Reviews and Comments

Good. This is a story about "demons" and "possession" but more in the voodoo sense of the word -- only not quite, because American archetypes like Captain America possess people instead. And the book starts off with someone being possessed in Airport Security.

It's well written. Daryl Gregory has much in common with Matt Ruff in his overall balancing of viewpoint, action and misdirection. More than that, the book is well edited -- it doesn't waste time inflating the plot, and instead goes right for the essence of the book. Everyone is always doing what is most important to them, and no-one's doing anything that's against their nature (although to be fair, some of them are doing some pretty stupid things sometimes).

It is clearly written by someone who loves science fiction (Philip K. Dick shows up as a character!) and as such, people who don't read SF probably won't get a number of references. That being said, it's good, not too long, and you should read it.

This isn't a bad book, but it's somewhat out of date, and suffers from the same problem that a number of security books have -- they go to great lengths to talk about attack, and very little time talking about effective defenses.

The usual suspects show up here: HTML, Javascript (and VBScript!), CSS, PHP, SQL Injection, Web Application Firewalls and the client side filters, and finally, a single chapter on Mitigation.

The mitigation chapter is great: it takes a serious and thoughtful look at what can be done to realistically limit possibly invalid input, and concludes that it's Hard. I wish that they had structured the entire book around defensive programming and gone more into safer markup languages like Markdown, but it's enough for three stars.

However, I wouldn't recommend this book to a programmer. It's a good eyeopener for people writing Javascript and HTML who have never seen attacks, but I think if you were at all concerned about attacks, you wouldn't be using PHP or opening yourself to SQL injection attacks by handwriting your SQL in the first place.

Sadly, the book immediately starts off by saying "Why" is not as interesting as "How" and goes on to make fun of theologists for never agreeing on the definition of "nothing" -- which is certainly true as far as it goes, but still doesn't address the actual teleological problem.

What he does do effectively is discuss the various physical phenomena underlying "nothing" -- virtual particles, quantum foam lattices and the Higgs field. He goes write back to the Big Bang and points out the quantum fluctuations at the point of Big Bang expansion could have "created" energy in the sense that the total energy is zero, but getting to the resting zero state is effectively impossible.

I felt a bit cheated after reading Brian Greene and Three Roads to Quantum Gravity, but he does get to the essential point that the Big Bang may have happened because "quantum nothingness" is unstable, but it still doesn't get to the question of why or how "nothing" can be "unstable" at all. Oh well.