Programming

Overheard: Google Chrome and the principle of least privilege

The most important reason for limiting the security privileges your code requires to run is to reduce the damage that can occur should your code be exploited by a malicious user. G Andrew Duthie, The Importance of the Principle of Least Privilege

Google Chrome uses the principle of least privilege. Each tab in Chrome is sandboxed (isolated) to prevent malware from installing itself or allowing what happens in one tab to affect what happens in another.

Overheard: Kent Beck, extreme programming and the quest for quality

I think it’s a combination of technical and social factors that leads to all the defects in deployed software. Part of it is the attitude that software is just inherently unreliable, and customers are conditioned to accept that. Developers are conditioned to accept that. Testers are conditioned to accept that. We just decided it was like the weather and there’s nothing we could do about it, which isn’t a very responsible position because in fact, there’s a lot that software developers can do about it. Kent Beck, as quoted in Extreme Programming inventor talks about agile development

Kent Beck gave a great interview that’s posted on the IBM developerWorks site, where he talks about the payroll project at Chrysler.  It’s a great read.

Now, the payroll program would handle Chrysler’s entire payroll, representing 1/10 of 1 percent of the entire US gross national product — at that scale, with union rules and all the places they operate, it’s a complicated program. They had a crying business need; it had to work. At the same time, this wasn’t rocket science — we just had to execute.

So, after a couple of weeks I interviewed everyone one-on-one. I told the first guy that we’ll divide the project into three-week intervals called, say, iterations. In each iteration we’ll implement a few new features called stories. We’ll write down all the stories we need, slot them into the iterations, then do it.

I told the next guy [I interviewed] that we have these three-week iterations divided into stories. For each story we’ll write these, um, acceptance tests to demonstrate that the stories meet the customer’s expectations.

With each person I interviewed I added a little more. By the end of the day, I’d interviewed 20 people and had laid out Extreme Programming’s basics.

My favorite quote from the article? “Sucks less isn’t progress.”

Overheard: The father of object-oriented programming

But just to show how stubbornly an idea can hang on, all through the seventies and eighties, there were many people who tried to get by with “Remote Procedure Call” instead of thinking about objects and messages. Dr. Alan Kay (he coined the name OOP)

Doesn’t this quote remind you of Grace Hopper? She said: The most dangerous phrase in the language is, “We’ve always done it this way.”

If you want to learn more about the guy who “invented” object-oriented programming, Wikipedia has a good entry — but I absolutely love this video where he shares his ideas about how we learn. I HIGHLY recommend it. Apple should have a poster for Alan Kay. He thinks different(ly). My favorite quote of Dr. Kay’s is “The best way to predict the future is to invent it.”

Overheard: Justin Gehtland and continuous integration

All development teams (read: more than one programmer) have to deal with integration builds. This is where you pull together all the bits and pieces that the different team members were working on, and check to see if you have a fully functioning product or a Frankenstein’s monster. Justin Gehtland, Continuous Integration with CruiseControl.NET and Draco.NET

Justin Gehtland is great teacher. (That’s my highest compliment!)

Overheard: Version control best practices

Many developers are sloppy about commenting their changes, and some may feel that commit messages are not needed. Either they consider the changes trivial, or they argue that you can just inspect the revision history to see what was changed. However, the revision history only shows what was actually changed, not what the programmer intended to do, or why the change was made. Anders Sandvig, Best Practices for Version Control

Overheard: Microsoft gets a “D” in SOA

Just what the world needs…yet another programming language. As soon as you say it’s aimed at non-developers, “real” developers will avoid it like the plague. And without “real” developer support, it’s dead in the water. Fred Fredrickson, responding to Mary Jo Foley’s blog post Microsoft declares its modeling love with a new language, ‘D’

Overheard: Keystroke dynamics in two-factor authentication

Nathan Harrington amended the GNOME Desktop Manager to include keystroke dynamics in the user verification process. When the user enters their username, the timings between key press events are measured and compared against a stored pattern. Jason Striegel, Add keystroke user verification to Gnome

I think Nathan Harrington has one of the coolest jobs of anyone I know. He’s always putting something new out for people to tinker with.

Overheard: File “Mars Programming Language” under “D”

“Great, just what I need. Another D in programming.” Segfault comment

How did Mars get shortened to “D” instead of “M”?

According to the Digital Mars FAQ page:  “The original name was the Mars Programming Language. But my friends kept calling it D, and I found myself starting to call it D. The idea of D being a successor to C goes back at least as far as 1988.”

Overheard: Visual Studio Express — Hello World

The reason we’re able to offer Express for free and even let developers build commercial applications with Express is because we limit 3rd party extensibility of Express, specifically by removing support macros, add-ins, and VSIP packages. Dan Fernandez, Visual Studio Express and TestDriven.NET

Microsoft wasn’t happy when developers began to extend what was freely given to them. Dan’s post above could have been called “We give you an inch and you take a mile.”

—–

On another totally unrelated Dan Fernandez note:

Wow! He’s blonde in this interview. I’m a big Dan Fernandez fan — but I had a hard time watching this video because I kept thinking “why did you bleach your hair?”

In spite of my hair distraction, I liked the interview. Dan is a great evangelist for Visual Studio Express. He’s able to capture and convey that feeling of accomplishment we all felt when we made those magical words “Hello World” appeared on the monitor. He’s not a snob. He appreciates the hobbyist, the hacker and the curious.

Ok…I can’t resist.

Q: What do you call a swimming pool full of blonde Visual Studio Express evangelists?
A: Frosted Flakes.

Overheard: I don’t want to ever have to wait for Java to load

Java doesn’t do anything by itself. It’s a programming language. Programming languages are like sewage plants: if the average user becomes aware of them, something’s gone wrong. Rupert Goodwins, Gallery: 10 most annoying programs on the Internet

Love it!  When I see that Orange Java box come up, I go get a cup of coffee.