User Profile

Honestly, it reminds me of an Ayn Rand book.

For every time I'm impressed how calm, kind and reasonable the protagonist is, there's another time how I'm shocked at how vindictive and petty the book (if not the protagonist directly) is to the people that seem to be standing in the way of the protagonist. Right now, it's security professionals, but a couple of chapters ago it was project managers, then developers, and then the CEO. No-one in those departments has any sympathy for the protagonist, nor is there a screw up (so far) that was clearly internal to the Ops team -- they are just apparently perfect at their job. And don't get me started on the complaints about how dingy the offices are next to HR (when part of HR's job is trying to make people feel comfortable, and those offices are part of the job description).

Oh, and Erik, the DevOps zen-master Mary Sue. He's just not credible as a character. Sure, he may exist, but he just doesn't know the protagonist well enough to be able to say the things he says. I'm secretly hoping he's Tyler Durden.

Finished it.

I am very, very surprised at how "Continuous Delivery" is jammed into the back.

I am very surprised by the comments that Bill (the protagonist) has about the developers.

I am downright astonished that the development team of a large corporation is capable of setting up a repeatable testable environment based on VM within weeks, can move to a cloud based solution like Amazon AWS, and put together a push-button packaged deployable solution to production and some how the operations guy gets the credit for that.

I've worked as an e-commerce consultant for more than a decade, and even at places like Twitter it takes months of effort to do that. And it's completely brushed aside as something the developers can just "do" as soon as it's mentioned to them.

It should have taken a solid year. It should have bottlenecked their critical resource, Brent, for a year. The same can be said of the job they did going through Kanban and the change process -- it would have taken a consultant months of getting everyone on-board and then even longer to get people not to fall into old habits, but somehow Bill comes back after a weekend and his team has already sorted everything. It's dishonest, and it presents a distorted view of how much work it can be to change and how much fear peopl can have of change, especially the threats of outsourcing and company liquidations.

I am utterly shocked at how John, the security guy, has a meltdown, gets drunk, and then and becomes an evangelist for Bill. It's bizarre, especially when you consider his approach. Ask Etsy about their e-commerce functionality and then ask Etsy whether they could get by without their security team. It's not even dishonest... it's disrespectful.

Read Continuous Integration and Beyond Software Architecture. Call in Opscode or another devops company to do a consult. Start sending out your ops guys to conferences. Just please, please, please, don't take this book literally. It's fiction. It makes Ayn Rand look realistic.

And that's all I have to say about that.

I read through Feed, the first of the Newflesh books, and loved it. I read through the subsequent two books in the trilogy, and went "huh." Now, with Parasite, I think I'm done.

Grant makes the same mistakes in every book. Her protagonist is ridiculously well-connected: her father and sister work for USAMRIID and even her loving boyfriend is a parasitologist with his own ridiculous plot twist. She introduces funhouse mary-sue characters two thirds into the plot. She has hitherto reasonable characters throw temper tantrums and threaten people for no reason. She makes absolutely safe places into death traps with some handwaving, and worst of all, she has her protagonist decide to not share vital information for the flimsiest of reasons.

Don't get me wrong, it's good reading. But it's like eating bad Mexican food when you're hungry -- sure, you're happy at the time but you know you're going to regret and be vaguely ashamed for having eaten it afterwards.

This is an excellent book. However, it's not so much about securing modern web applications as it is about describing browser holes. As it should be, since much of it was taken from Google's Browser Security Handbook -- still, it's distracting to see so much space being devoted to the topic of Java applets and frames when the best way to secure a modern web application is to NOT USE JAVA APPLETS OR FRAMES. So I took off a star for that.

It also falls into the common trap of spending more time detailing the exploits than the techniques used to combat them. I realize to some extent this is a function of there being so many options to write a web application, but it'd be nice to see some worked examples.

That said, this is one of the most complete, comprehensive guides to the rathole that is the Web, and I've already got two more books I want to read just from the footnotes provided on the topic. His analysis of parsing HTML and validating browser input is particularly incisive (if trenchant).