"5 big security mistakes you're probably making"

March 13, 2012 By Roger A. Grimes | InfoWorld

A Comment...

Mr. Grimes often speaks of patching. In the world of Microsoft and other proprietary software, I know of little other choice as a first line of defense. That's a big reason I took back my computers from Microsoft, et.al. a few years ago.

Most businesses can't do that since they've decided they like comercial software companies running their business. They no longer maintain the in-house expertise to have secure systems.

Commercial, proprietary, closed-source software can never be secure.

What about the military, NSA, etc. which have some of the most secure systems in existence? Those are all developed in-house or by contractors to exacting specifications (That's why they cost so much). Those institutions have the source code to everything mission-critical they run and they isolate what little commercial software they have.

There have been so many Windows patches that I doubt anyone but Microsoft has a count. But think about this... Every one of those flaws was either present from the initial release or introduced by a previous patch!

Thus, the vast majority of vulnerabilities over the lifetime of any program will always be uncorrected. And the number of person-hours spent looking for vulnerabilities to exploit dwarfs the person-hours that Microsoft or any other company can afford to devote to patching.

How can we have reasonably secure systems then?

The only way I know of is open-source software.

Here's an analogy... Most theft occurs at night, when the lights are off and the theif can't be seen. The first line of defense for a storefront is to leave lights on when the store is closed so police and everyone else can see inside.

Closed-sourcing hides the software's errors from everyone but those with the skill and motivation to exploit them.

Companies will never have secure systems till they realize that the United States can never compete with developing countries on price. Trying to by outsourcing and using commercial software have been short-sighted.

When they take back control of their computer systems -- the engine their entire business depends on -- they will once again be able to compete the only way a country with our standard of living can... with innovation.
  

Google App Engine Support

Why Google's $500 a month Enterprise Support for App Engine mysteriously takes a 6 hour break from 6pm to midnight (PST) might be explained by looking at a world timezone map compared to a map of Google offices around the world.

Do Google's office locations have any relation to the concentration of App Engine users? If so, this may be the least disruptive period since most of the 6 business hours affected are over the Pacific. Are there many (any?) App Engine users in Japan, New Zealand, Australia or surrounding areas?

On the other hand, it could be to provide an exclusive window for third-party support from companies like Cloud Sherpas.

But then again, maybe running an around-the-clock technical support help-desk operation is just not what Google does best.

Google is, after all, an innovator.

Google creates leading-edge software systems. Their culture is one where everyone is thought of as a superstar... or an aspiring one. Google hires and promotes self-motivated, creative, impatient, out-of-the-box personalities.

While the best help desk people are compassionate, patient, methodical, thorough personalities that enjoy the satisfaction and confidence that comes from knowing the answers (Most of the the time. If they could just get the caller to ask the right question.)

It would make sense to outsource the help desk... but the logistics can never work.

How can a third-party keep its staff up-to-date with almost daily changes?

We are rapidly coming to expect software problems, particularly online software problems, to be fixed in a matter of days (or hours). Though many fixes to application software are internal and require no help desk procedure changes, most fixes in APIs like those for App Engine will at least alter the "best" way to do things if not the "only" way.

No, the only way Google can best its rivals for support is to automate it.

Google is just going to have to do what programming language designers have been trying to do since Grace Hopper developed COBOL... They're going to have to create a truly self-documenting language.

Be it Go, Dart, or something to come that barely resembles a "language", Google needs a system that communicates how to use it automatically from the code itself.

We already have IDEs that provide syntax and other documentation to the programmer. Maybe there could be deeper levels (in a wiki?) that are automatically generated from the code itself and accessible from outside the IDE. These would then be enhanced with feedback from developers, help desk personnel and users.

I expect such self-documenting systems exist... somewhere.

If anyone can bring them to world... Google can!

Resources

• Google to App Engine customers: Don't call us, we'll call you
  InfoWorld, October 13, 2011, Bill Snyder
  
• Turning Information into Knowledge:
  Information Finding as a Collaborative Activity
  Kate Ehrlich and Debra Cash

"Fed. Government Pays IT Contractors Nearly Twice As Much As Its Own IT Workers"

By Stephanie Overby, CIO, Wed, September 14, 2011

A Comment...

Finally! Somebody crunched the numbers and put them in a form everyone can understand. Now that their small pilot project of the Federal government has proven it can be done, POGO should move on to where the real waste, fraud and abuse is -- State Governments.

Let's summarize...

• Public employees, in all fields, have always been, and probably always will be, paid less than private industry employees doing the same work, with the same experience, and the same level of quality. The trade off used to be better job security, but that is rapidly disappearing with no increase in pay.
  
• For the typical government contractor, its salaries are higher, it has additional staff and resources dedicated to nothing but obtaining and managing contracts, and it has to make a profit.

Where in all that is there room for any cost savings?

Blasphemy Warning!

The mantra that "Anything government can do, private business can do better" is a fraud. It is pure marketing. There is no factual basis for it whatsoever.

Government, like business, has its share of slackers, "creative advancement strategists" and "funding siphoners".

Unlike business, it usually can't keep them hidden for long.

If businesses were required to be as open as government, people would vote to vastly expand government because it does everything far cheaper and most importantly... far more beneficially to you and me.

The Founding Fathers wisely realized (after much heated argument) that our success as a country depended on always maintaining a healthy balance between competing interests. In this case -- government and business.

Business interests on the other hand, have spent the last 235 years dismantling that principal. They've spent the last 30 years constantly screaming "government is too big", though it is far smaller than it needs to be. In doing so, the gargantuan business community has succeded in taking over the country and virtually enslaving (albeit, lavishly) our elected officials.

If all outsourcing were eliminated tomorrow, within 2 years I think we could pay off the national debt and buy Canada (Okay, maybe only British Columbia and the Yukon - so we're contiguous with Alaska.)

But the way things are going, it may be Canada that buys us. (Works for me!)

I don't doubt for a minute that American business would sell if the price were right!