doesn't seem to be the claim made in the parent comment. I read it as a far weaker, "In much the same way that security researchers label antipatterns that enable attacks and that makes it easier to talk about security, the GOF label patterns that make it easier to talk about design." I don't know that the parent comment…

From an security professional's point of view, the idea is to find flaws in software, developers thinking, or corporate culture that make vulnerabilities for attack.

GoF doesn't really help with any of the above. What GoF helps with is shoring up weak languages that don't have the proper stuff to begin with. It talks about abstractions and how to build them.

What is useful from a security professional's point of view is to learn how to puncture abstractions. Finding flaws such as information leakage between abstractions. This is a hard mind-set to come to.

GoF will not help you with any of this.

Post reply on HN