Now if only this linked to EPUBs instead of Wiley/Amazon/etc, that'd be really convenient :)
Recommended Security Reading
41–50 of 51 posts
Re: Recommended Security Reading
#42Let's say I'm interested in building an app that uses encryption: an end-to-end email client and/ or server, a tarsnap competitor, or I just want to build a privacy conscious app (end-to-end encryption of user data, basically). How should I get started, would there be a reading list on cryptography besides the security reading list?
(And yes, I know the best way is to get a PhD building the thing, but I'm interested in learning nonetheless )
Re: Recommended Security Reading
#43Earlier quoted context omitted.
(To save you some explaining time:) I'm excruciatingly familiar with the GoF patterns and much of the broader pattern movement (I'm a recovering C++ programmer). So: Of the original GoF patterns, which specific ones make it easier to discuss SQL injection?
"Of the original GoF patterns, which specific ones make it easier to discuss SQL injection?" That doesn't seem to be the claim made in the parent comment. I read it as a far weaker, "In much the same way that security researchers label antipatterns that enable attacks and that makes it easier to talk about security, the GOF label patterns that make it easier to talk about design." I don't know that the parent comment…
> I don't know that the parent comment makes a good case for relevance of this claim, though, since
The parent comment is responding to @tptacek's original comment:
> (It's actually of dubious relevance to programmers in general).
Where 'it' is the Design Patterns book. That's a more broad statement than just whether or not security researchers needs to read the book. The parent to your post replied to that:
> I agree that _Design Patterns_ has little to do with security, but I think you are being a bit hard on it from a programming perspective.
So, in summary:
tptacek: Design Patterns has no relevance to security. It also
has dubious relevance to all other programming.
skue: It doesn't have relevance to security, but I feel that it
does have relevance to programming in general.Re: Recommended Security Reading
#44Avoid _Applied Cryptography_. You probably won't get too much value from _Introduction to Modern Cryptography_, either. The only cryptography book I can recommend is _Cryptography Engineering_ (nee _Practical Cryptography_, which is virtually identical). You would be surprised how few professional security people know anything about cryptography. It certainly isn't a qualifier. I generally have a hard time with any b…
Although I haven't found GoF book useful when looking to solve a problem at work, it has come super handy when preparing for technical interviews. I must admit that over the last 10 years I haven't managed to answer any of the Design Patterns questions satisfactorily. Never mind that the roles required Perl/Python scripting skills in the job post.
Re: Recommended Security Reading
#45Really a better list is by tom his own self: http://www.amazon.com/lm/R2EN4JTQOCHNBA/ref=cm_lm_pthnk_view... My recommendations would add: http://www.amazon.com/The-Codebreakers-Comprehensive-Communi... by David Kahn. Many stories of the whole history of secret communications, with lessons in op-sec, not changing the codes frequently enough, they can't possibly break this. The John LaCarre http://en.wikipedia.org/wik…
The first book on that list "Grey Hat Python" isn't very good. It contains some good parts but it skips things like Scapy which a consider a superb tool if you are in the pentesting business. I recommend reading "Violent Python" instead. It's everything that Grey Hat should have been...
Re: Recommended Security Reading
#46Re: Recommended Security Reading
#47Earlier quoted context omitted.
"Of the original GoF patterns, which specific ones make it easier to discuss SQL injection?" That doesn't seem to be the claim made in the parent comment. I read it as a far weaker, "In much the same way that security researchers label antipatterns that enable attacks and that makes it easier to talk about security, the GOF label patterns that make it easier to talk about design." I don't know that the parent comment…
> I don't know that the parent comment makes a good case for relevance of this claim, though, since The parent comment is responding to @tptacek's original comment: > (It's actually of dubious relevance to programmers in general). Where 'it' is the Design Patterns book. That's a more broad statement than just whether or not security researchers needs to read the book. The parent to your post replied to that: > I agre…
Fair point - skue was not trying to make (and actually specifically disclaimed) any claim as to relevance.
Re: Recommended Security Reading
#48Really a better list is by tom his own self: http://www.amazon.com/lm/R2EN4JTQOCHNBA/ref=cm_lm_pthnk_view... My recommendations would add: http://www.amazon.com/The-Codebreakers-Comprehensive-Communi... by David Kahn. Many stories of the whole history of secret communications, with lessons in op-sec, not changing the codes frequently enough, they can't possibly break this. The John LaCarre http://en.wikipedia.org/wik…
I got Codebreakers over 15 years ago, and I still haven't finished it. That thing is incredibly dense. I don't know if this is a recommendation, an anti-recommendation, or an excuse.
I totally agree with you, this actually has happened to me, not once, but twice. It took me 7 years to get it off! I think there are a few recommendations for it.
Re: Recommended Security Reading
#49Earlier quoted context omitted.
From an security professional's point of view, the idea is to find flaws in software, developers thinking, or corporate culture that make vulnerabilities for attack. GoF doesn't really help with any of the above. What GoF helps with is shoring up weak languages that don't have the proper stuff to begin with. It talks about abstractions and how to build them. What is useful from a security professional's point of view…
Did you just want to voice your opinion and find my comment relevant enough to serve as a place to hang it, or did you mean that as a response to what I wrote? I don't think I substantively disagree, although I think Norvig's claim is often read (not sure if intended) slightly stronger than is merited. I would also note that the list does not seem to be restricted to "security professionals", but to all those interes…
I was chiming in on support of I suppose if the system you're reverse engineering made substantial use of GoF design patterns, familiarity with them would probably help, but that seems a little bit of a stretch and to clarify my opinion about the 'tptacek comment pointing out a common vulnerability (sql injection) and how GoF doesn't really addresss it.
And we could discuss I think Norvig's claim is often read (not sure if intended) slightly stronger than is merited quite a bit. I might go the other way, as I think Norvig is really quite gentle in making his points.
So not disagreeing with your comment, and perhaps I did hang my comment on the wrong post.
Re: Recommended Security Reading
#50Really a better list is by tom his own self: http://www.amazon.com/lm/R2EN4JTQOCHNBA/ref=cm_lm_pthnk_view... My recommendations would add: http://www.amazon.com/The-Codebreakers-Comprehensive-Communi... by David Kahn. Many stories of the whole history of secret communications, with lessons in op-sec, not changing the codes frequently enough, they can't possibly break this. The John LaCarre http://en.wikipedia.org/wik…
I can second the recommendation for The Cuckoo's Egg. I picked it up somehow in 1994 or so and was immediately impressed.
I hear there's an alternate title it's being published under now though, so look for the author, Cliff Stoll.