The Way of the great learning involves manifesting virtue, renovating the people, and abiding by the highest good.

2009年1月30日星期五

Measurement Lab

Google及其盟友发布了一套工具,设计目的是帮助宽带用户和研究人员测试网络连接性能 工具发布在MeasurementLab.net上,包括网络诊断工具,网络通道诊断工具,测试宽带供应商是否有意减慢P2P通信速度的工具。即将发布的M-Lab应用有:判断宽带供应商是否将某类通信优先权置于其它通信之下的工具,判断供应商是否降级某些用户或软件的工具。Google副总裁和TCP/IP协议开发者之一的Vint Cerf表示,“透明是我们的目标,我们的意图是向感兴趣的用户提供更多可见的信息。” 测试工具是Java程序,因此运行之前你需要安装插件和JAVA安装程序。目前整个测试工具运行都很缓慢。

About Measurement Lab

Measurement Lab (M-Lab) is an open, distributed server platform for researchers to deploy Internet measurement tools. The goal of M-Lab is to advance network research and empower the public with useful information about their broadband connections. By enhancing Internet transparency, M-Lab helps sustain a healthy, innovative Internet.

When an Internet application doesn't work as expected, how can you tell whether the problem is caused by your broadband connection, the application or something else? It can be very difficult for professional network administrators, let alone average Internet users, to answer this sort of question today.

Transparency has always been an essential component of the Internet's success, and Internet users deserve to be well-informed about the performance of their broadband connections. For that to happen, researchers need resources to develop new analytical tools.

That's where M-Lab comes in.

    Tools for Users

    Many researchers are already developing tools that allow users to test their broadband connections by briefly communicating with a server elsewhere on the Internet. The M-Lab platform supports the development of these measurement tools.

    An Open Platform for Researchers

    M-Lab assists scientific research by providing widely-distributed servers and ample connectivity for researchers' use. Each tool will be allocated dedicated resources on the M-Lab platform to facilitate accurate measurements. Server-side tools will be openly licensed and operated to allow third-parties to develop their own client-side measurement software.

    Better, Open Data for Everyone

    All data collected via M-Lab will be made available to the research community to allow researchers to build on a common pool of network measurement data.

M-Lab today and in the future

M-Lab is only at the beginning of its development. Today, three tools will be available, running on three servers at one location, and they will only be able to support a limited number of simultaneous users. A total of 36 servers will be deployed across 12 locations early in 2009.

In order to achieve its goals, M-Lab depends on the active support of additional companies, institutions and researchers, and we welcome input from anyone interested in helping the platform flourish. As more researchers, institutions and companies participate, M-Lab will able to support a wider variety of tools.

If you are an Internet user and want to run the tools, check out our Tools page.

If you are a company, institution or researcher interested in learning more about using and supporting M-Lab, learn more here.

M-Lab Partners

M-Lab was founded by the New America Foundation's Open Technology Institute, the PlanetLab Consortium, Google Inc. and academic researchers.

2009年1月28日星期三

List of open source games

http://en.wikipedia.org/wiki/Alphabetical_list_of_open_source_games

Open source games are computer games assembled out of, and are themselves open-source software; public domain games are also listed. For some of these games, only the game engine is open-source software, and the game content is not open content, and is under a different license.

2009年1月25日星期日

ReadWriteWeb: Google Drive传闻又现

多年来人们都在预测Google 将会利用其不可思议的能力来提供在线存储服务“Google Drive。” 这个计划的传闻最近又出现了, 不过这次有了一些新的内容。

为什么你们喜欢Google Drive 服务呢? 是因为可能非常低的费用(或者免费?)。 是因为可以轻松容易的备份重要数据, 还是因为存储数据可能整合到其他Google 服务中去呢? 在这次传闻中有许多理由可以让你为之一震。

Greg Sterling 今天早上在Search Engine Land 总结了最新的传闻。 他介绍了最近的两个关于GDrive 有可能成真的消息。

GMail 有可能作为GDrive 的主页

Gmail 产品经理Todd Jackson 于上个星期讨论了网络应用

“我们了解到人们的文件大小日益增加。 他们希望共享文件, 将文件保存在网络中, 同时也不用担心在任何电脑运行不了。 Google 希望帮助他们解决这些问题。”

要是这样当然好啦, 我们知道Gmail 已经是大容量了。 它有可能是GDrive 的主页。 但是有没有比这更靠谱的答案么?

Picassa(Picasa?) 暗示

Sterling 同时也于前晚指出在Gooogle 观察网站Google Blogoscoped 有一张Picassa 的截图, 图上显示上传选项上有“Google Web Drive。”

而在这个帖子上的留言讨论非常有意思, 包括提及在Google Docs 上可能的相册储存, 以及Blogoscoped 读者认为GDrive 该是什么样子的一张模拟截图。

你想要Google Drive 么? 你相信Google Drive 真的会到来么?

Written by Marshall Kirkpatrick / January 19, 2009

2009年1月22日星期四

How Google’s PageRank predicts Nobel Prize winners

January 21st, 2009 | by KFC |

pagerankings-graph

Ranking scientists by their citations–the number of times they are mentioned in other scientists’ papers– is a miserable business. Everybody can point to ways in which this system is flawed:

  • not all citations are equal. The importance of the citing paper is a significant factor
  • scientists in different fields of study use citations in different ways. An average paper in the life sciences is cited about six times, three times in physics, and about once in mathematics.
  • ground-breaking papers may be cited less often because a field is necessarily smaller in its early days.
  • important papers often stop being cited when they are incorporated into textbooks

The pattern of citations between papers forms a complex network, not unlike the one the internet forms. Might that be a clue that point us towards a better way of assessing the merits of the papers that it consists of?

Sergei Maslov from Brookhaven National Laboratory in New York state and Sidney Redner at Boston University have asked themselves just that question and suggest that Google’s PageRank algorithm might throw some light on the matter.

In essence, PageRank counts the number of citations a paper receives (or the number of links that point to a webpage). The more a paper receives, the higher it is ranked. But a citing is also weighted according to the ranking of the citing paper. So citations from important papers make another paper more important.

Maslov and Redner have applied the algorithm to 353,268 articles published by the American Physical Society since 1893 in journals such as Physical Review Letters . And the results are a breath of fresh air.

The top 10 papers by Google Pageranking are:

  1. Unitary Symmetry & Leptonic Decays by Cabibbo
  2. Theory of Superconductivity by Bardeen, Cooper & Schrieffer
  3. Self-Consistent Equations . . . by Kohn & Sham
  4. Inhomogeneous Electron Gas by Hohenberg & Kohn
  5. A Model of Leptons by Weinberg
  6. Crystal Statistics . . . by Onsager
  7. Theory of the Fermi Interaction by Feynman & Gell-Mann
  8. Absence of Diffusion in . . . by Anderson
  9. The Theory of Complex Spectra by Slater
  10. Scaling Theory of Localization by Abrahams, Anderson, et al.

That’s an impressive list, not least because most of these authors are Nobel Prize winners. (Curiously the author of the top paper, Nicola Cabibbo, is not. That ought to be of interest to the Nobel committee who awarded Makoto Kobayashi and Toshihide Maskawa the 2008 Nobel Prize for physics for work that was heavily based on Cabibbo’s ideas.)

All of which suggests an idea. Mining the later entries in this list might be an good way of predicting future prize winners. So get your bets in before the bookies get wind of it.

Redner and Maslov conclude: “Google’s PageRank algorithm and its modifications hold great promise for quantifying the impact of scientific publications.”

Can’t argue with that.

Ref: arxiv.org/abs/0901.2640: Promise and Pitfalls of Extending Google’s PageRank Algorithm to Citation Networks

2009年1月18日星期日

Why Software Should Be Free

by Richard Stallman
(Version of April 24, 1992)
Introduction
The existence of software inevitably raises the question of how decisions about its use should be made. For example, suppose one individual who has a copy of a program meets another who would like a copy. It is possible for them to copy the program; who should decide whether this is done? The individuals involved? Or another party, called the “owner”?
Software developers typically consider these questions on the assumption that the criterion for the answer is to maximize developers' profits. The political power of business has led to the government adoption of both this criterion and the answer proposed by the developers: that the program has an owner, typically a corporation associated with its development.
I would like to consider the same question using a different criterion: the prosperity and freedom of the public in general.
This answer cannot be decided by current law—the law should conform to ethics, not the other way around. Nor does current practice decide this question, although it may suggest possible answers. The only way to judge is to see who is helped and who is hurt by recognizing owners of software, why, and how much. In other words, we should perform a cost-benefit analysis on behalf of society as a whole, taking account of individual freedom as well as production of material goods.
In this essay, I will describe the effects of having owners, and show that the results are detrimental. My conclusion is that programmers have the duty to encourage others to share, redistribute, study, and improve the software we write: in other words, to write “free” software.(1)
How Owners Justify Their Power
Those who benefit from the current system where programs are property offer two arguments in support of their claims to own programs: the emotional argument and the economic argument.
The emotional argument goes like this: “I put my sweat, my heart, my soul into this program. It comes from me, it's mine!”
This argument does not require serious refutation. The feeling of attachment is one that programmers can cultivate when it suits them; it is not inevitable. Consider, for example, how willingly the same programmers usually sign over all rights to a large corporation for a salary; the emotional attachment mysteriously vanishes. By contrast, consider the great artists and artisans of medieval times, who didn't even sign their names to their work. To them, the name of the artist was not important. What mattered was that the work was done—and the purpose it would serve. This view prevailed for hundreds of years.
The economic argument goes like this: “I want to get rich (usually described inaccurately as ‘making a living’), and if you don't allow me to get rich by programming, then I won't program. Everyone else is like me, so nobody will ever program. And then you'll be stuck with no programs at all!” This threat is usually veiled as friendly advice from the wise.
I'll explain later why this threat is a bluff. First I want to address an implicit assumption that is more visible in another formulation of the argument.
This formulation starts by comparing the social utility of a proprietary program with that of no program, and then concludes that proprietary software development is, on the whole, beneficial, and should be encouraged. The fallacy here is in comparing only two outcomes—proprietary software vs. no software—and assuming there are no other possibilities.
Given a system of software copyright, software development is usually linked with the existence of an owner who controls the software's use. As long as this linkage exists, we are often faced with the choice of proprietary software or none. However, this linkage is not inherent or inevitable; it is a consequence of the specific social/legal policy decision that we are questioning: the decision to have owners. To formulate the choice as between proprietary software vs. no software is begging the question.
The Argument against Having Owners
The question at hand is, “Should development of software be linked with having owners to restrict the use of it?”
In order to decide this, we have to judge the effect on society of each of those two activities independently: the effect of developing the software (regardless of its terms of distribution), and the effect of restricting its use (assuming the software has been developed). If one of these activities is helpful and the other is harmful, we would be better off dropping the linkage and doing only the helpful one.
To put it another way, if restricting the distribution of a program already developed is harmful to society overall, then an ethical software developer will reject the option of doing so.
To determine the effect of restricting sharing, we need to compare the value to society of a restricted (i.e., proprietary) program with that of the same program, available to everyone. This means comparing two possible worlds.
This analysis also addresses the simple counterargument sometimes made that “the benefit to the neighbor of giving him or her a copy of a program is cancelled by the harm done to the owner.” This counterargument assumes that the harm and the benefit are equal in magnitude. The analysis involves comparing these magnitudes, and shows that the benefit is much greater.
To elucidate this argument, let's apply it in another area: road construction.
It would be possible to fund the construction of all roads with tolls. This would entail having toll booths at all street corners. Such a system would provide a great incentive to improve roads. It would also have the virtue of causing the users of any given road to pay for that road. However, a toll booth is an artificial obstruction to smooth driving—artificial, because it is not a consequence of how roads or cars work.
Comparing free roads and toll roads by their usefulness, we find that (all else being equal) roads without toll booths are cheaper to construct, cheaper to run, safer, and more efficient to use.(2) In a poor country, tolls may make the roads unavailable to many citizens. The roads without toll booths thus offer more benefit to society at less cost; they are preferable for society. Therefore, society should choose to fund roads in another way, not by means of toll booths. Use of roads, once built, should be free.
When the advocates of toll booths propose them as merely a way of raising funds, they distort the choice that is available. Toll booths do raise funds, but they do something else as well: in effect, they degrade the road. The toll road is not as good as the free road; giving us more or technically superior roads may not be an improvement if this means substituting toll roads for free roads.
Of course, the construction of a free road does cost money, which the public must somehow pay. However, this does not imply the inevitability of toll booths. We who must in either case pay will get more value for our money by buying a free road.
I am not saying that a toll road is worse than no road at all. That would be true if the toll were so great that hardly anyone used the road—but this is an unlikely policy for a toll collector. However, as long as the toll booths cause significant waste and inconvenience, it is better to raise the funds in a less obstructive fashion.
To apply the same argument to software development, I will now show that having “toll booths” for useful software programs costs society dearly: it makes the programs more expensive to construct, more expensive to distribute, and less satisfying and efficient to use. It will follow that program construction should be encouraged in some other way. Then I will go on to explain other methods of encouraging and (to the extent actually necessary) funding software development.
The Harm Done by Obstructing Software
Consider for a moment that a program has been developed, and any necessary payments for its development have been made; now society must choose either to make it proprietary or allow free sharing and use. Assume that the existence of the program and its availability is a desirable thing.(3)
Restrictions on the distribution and modification of the program cannot facilitate its use. They can only interfere. So the effect can only be negative. But how much? And what kind?
Three different levels of material harm come from such obstruction:
Fewer people use the program.
None of the users can adapt or fix the program.
Other developers cannot learn from the program, or base new work on it.
Each level of material harm has a concomitant form of psychosocial harm. This refers to the effect that people's decisions have on their subsequent feelings, attitudes, and predispositions. These changes in people's ways of thinking will then have a further effect on their relationships with their fellow citizens, and can have material consequences.
The three levels of material harm waste part of the value that the program could contribute, but they cannot reduce it to zero. If they waste nearly all the value of the program, then writing the program harms society by at most the effort that went into writing the program. Arguably a program that is profitable to sell must provide some net direct material benefit.
However, taking account of the concomitant psychosocial harm, there is no limit to the harm that proprietary software development can do.
Obstructing Use of Programs
The first level of harm impedes the simple use of a program. A copy of a program has nearly zero marginal cost (and you can pay this cost by doing the work yourself), so in a free market, it would have nearly zero price. A license fee is a significant disincentive to use the program. If a widely-useful program is proprietary, far fewer people will use it.
It is easy to show that the total contribution of a program to society is reduced by assigning an owner to it. Each potential user of the program, faced with the need to pay to use it, may choose to pay, or may forego use of the program. When a user chooses to pay, this is a zero-sum transfer of wealth between two parties. But each time someone chooses to forego use of the program, this harms that person without benefitting anyone. The sum of negative numbers and zeros must be negative.
But this does not reduce the amount of work it takes to develop the program. As a result, the efficiency of the whole process, in delivered user satisfaction per hour of work, is reduced.
This reflects a crucial difference between copies of programs and cars, chairs, or sandwiches. There is no copying machine for material objects outside of science fiction. But programs are easy to copy; anyone can produce as many copies as are wanted, with very little effort. This isn't true for material objects because matter is conserved: each new copy has to be built from raw materials in the same way that the first copy was built.
With material objects, a disincentive to use them makes sense, because fewer objects bought means less raw material and work needed to make them. It's true that there is usually also a startup cost, a development cost, which is spread over the production run. But as long as the marginal cost of production is significant, adding a share of the development cost does not make a qualitative difference. And it does not require restrictions on the freedom of ordinary users.
However, imposing a price on something that would otherwise be free is a qualitative change. A centrally-imposed fee for software distribution becomes a powerful disincentive.
What's more, central production as now practiced is inefficient even as a means of delivering copies of software. This system involves enclosing physical disks or tapes in superfluous packaging, shipping large numbers of them around the world, and storing them for sale. This cost is presented as an expense of doing business; in truth, it is part of the waste caused by having owners.
Damaging Social Cohesion
Suppose that both you and your neighbor would find it useful to run a certain program. In ethical concern for your neighbor, you should feel that proper handling of the situation will enable both of you to use it. A proposal to permit only one of you to use the program, while restraining the other, is divisive; neither you nor your neighbor should find it acceptable.
Signing a typical software license agreement means betraying your neighbor: “I promise to deprive my neighbor of this program so that I can have a copy for myself.” People who make such choices feel internal psychological pressure to justify them, by downgrading the importance of helping one's neighbors—thus public spirit suffers. This is psychosocial harm associated with the material harm of discouraging use of the program.
Many users unconsciously recognize the wrong of refusing to share, so they decide to ignore the licenses and laws, and share programs anyway. But they often feel guilty about doing so. They know that they must break the laws in order to be good neighbors, but they still consider the laws authoritative, and they conclude that being a good neighbor (which they are) is naughty or shameful. That is also a kind of psychosocial harm, but one can escape it by deciding that these licenses and laws have no moral force.
Programmers also suffer psychosocial harm knowing that many users will not be allowed to use their work. This leads to an attitude of cynicism or denial. A programmer may describe enthusiastically the work that he finds technically exciting; then when asked, “Will I be permitted to use it?”, his face falls, and he admits the answer is no. To avoid feeling discouraged, he either ignores this fact most of the time or adopts a cynical stance designed to minimize the importance of it.
Since the age of Reagan, the greatest scarcity in the United States is not technical innovation, but rather the willingness to work together for the public good. It makes no sense to encourage the former at the expense of the latter.
Obstructing Custom Adaptation of Programs
The second level of material harm is the inability to adapt programs. The ease of modification of software is one of its great advantages over older technology. But most commercially available software isn't available for modification, even after you buy it. It's available for you to take it or leave it, as a black box—that is all.
A program that you can run consists of a series of numbers whose meaning is obscure. No one, not even a good programmer, can easily change the numbers to make the program do something different.
Programmers normally work with the “source code” for a program, which is written in a programming language such as Fortran or C. It uses names to designate the data being used and the parts of the program, and it represents operations with symbols such as ‘+’ for addition and ‘-’ for subtraction. It is designed to help programmers read and change programs. Here is an example; a program to calculate the distance between two points in a plane: float
distance (p0, p1)
struct point p0, p1;
{
float xdist = p1.x - p0.x;
float ydist = p1.y - p0.y;
return sqrt (xdist * xdist + ydist * ydist);
}
Here is the same program in executable form, on the computer I normally use: 1314258944 -232267772 -231844864 1634862
1411907592 -231844736 2159150 1420296208
-234880989 -234879837 -234879966 -232295424
1644167167 -3214848 1090581031 1962942495
572518958 -803143692 1314803317
Source code is useful (at least potentially) to every user of a program. But most users are not allowed to have copies of the source code. Usually the source code for a proprietary program is kept secret by the owner, lest anybody else learn something from it. Users receive only the files of incomprehensible numbers that the computer will execute. This means that only the program's owner can change the program.
A friend once told me of working as a programmer in a bank for about six months, writing a program similar to something that was commercially available. She believed that if she could have gotten source code for that commercially available program, it could easily have been adapted to their needs. The bank was willing to pay for this, but was not permitted to—the source code was a secret. So she had to do six months of make-work, work that counts in the GNP but was actually waste.
The MIT Artificial Intelligence Lab (AI Lab) received a graphics printer as a gift from Xerox around 1977. It was run by free software to which we added many convenient features. For example, the software would notify a user immediately on completion of a print job. Whenever the printer had trouble, such as a paper jam or running out of paper, the software would immediately notify all users who had print jobs queued. These features facilitated smooth operation.
Later Xerox gave the AI Lab a newer, faster printer, one of the first laser printers. It was driven by proprietary software that ran in a separate dedicated computer, so we couldn't add any of our favorite features. We could arrange to send a notification when a print job was sent to the dedicated computer, but not when the job was actually printed (and the delay was usually considerable). There was no way to find out when the job was actually printed; you could only guess. And no one was informed when there was a paper jam, so the printer often went for an hour without being fixed.
The system programmers at the AI Lab were capable of fixing such problems, probably as capable as the original authors of the program. Xerox was uninterested in fixing them, and chose to prevent us, so we were forced to accept the problems. They were never fixed.
Most good programmers have experienced this frustration. The bank could afford to solve the problem by writing a new program from scratch, but a typical user, no matter how skilled, can only give up.
Giving up causes psychosocial harm—to the spirit of self-reliance. It is demoralizing to live in a house that you cannot rearrange to suit your needs. It leads to resignation and discouragement, which can spread to affect other aspects of one's life. People who feel this way are unhappy and do not do good work.
Imagine what it would be like if recipes were hoarded in the same fashion as software. You might say, “How do I change this recipe to take out the salt?” and the great chef would respond, “How dare you insult my recipe, the child of my brain and my palate, by trying to tamper with it? You don't have the judgment to change my recipe and make it work right!”
“But my doctor says I'm not supposed to eat salt! What can I do? Will you take out the salt for me?”
“I would be glad to do that; my fee is only $50,000.” Since the owner has a monopoly on changes, the fee tends to be large. “However, right now I don't have time. I am busy with a commission to design a new recipe for ship's biscuit for the Navy Department. I might get around to you in about two years.”
Obstructing Software Development
The third level of material harm affects software development. Software development used to be an evolutionary process, where a person would take an existing program and rewrite parts of it for one new feature, and then another person would rewrite parts to add another feature; in some cases, this continued over a period of twenty years. Meanwhile, parts of the program would be “cannibalized” to form the beginnings of other programs.
The existence of owners prevents this kind of evolution, making it necessary to start from scratch when developing a program. It also prevents new practitioners from studying existing programs to learn useful techniques or even how large programs can be structured.
Owners also obstruct education. I have met bright students in computer science who have never seen the source code of a large program. They may be good at writing small programs, but they can't begin to learn the different skills of writing large ones if they can't see how others have done it.
In any intellectual field, one can reach greater heights by standing on the shoulders of others. But that is no longer generally allowed in the software field—you can only stand on the shoulders of the other people in your own company.
The associated psychosocial harm affects the spirit of scientific cooperation, which used to be so strong that scientists would cooperate even when their countries were at war. In this spirit, Japanese oceanographers abandoning their lab on an island in the Pacific carefully preserved their work for the invading U.S. Marines, and left a note asking them to take good care of it.
Conflict for profit has destroyed what international conflict spared. Nowadays scientists in many fields don't publish enough in their papers to enable others to replicate the experiment. They publish only enough to let readers marvel at how much they were able to do. This is certainly true in computer science, where the source code for the programs reported on is usually secret.
It Does Not Matter How Sharing Is Restricted
I have been discussing the effects of preventing people from copying, changing, and building on a program. I have not specified how this obstruction is carried out, because that doesn't affect the conclusion. Whether it is done by copy protection, or copyright, or licenses, or encryption, or ROM cards, or hardware serial numbers, if it succeeds in preventing use, it does harm.
Users do consider some of these methods more obnoxious than others. I suggest that the methods most hated are those that accomplish their objective.
Software Should be Free
I have shown how ownership of a program—the power to restrict changing or copying it—is obstructive. Its negative effects are widespread and important. It follows that society shouldn't have owners for programs.
Another way to understand this is that what society needs is free software, and proprietary software is a poor substitute. Encouraging the substitute is not a rational way to get what we need.
Vaclav Havel has advised us to “Work for something because it is good, not just because it stands a chance to succeed.” A business making proprietary software stands a chance of success in its own narrow terms, but it is not what is good for society.
Why People Will Develop Software
If we eliminate copyright as a means of encouraging people to develop software, at first less software will be developed, but that software will be more useful. It is not clear whether the overall delivered user satisfaction will be less; but if it is, or if we wish to increase it anyway, there are other ways to encourage development, just as there are ways besides toll booths to raise money for streets. Before I talk about how that can be done, first I want to question how much artificial encouragement is truly necessary.
Programming is Fun
There are some lines of work that few will enter except for money; road construction, for example. There are other fields of study and art in which there is little chance to become rich, which people enter for their fascination or their perceived value to society. Examples include mathematical logic, classical music, and archaeology; and political organizing among working people. People compete, more sadly than bitterly, for the few funded positions available, none of which is funded very well. They may even pay for the chance to work in the field, if they can afford to.
Such a field can transform itself overnight if it begins to offer the possibility of getting rich. When one worker gets rich, others demand the same opportunity. Soon all may demand large sums of money for doing what they used to do for pleasure. When another couple of years go by, everyone connected with the field will deride the idea that work would be done in the field without large financial returns. They will advise social planners to ensure that these returns are possible, prescribing special privileges, powers, and monopolies as necessary to do so.
This change happened in the field of computer programming in the past decade. Fifteen years ago, there were articles on “computer addiction”: users were “onlining” and had hundred-dollar-a-week habits. It was generally understood that people frequently loved programming enough to break up their marriages. Today, it is generally understood that no one would program except for a high rate of pay. People have forgotten what they knew fifteen years ago.
When it is true at a given time that most people will work in a certain field only for high pay, it need not remain true. The dynamic of change can run in reverse, if society provides an impetus. If we take away the possibility of great wealth, then after a while, when the people have readjusted their attitudes, they will once again be eager to work in the field for the joy of accomplishment.
The question, “How can we pay programmers?” becomes an easier question when we realize that it's not a matter of paying them a fortune. A mere living is easier to raise.
Funding Free Software
Institutions that pay programmers do not have to be software houses. Many other institutions already exist that can do this.
Hardware manufacturers find it essential to support software development even if they cannot control the use of the software. In 1970, much of their software was free because they did not consider restricting it. Today, their increasing willingness to join consortiums shows their realization that owning the software is not what is really important for them.
Universities conduct many programming projects. Today they often sell the results, but in the 1970s they did not. Is there any doubt that universities would develop free software if they were not allowed to sell software? These projects could be supported by the same government contracts and grants that now support proprietary software development.
It is common today for university researchers to get grants to develop a system, develop it nearly to the point of completion and call that “finished”, and then start companies where they really finish the project and make it usable. Sometimes they declare the unfinished version “free”; if they are thoroughly corrupt, they instead get an exclusive license from the university. This is not a secret; it is openly admitted by everyone concerned. Yet if the researchers were not exposed to the temptation to do these things, they would still do their research.
Programmers writing free software can make their living by selling services related to the software. I have been hired to port the GNU C compiler to new hardware, and to make user-interface extensions to GNU Emacs. (I offer these improvements to the public once they are done.) I also teach classes for which I am paid.
I am not alone in working this way; there is now a successful, growing corporation which does no other kind of work. Several other companies also provide commercial support for the free software of the GNU system. This is the beginning of the independent software support industry—an industry that could become quite large if free software becomes prevalent. It provides users with an option generally unavailable for proprietary software, except to the very wealthy.
New institutions such as the Free Software Foundation can also fund programmers. Most of the Foundation's funds come from users buying tapes through the mail. The software on the tapes is free, which means that every user has the freedom to copy it and change it, but many nonetheless pay to get copies. (Recall that “free software” refers to freedom, not to price.) Some users who already have a copy order tapes as a way of making a contribution they feel we deserve. The Foundation also receives sizable donations from computer manufacturers.
The Free Software Foundation is a charity, and its income is spent on hiring as many programmers as possible. If it had been set up as a business, distributing the same free software to the public for the same fee, it would now provide a very good living for its founder.
Because the Foundation is a charity, programmers often work for the Foundation for half of what they could make elsewhere. They do this because we are free of bureaucracy, and because they feel satisfaction in knowing that their work will not be obstructed from use. Most of all, they do it because programming is fun. In addition, volunteers have written many useful programs for us. (Even technical writers have begun to volunteer.)
This confirms that programming is among the most fascinating of all fields, along with music and art. We don't have to fear that no one will want to program.
What Do Users Owe to Developers?
There is a good reason for users of software to feel a moral obligation to contribute to its support. Developers of free software are contributing to the users' activities, and it is both fair and in the long-term interest of the users to give them funds to continue.
However, this does not apply to proprietary software developers, since obstructionism deserves a punishment rather than a reward.
We thus have a paradox: the developer of useful software is entitled to the support of the users, but any attempt to turn this moral obligation into a requirement destroys the basis for the obligation. A developer can either deserve a reward or demand it, but not both.
I believe that an ethical developer faced with this paradox must act so as to deserve the reward, but should also entreat the users for voluntary donations. Eventually the users will learn to support developers without coercion, just as they have learned to support public radio and television stations.
What Is Software Productivity?
If software were free, there would still be programmers, but perhaps fewer of them. Would this be bad for society?
Not necessarily. Today the advanced nations have fewer farmers than in 1900, but we do not think this is bad for society, because the few deliver more food to the consumers than the many used to do. We call this improved productivity. Free software would require far fewer programmers to satisfy the demand, because of increased software productivity at all levels:
Wider use of each program that is developed.
The ability to adapt existing programs for customization instead of starting from scratch.
Better education of programmers.
The elimination of duplicate development effort.
Those who object to cooperation claiming it would result in the employment of fewer programmers are actually objecting to increased productivity. Yet these people usually accept the widely-held belief that the software industry needs increased productivity. How is this?
“Software productivity” can mean two different things: the overall productivity of all software development, or the productivity of individual projects. Overall productivity is what society would like to improve, and the most straightforward way to do this is to eliminate the artificial obstacles to cooperation which reduce it. But researchers who study the field of “software productivity” focus only on the second, limited, sense of the term, where improvement requires difficult technological advances.
Is Competition Inevitable?
Is it inevitable that people will try to compete, to surpass their rivals in society? Perhaps it is. But competition itself is not harmful; the harmful thing is combat.
There are many ways to compete. Competition can consist of trying to achieve ever more, to outdo what others have done. For example, in the old days, there was competition among programming wizards—competition for who could make the computer do the most amazing thing, or for who could make the shortest or fastest program for a given task. This kind of competition can benefit everyone, as long as the spirit of good sportsmanship is maintained.
Constructive competition is enough competition to motivate people to great efforts. A number of people are competing to be the first to have visited all the countries on Earth; some even spend fortunes trying to do this. But they do not bribe ship captains to strand their rivals on desert islands. They are content to let the best person win.
Competition becomes combat when the competitors begin trying to impede each other instead of advancing themselves—when “Let the best person win” gives way to “Let me win, best or not.” Proprietary software is harmful, not because it is a form of competition, but because it is a form of combat among the citizens of our society.
Competition in business is not necessarily combat. For example, when two grocery stores compete, their entire effort is to improve their own operations, not to sabotage the rival. But this does not demonstrate a special commitment to business ethics; rather, there is little scope for combat in this line of business short of physical violence. Not all areas of business share this characteristic. Withholding information that could help everyone advance is a form of combat.
Business ideology does not prepare people to resist the temptation to combat the competition. Some forms of combat have been banned with anti-trust laws, truth in advertising laws, and so on, but rather than generalizing this to a principled rejection of combat in general, executives invent other forms of combat which are not specifically prohibited. Society's resources are squandered on the economic equivalent of factional civil war.
“Why Don't You Move to Russia?”
In the United States, any advocate of other than the most extreme form of laissez-faire selfishness has often heard this accusation. For example, it is leveled against the supporters of a national health care system, such as is found in all the other industrialized nations of the free world. It is leveled against the advocates of public support for the arts, also universal in advanced nations. The idea that citizens have any obligation to the public good is identified in America with Communism. But how similar are these ideas?
Communism as was practiced in the Soviet Union was a system of central control where all activity was regimented, supposedly for the common good, but actually for the sake of the members of the Communist party. And where copying equipment was closely guarded to prevent illegal copying.
The American system of software copyright exercises central control over distribution of a program, and guards copying equipment with automatic copying-protection schemes to prevent illegal copying.
By contrast, I am working to build a system where people are free to decide their own actions; in particular, free to help their neighbors, and free to alter and improve the tools which they use in their daily lives. A system based on voluntary cooperation and on decentralization.
Thus, if we are to judge views by their resemblance to Russian Communism, it is the software owners who are the Communists.
The Question of Premises
I make the assumption in this paper that a user of software is no less important than an author, or even an author's employer. In other words, their interests and needs have equal weight, when we decide which course of action is best.
This premise is not universally accepted. Many maintain that an author's employer is fundamentally more important than anyone else. They say, for example, that the purpose of having owners of software is to give the author's employer the advantage he deserves—regardless of how this may affect the public.
It is no use trying to prove or disprove these premises. Proof requires shared premises. So most of what I have to say is addressed only to those who share the premises I use, or at least are interested in what their consequences are. For those who believe that the owners are more important than everyone else, this paper is simply irrelevant.
But why would a large number of Americans accept a premise that elevates certain people in importance above everyone else? Partly because of the belief that this premise is part of the legal traditions of American society. Some people feel that doubting the premise means challenging the basis of society.
It is important for these people to know that this premise is not part of our legal tradition. It never has been.
Thus, the Constitution says that the purpose of copyright is to “promote the progress of science and the useful arts.” The Supreme Court has elaborated on this, stating in ‘Fox Film vs. Doyal’ that “The sole interest of the United States and the primary object in conferring the [copyright] monopoly lie in the general benefits derived by the public from the labors of authors.”
We are not required to agree with the Constitution or the Supreme Court. (At one time, they both condoned slavery.) So their positions do not disprove the owner supremacy premise. But I hope that the awareness that this is a radical right-wing assumption rather than a traditionally recognized one will weaken its appeal.
Conclusion
We like to think that our society encourages helping your neighbor; but each time we reward someone for obstructionism, or admire them for the wealth they have gained in this way, we are sending the opposite message.
Software hoarding is one form of our general willingness to disregard the welfare of society for personal gain. We can trace this disregard from Ronald Reagan to Dick Cheney, from Exxon to Enron, from failing banks to failing schools. We can measure it with the size of the homeless population and the prison population. The antisocial spirit feeds on itself, because the more we see that other people will not help us, the more it seems futile to help them. Thus society decays into a jungle.
If we don't want to live in a jungle, we must change our attitudes. We must start sending the message that a good citizen is one who cooperates when appropriate, not one who is successful at taking from others. I hope that the free software movement will contribute to this: at least in one area, we will replace the jungle with a more efficient system which encourages and runs on voluntary cooperation.
Footnotes
The word “free” in “free software” refers to freedom, not to price; the price paid for a copy of a free program may be zero, or small, or (rarely) quite large.
The issues of pollution and traffic congestion do not alter this conclusion. If we wish to make driving more expensive to discourage driving in general, it is disadvantageous to do this using toll booths, which contribute to both pollution and congestion. A tax on gasoline is much better. Likewise, a desire to enhance safety by limiting maximum speed is not relevant; a free-access road enhances the average speed by avoiding stops and delays, for any given speed limit.
One might regard a particular computer program as a harmful thing that should not be available at all, like the Lotus Marketplace database of personal information, which was withdrawn from sale due to public disapproval. Most of what I say does not apply to this case, but it makes little sense to argue for having an owner on the grounds that the owner will make the program less available. The owner will not make it completely unavailable, as one would wish in the case of a program whose use is considered destructive.
This essay is published in Free Software, Free Society: The Selected Essays of Richard M. Stallman
back to top
Please send FSF & GNU inquiries to gnu@gnu.org. There are also other ways to contact the FSF. Please send broken links and other corrections or suggestions to webmasters@gnu.org.
Please see the Translations README for information on coordinating and submitting translations of this article.
Copyright © 1998, 2000, 2001, 2006, 2007 Free Software Foundation, Inc.,
51 Franklin St, Fifth Floor, Boston, MA 02110, USA
Verbatim copying and distribution of this entire article are permitted worldwide, without royalty, in any medium, provided this notice, and the copyright notice, are preserved.
Updated: $Date: 2009/01/06 23:22:49 $
Translations of this page -->
Česky [cs]
Deutsch [de]
English [en]
Español [es]
Suomi [fi]
Français [fr]
עברית [he]
Bahasa Indonesia [id]
Nederlands [nl]
Polski [pl]
português do Brasil [pt-br]
Русский [ru]
Српски [sr]
தமிழ் [ta]
简体中文 [zh-cn]
繁體中文 [zh-tw]

What is Free/Open Source Software?

“Briefly, OSS/FS programs are programs whose licenses give users the freedom to run the program for any purpose, to study and modify the program, and to redistribute copies of either the original or modified program (without having to pay royalties to previous developers).”David Wheeleri
Free and Open Source Software (FOSS) has become an international phenomenon, moving from relative obscurity to being the latest buzzword in a few short years. However, there is still a lack of understanding about what really constitutes FOSS and the ramifications of this new concept. To better explain this phenomenon, we will examine the philosophy and development methods behind FOSS.The FOSS philosophy
There are two major philosophies in the FOSS world: the Free Software Foundation (FSF) philosophy and the Open Source Initiative (OSI) philosophy. We begin with the FSF philosophy, due to its historical precedence (see the following section, “A Brief History of FOSS”) and pioneering position in the movement.
According to the FSF, free software is about protecting four user freedoms:The freedom to run a program, for any purpose;The freedom to study how a program works and adapt it to a person’s needs. Access to the source code is a precondition for this;The freedom to redistribute copies so that you can help your neighbour; andThe freedom to improve a program and release your improvements to the public, so that the whole community benefits. Access to the source code is a precondition for this.ii
At the heart of FSF is the freedom to cooperate. Because non-free (free as in freedom, not price) software restricts the freedom to cooperate, FSF considers non-free software unethical. FSF is also opposed to software patents and additional restrictions to existing copyright laws. All of these restrict the four user freedoms listed above. For a more detailed explanation of why software needs to be free, please refer to the FSF explanation, “Why Software Should Be Free”, found at http://www.fsf.org/philosophy/shouldbefree.html
The OSI philosophy is somewhat different:
The basic idea behind open source is very simple: When programmers can read, redistribute, and modify the source code for a piece of software, the software evolves. People improve it, people adapt it, people fix bugs. And this can happen at a speed that, if one is used to the slow pace of conventional software development, seems astonishing.iii
The OSI is focused on the technical values of making powerful, reliable software, and is more business-friendly than the FSF. It is less focused on the moral issues of Free Software and more on the practical advantages of the FOSS distributed development method.
While the fundamental philosophy of the two movements are different, both FSF and OSI share the same space and cooperate on practical grounds like software development, efforts against proprietary software, software patents, and the like. As Richard Stallman says, the Free Software Movement and the Open Source Movement are two political parties in the same community.The FOSS development method
The FOSS development model is unique and became possible only with the advent of the Internet and the communication boom caused by it. The cathedral and bazaar analogiesiv are used to contrast the FOSS development model with traditional software development methods.
Traditional software development is likened to the way cathedrals were built in ancient times. Small groups of skilled artisans carefully planned out the design in isolation and everything was built in a single effort. Once built, the cathedrals were complete and little further modification was made. Software was traditionally built in a similar fashion. Groups of programmers worked in isolation, with careful planning and management, until their work was completed and the program released to the world. Once released, the program was considered finished and limited work was subsequently done on it.
In contrast, FOSS development is more akin to a bazaar, which grows organically. Initial traders come, establish their structures, and begin business. Later traders come and establish their own structures, and the bazaar grows in what appears to be a very chaotic fashion. Traders are concerned primarily with building a minimally functional structure so that they can begin trading. Later additions are added as circumstances dictate. Likewise, FOSS development starts off highly unstructured. Developers release early minimally functional code to the general public and then modify their programs based on feedback. Other developers may come along and modify or build upon the existing code. Over time, an entire operating system and suite of applications develops and evolves continuously.
The bazaar method of development has been proven over time to have several advantages:
1.Reduced duplication of effortBy releasing programs early and granting users the right to modify and redistribute the source code, FOSS developers reuse the work produced by compatriots. The economies of scale can be enormous. Instead of five software developers in 10 companies writing a single networking application, there is the potential for the combined efforts of 50 developers. The reduced duplication of effort allows FOSS development to scale to massive, unheard of levels involving thousands of developers around the world.
2.Building upon the work of othersWith the availability of existing source code to build on, development times are reduced. Many FOSS projects rely on software built by other projects to supply needed functionality. For example, instead of writing their own cryptographic code, the Apache web server project uses the OpenSSL project’s implementation, thereby saving thousands of hours of coding and testing. Even in cases where source code cannot be directly integrated, the availability of existing source code allows developers to learn how another project has solved a similar problem.
3.Better quality control“Given enough eyeballs, all bugs are shallow”v is an oft-cited quotation in the FOSS world. It means with enough qualified developers using the application and examining the source code, errors are spotted and fixed faster. Proprietary applications may accept error reports but because their users are denied access to the source code, users are limited to reporting symptoms. FOSS developers often find that users with access to the source code not only report problems but also pinpoint the exact cause and, in some cases, supply the fixes. This greatly reduces development and quality control time.
4.Reduced maintenance costsMaintenance of any software package can often equal or exceed the cost of initial software developmentvi. When a single organization has to maintain software, this can be an extremely expensive task. However, with the FOSS development model, maintenance costs can be shared among the thousands of potential users of a software application, reducing per-organization costs. Likewise, enhancements can be made by the organization/individual with the best expertise in the matter, which results in a more efficient use of resources.

2009年1月16日星期五

Plan 9 From Bell Labs

April, 2002
updated June, 2003
Copyright © 2002-2003 Lucent Technologies Inc.
All Rights Reserved
The fourth release of the Plan 9 operating system from Bell Labs packages a major overhaul of the system at every level. From the underlying file system protocol, 9P, through the kernel, libraries, and applications, almost everything has been modified and, in many cases, redesigned or rewritten.
The most significant change is that 9P has been redesigned to address a number of shortcomings, most important, its previous inability to handle long file names. Unfortunately, squeezing long names onto the disks of existing file servers is a messy business that we’re still grappling with, so at the moment fs(4) and kfs(4) can’t yet handle long names, although they do talk the new protocol. (In fact, they talk both old and new, as required, to ease transition.) In the meantime, there is a workaround 鈥?lnfs(4) 鈥?and many of the other file servers such as ramfs(4) and u9fs(4) work just fine with long names. It’s only the old disk-resident file servers that don’t. The new file server fossil(4) handles supports long names and many other features. The older servers are now deprecated.
The following is a partial list of the major changes throughout the system.
∙ The file system protocol, 9P, has been reworked. It now has variable-length names, so it can handle long names but also is more compact when handling short ones. It uses a different format that is easily parsed, eliminating the need for the old aux/fcall utility, and delegates its authentication duties to an external agent, factotum.
∙ Security has been a focus of attention. A new security agent, factotum(4), manages passwords and other secrets and, coupled with a new secure file store secstore(8), enables secure single sign-on.
∙ Cpu, import, and exportfs all encrypt their connections now, and since they use the new 9P they also use new network port numbers. A new service aan(1) is used by import to make its network connections more reliable in the face of network outages. The old ports still work, through the agency of a protocol conversion filter srvold9p(4).
∙ We are phasing out the IL protocol since it doesn’t handle long-distance connections well (and long-distance networks don’t handle it well, either). IL is still used by fs(4) but TCP has become the standard protocol for all other services.
∙ The software for the new network-resident secure block store, venti(8), is included with this distribution. The new file server fossil(4) uses Venti rather than a WORM as its permanent block repository/backup medium. It is still being developed, but is mature enough that a handful of users throughout the world are using it as their primary file server.
∙ The need to handle longer file names triggered a rethinking of the way the system handles strings in general. The kernel is now more explanatory when it gives an error message and more consistent in how it handles strings such as commands to devices. The interfaces to many of the system calls, such as errstr(2) and wait(2) all had to change as a result, as did the library interface to read directories, stat(2) and its relatives.
∙ The formatted I/O package described in print(2) and fmtinstall(2) has been redesigned. Although the basic interface is unchanged, it now runs without locks and has an internal buffer management mechanism that means print no longer needs a large on-stack buffer. The interface for writing custom print verbs and custom formatted I/O routines has also been greatly improved.
∙ The thread library thread(2) has been completely rewritten. The main visible change is that, coupled with the changes to printing, threadprint is gone; you can just use print or fprint at will.
∙ Support for electronic mail has been extended in many ways and now includes some new spam filtering tools, much better (and more standard) handling of MIME messages, the ability to render incoming HTML mail, and much more.
There are so many changes to the programming interfaces of the system that they are described in a separate document, entitled Changes to the Programming Environment in the Fourth Release of Plan 9. Please read it before you start updating your own software to run under the new system.
The installation method has also changed and we’re moving towards a new method for maintaining updates. The Plan 9 Wiki (http://plan9.bell-labs.com/wiki/plan9) and Usenet group (comp.os.plan9) are the places to visit to learn more and stay current. In particular, the installation notes are now maintained in the Wiki; the traditional papers on installation and start-up are gone.
There’s lots more new stuff. If you have problems, mail 9trouble@plan9.bell-labs.com or, better, check the wiki http://plan9.bell-labs.com/wiki/plan9 or ask the Usenet newsgroup comp.os.plan9.
Good Luck!

KDE 4.2 RC Release Announcement

FOR IMMEDIATE PUBLICATIONAlso available in:
KDE 4.2 RC Released for Final Testing
KDE Commmunity Ships Release Candidate of KDE 4.2, codenamed "Cilense"
January 13th, 2009. The KDE Community today announced the immediate availability of "Cilense", (a.k.a KDE 4.2 Release Candidate), the only planned release candidate for the KDE 4.2 desktop. Cilense is aimed at testers and reviewers. It should provide a solid ground to report last-minute bugs that need to be tackled before KDE 4.2.0 is released. Reviewers can use this release candidate to get a first look at the upcoming KDE 4.2 desktop which provides significant improvements all over the desktop and applications. It is not recommended for everyday use, however. KDE 4.2.0 will be released in January, 27th 2009, 6 months after KDE 4.1. KDE 4.2.0 will be followed up by a series of monthly service updates and followed up by KDE 4.3.0 in summer 2009.
The Panel in KDE 4.2
Features and improvements of KDE 4.2 are covered in the 4.2 Beta 2 release announcement.
To find out more about the KDE 4 desktop and applications, please also refer to the KDE 4.1.0 and KDE 4.0.0 release notes.
Installing KDE 4.2 RC Binary Packages
Packagers. Some Linux/UNIX OS vendors have kindly provided binary packages of KDE 4.2 RC, and in other cases community volunteers have done so. Some of these binary packages are available for free download via the KDE 4.2 RC Info Page. Additional binary packages, as well as updates to the packages now available, may become available over the coming weeks.
Package Locations. For a current list of available binary packages of which the KDE Project has been informed, please visit the KDE 4.2 RC Info Page.
Compiling KDE 4.2 RC
The complete source code for KDE 4.1.96 may be freely downloaded. Instructions on compiling and installing KDE 4.1.96 are available from the KDE 4.2 RC Info Page.
About KDE
KDE is an international technology team that creates free and open source software for desktop and portable computing. Among KDE's products are a modern desktop system for Linux and UNIX platforms, comprehensive office productivity and groupware suites and hundreds of software titles in many categories including Internet and web applications, multimedia, entertainment, educational, graphics and software development. KDE software is translated into more than 60 languages and is built with ease of use and modern accessibility principles in mind. KDE4's full-featured applications run natively on Linux, BSD, Solaris, Windows and Mac OS X.
Trademark Notices. KDE® and the K Desktop Environment® logo are registered trademarks of KDE e.V. Linux is a registered trademark of Linus Torvalds. UNIX is a registered trademark of The Open Group in the United States and other countries. All other trademarks and copyrights referred to in this announcement are the property of their respective owners.

2009年1月15日星期四

Push Your Web Design Into The Future With CSS3

There are exciting new features in the pipeline for Cascading Style Sheets that will allow for an explosion of creativity in Web design. These features include CSS styling rules that are being released with the upcoming CSS3 specification. Realistically, you won’t be able to use these on your everyday client projects for another few years, but for design blogs and websites aimed at the Web design community, these features can help you push the boundaries of modern Web design today, adding that extra spice to your design and helping the industry move forward.

Here are five techniques snatched from the future that you can put into practice in your website designs today.

1. Border Radius

CSS border-radius

Probably the most common CSS3 feature currently being used is border-radius. Standard HTML block elements are square-shaped with 90-degree corners. The CSS3 styling rule allows rounded corners to be set.

          -moz-border-radius: 20px;           -webkit-border-radius: 20px;           border-radius: 20px;

Border-radius can also be used to target individual corners, although the syntax for -moz- and -webkit- is slightly different:

          -moz-border-radius-topleft: 20px;           -moz-border-radius-topright: 20px;           -moz-border-radius-bottomleft: 10px;           -moz-border-radius-bottomright: 10px;           -webkit-border-top-right-radius: 20px;           -webkit-border-top-left-radius: 20px;           -webkit-border-bottom-left-radius: 10px;           -webkit-border-bottom-right-radius: 10px;

Supported in Firefox, Safari and Chrome.

As used by: Twitter.

See also:

2. Border Image

CSS border-image

Border-image, as the name suggests, allows an image file to be used as the border of an object. The image is first created in relation to each side of an object, where each side of the image corresponds to a side of the HTML object. This is then implemented with the following syntax:

           border: 5px solid #cccccc;           -webkit-border-image: url(/images/border-image.png) 5 repeat;           -moz-border-image: url(/images/border-image.png) 5 repeat;           border-image: url(/images/border-image.png) 5 repeat;

The {border: 5px} attribute specifies the overall width of the border, and then each border-image rule targets the image file and tells the browser how much of the image to use to fill up that 5px border area.

Border images can also be specified on a per-side basis, allowing for separate images to be used on each of the four sides as well as the four corners:

 border-bottom-right-image  border-bottom-image  border-bottom-left-image  border-left-image     border-top-left-image     border-top-image     border-top-right-image     border-right-image

Supported in Firefox 3.1, Safari and Chrome.

As used by: Blog.SpoonGraphics.

See also:

3. Box Shadow and Text Shadow

CSS Shadow

Drop shadows: don’t you just love them?! They can so easily make or break a design. Now, with CSS3, you don’t even need Photoshop! The usage we’ve seen so far has really added to the design, a good example being this year’s 24 Ways website.

          -webkit-box-shadow: 10px 10px 25px #ccc;           -moz-box-shadow: 10px 10px 25px #ccc;           box-shadow: 10px 10px 25px #ccc;

The first two attributes determine the offset of the shadow in relation to the element, in this case, 10 pixels on the x and y axis. The third attribute sets the level of blurriness of the shadow. And finally, the shadow color is set.

Also, the text-shadow attribute is available for use on textual content:

        text-shadow: 2px 2px 5px #ccc;

Supported in Firefox 3.1, Safari, Chrome (box-shadow only) and Opera (text-shadow only).

As used by: 24 Ways.

See also:

4. Easy Transparency with RGBA and Opacity

CSS Opacity

The use of PNG files in Web design has made transparency a key design feature. Now, an alpha value or opacity rule can be specified directly in the CSS.

        rgba(200, 54, 54, 0.5);         /* example: */         background: rgba(200, 54, 54, 0.5);         /* or */         color: rgba(200, 54, 54, 0.5);

The first three numbers refer to the red, green and blue color channels, and the final value refers to the alpha channel that produces the transparency effect.

Alternatively, with the opacity rule, the color can be specified as usual, with the opacity value set as a separate rule:

          color: #000;           opacity: 0.5;

Supported in Firefox, Safari, Chrome, Opera (opacity) and IE7 (opacity, with fixes).

As used by: 24 Ways (RGBA).

See also:

5. Custom Web Fonts with @Font-Face

CSS font-face

There has always been a set of safe fonts that can be used on the Web, as you know: Arial, Helvetica, Verdana, Georgia, Comic Sans (ahem…), etc. Now the @font-face CSS3 rule allows fonts to be called from an online directory and used to display text in a whole new light. This does bring up issues of copyright, so there are only a handful of specific fonts that can be used for @font-face embedding.

The styling is put into practice like so:

        @font-face {         font-family:'Anivers';         src: url('/images/Anivers.otf') format('opentype');         }

The rest of the font family, containing secondary options, is then called as usual:

        h1 { font-family: ‘Anivers’, Helvetica, Sans-Serif;

Supported in Firefox 3.1, Safari, Opera 10 and IE7 (with lots of fixes: if you are brave enough, you can make font-face work in IE (thanks for heads up, Jon Tan))

As used by: TapTapTap.

See also:

Although CSS3 is still under development, the rules listed here are supported by some browsers right now. Safari in particular has extensive support for these new features. Unfortunately, despite being a top-quality browser, Safari has a relatively low number of users, so it is probably not worthwhile adding extra features solely for this group of users. But with Apple’s Mac computers making their way into everyday life, Safari’s usage is likely to continually increase.

Firefox, on the other hand, now has a considerably large user base. What’s more, the soon-to-be-released Firefox 3.1 has added support for a range of CSS3 features. Assuming that most users of Firefox will update their browsers, there will soon be a large group of users with support for these new styling rules.

Google Chrome was released this year. Based on the WebKit engine, this browser has much of the same support as Safari. While Safari makes up a good proportion of Mac users, Chrome has burst onto the scene, making up a decent proportion of Windows users.

Percentage-wise, the W3’s browser statistics indicate that, as of November 2008, 44.2% of W3School’s users across the Web were browsing with Firefox, 3.1% with Chrome and 2.7% with Safari. That means almost 50% of all Internet users should be able to view these features. Within the Web design community in particular, which is much more conscious of browser choice, the range of users with CSS3 support is much higher, at 73.6% (according to the stats at Blog.SpoonGraphics).

6. The downside

Your website may now have a range of fancy new design features, but there are a few negatives to take into consideration:

  • Internet Explorer: 46% of Internet users won’t see these features, so don’t use them as a crucial part of the design of your website. Make sure that secondary options are in place, such as a standard border in place of border-image and a normal font in place of @font-face. Please notice that Internet Explorer supports @font-face with EOT (more details) since v4 (thanks for heads up, Jon Tan).
  • Invalid style sheets: These CSS3 features have not been released as a final specification. They are currently implemented with tags that target different browsers. This can invalidate your style sheet.
  • Extra CSS markup: Following the last point, having to add a different tag for each browser to specify the same rule, as well as include the standard rule for the final CSS specification, adds a lot of extra code to your CSS markup.
  • Potentially horrific usage: Just as is done with traditional Photoshop filters, the use of these new styling features could result in some eye-wrenching designs. Drop shadows in particular ring warning bells for us; we’re not looking forward to seeing the Marketing Department’s choices with that one!

About the Author

Chris Spooner is a freelance graphic and website designer from the UK. He lives and breathes the topic of design and enjoys keeping up to date with the design industry. Chris also publishes design articles, tutorials and free giveaways on his popular design blog; Blog.SpoonGraphics.

(al)

CWE/SANS TOP 25 Most Dangerous Programming Errors


Experts Announce Agreement on the 25 Most Dangerous Programming Errors - And How to Fix Them
Agreement Will Change How Organizations Buy Software.

Project Manager: Bob Martin, MITRE
Questions: top25@sans.org
PDF PDF For Printing

(January 12, 2009) Today in Washington, DC, experts from more than 30 US and international cyber security organizations jointly released the consensus list of the 25 most dangerous programming errors that lead to security bugs and that enable cyber espionage and cyber crime. Shockingly, most of these errors are not well understood by programmers; their avoidance is not widely taught by computer science programs; and their presence is frequently not tested by organizations developing software for sale.

The impact of these errors is far reaching. Just two of them led to more than 1.5 million web site security breaches during 2008 - and those breaches cascaded onto the computers of people who visited those web sites, turning their computers into zombies.

People and organizations that provided substantive input to the project are listed below. They are among the most respected security experts and they come from leading organizations ranging from Symantec and Microsoft, to DHS's National Cyber Security Division and NSA's Information Assurance Division, to OWASP and the Japanese IPA, to the University of California at Davis and Purdue University. The MITRE and the SANS Institute managed the Top 25 Errors initiative, but the impetus for this project came from the National Security Agency and financial support for MITRE's project engineers came from the US Department of Homeland Security's National Cyber Security Division. The Information Assurance Division at NSA and National Cybersecurity Division at DHS have consistently been the government leaders in working to improve the security of software purchased by the government and by the critical national infrastructure.

What was remarkable about the process was how quickly all the experts came to agreement, despite some heated discussion. "There appears to be broad agreement on the programming errors," says SANS Director, Mason Brown, "Now it is time to fix them. First we need to make sure every programmer knows how to write code that is free of the Top 25 errors, and then we need to make sure every programming team has processes in place to find, fix, or avoid these problems and has the tools needed to verify their code is as free of these errors as automated tools can verify."

The Office of the Director of National Intelligence expressed its support saying, "We believe that integrity of hardware and software products is a critical element of cybersecurity. Creating more secure software is a fundamental aspect of system and network security, given that the federal government and the nation's critical infrastructure depend on commercial products for business operations. The Top 25 is an important component of an overall security initiative for our country. We applaud this effort and encourage the utility of this tool through other venues such as cyber education."

Until now, most guidance focused on the 'vulnerabilities' that result from programming errors. This is helpful. The Top 25, however, focuses on the actual programming errors, made by developers that create the vulnerabilities. As important, the Top 25 web site provides detailed and authoritative information on mitigation. "Now, with the Top 25, we can spend less time working with police after the house has been robbed and instead focus on getting locks on the doors before it happens." said Paul Kurtz, a principal author of the US National Strategy to Secure Cyberspace and executive director of the Software Assurance Forum for Excellence in Code (SAFECode).

What You Will Find In This Announcement:

  • Which People and Organizations Made Substantive Contributions to the Top 25 Errors List?
  • How Will the Top 25 Errors Be Used?
  • How Important Are the Top 25 Errors?
  • What Errors Are Included in the Top 25?
  • Resources to Help Organizations Eliminate The Errors

      Which People and Organizations Made Substantive Contributions to the Top 25 Errors List?

      Robert C. Seacord, CERT
      Pascal Meunier, CERIAS, Purdue University
      Matt Bishop, University of California, Davis
      Kenneth van Wyk, KRvW Associates
      Masato Terada, Information-Technology Promotion Agency (IPA), (Japan)
      Sean Barnum, Cigital, Inc.
      Mahesh Saptarshi and Cassio Goldschmidt, Symantec Corporation
      Adam Hahn, MITRE
      Jeff Williams, Aspect Security
      Carsten Eiram, Secunia
      Josh Drake, iDefense Labs at VeriSign, Inc.
      Chuck Willis, MANDIANT
      Michael Howard, Microsoft
      Bruce Lowenthal, Oracle Corporation
      Mark J. Cox, Red Hat Inc.
      Jacob West, Fortify Software
      Djenana Campara, Hatha Systems
      James Walden, Northern Kentucky University
      Frank Kim, ThinkSec
      Chris Eng and Chris Wysopal, Veracode, Inc.
      Ryan Barnett, Breach Security
      Antonio Fontes, New Access SA, (Switzerland)
      Mark Fioravanti II, Missing Link Security Inc.
      Ketan Vyas, Tata Consultancy Services (TCS)
      Lindsey Cheng, Ian Peters and Tom Burgess, Secured Sciences Group, LLC
      Hardik Parekh and Matthew Coles, RSA - Security Division of EMC Corporation
      Mouse
      Ivan Ristic
      Apple Product Security
      Software Assurance Forum for Excellence in Code (SAFECode)
      Core Security Technologies Inc.
      Depository Trust & Clearing Corporation (DTCC)
      The working group at the first OWASP ESAPI Summit
      National Security Agency (NSA) Information Assurance Division
      Department of Homeland Security (DHS) National Cyber Security Division

      Robert Martin, CWE Project Leader at MITRE heralded the effort of these contributors by saying, "It is gratifying to see the amount of collaboration and energy that all these serious, security-savvy people invested in making this list as accurate and authoritative as it can be. Very impressive!"

      How Will the Top 25 Errors Be Used?

      The Top 25 Errors will have four major impacts:

      • Software buyers will be able to buy much safer software.
      • Programmers will have tools that consistently measure the security of the software they are writing.
      • Colleges will be able to teach secure coding more confidently.
      • Employers will be able to ensure they have programmers who can write more secure code.

      First, software buyers will be able to buy much safer software.

      Buyers will require that software vendors certify in writing that the code they are delivering is free of these 25 programming errors. Certification shifts responsibility to the vendor for correcting the errors and for any damage caused by those errors. The standard procurement language under development by the State of New York and other state governments already is being adjusted to use the Top 25 Errors. Over time the multi-national Common Criteria program may also adopt the Top 25 as one approach for ensuring code purchased by the US government is free of the Top 25 errors.

      Second, programmers will have tools that consistently measure the security of the software they are writing.

      Software testing tools will use the Top 25 in their evaluations and provide scores for the level of secure coding in software being tested. In parallel with this announcement, on January 12, one of the leading software testing vendors is announcing that its software will be able to test for and report on the presence of a large fraction of the Top 25 Errors. Application development teams will use such testing software during the development process.

      Colleges will be able to teach secure coding more confidently.

      Colleges and others who prepare programmers will use the Top 25 Errors as a foundation for curriculum that ensures their students know how to avoid the critical programming errors. One of the colleges that participated in developing the Top 25, UC Davis, has already established a secure coding clinic where student-written software is reviewed for the key programming errors that lead to critical security vulnerabilities. The Top 25 enables the clinic to prioritize errors in its review. Other colleges are beginning to emulate the secure coding clinics.

      Employers will be able to ensure they have programmers who can write more secure code.

      Employers will use the Top 25 Errors list as a guide for evaluating and improving skills of programmers they hire and of outsourced programming talent. More than 100 large employers are already using a common assessment tool called the GSSP (GIAC Secure Software Programmer) to measure secure coding skills. The GSSP exams are being reviewed in an effort to fully incorporate and highlight mastery of programming knowledge needed to find and eliminate or avoid the Top 25. More data on the GSSP may be found at http://www.sans-ssi.org/ and organizations with at least 500 programmers may have up to 100 of those programmers? secure coding skills assessed confidentially and at no cost. Email spa@sans.org to get that started.

      Courses are available that teach secure coding skills to programmers in C/C++, in Java, and in .NET languages. Information at http://www.sans-ssi.org/courses/

      How Important Are the Top 25 Errors?

      We asked several of the participants why they thought this effort was important enough to merit a significant amount of their time and expertise. Here are a few of their answers. More are at the end of the announcement.

      National Security Agency's Information Assurance Directorate
      "The publication of a list of programming errors that enable cyber espionage and cyber crime is an important first step in managing the vulnerability of our networks and technology. There needs to be a move away from reacting to thousands of individual vulnerabilities, and to focus instead on a relatively small number of software flaws that allow vulnerabilities to occur, each with a general root cause. Such a list allows the targeting of improvements in software development practices, tools, and requirements to manage these problems earlier in the life cycle, where they can be solved on a large scale and cost-effectively."
      -Tony Sager, National Security Agency's Information Assurance Directorate
      US Department of Energy:
      "The CWE/SANS Top 25 effort is extremely valuable and will provide many organizations with a tangible way to begin addressing software security problems."
      - Michael Klosterman, SCADA Operations, Western Area Power Association, US Department of Energy
      Depository Trust:
      "The CWE-SANS Top 25 Errors is a vital tool for organizations that believe in a risk-based approach to software security enabling them to assess the specific vulnerabilities identified in their environments compared with a composite perspective of risk from industry recognized experts."
      - Jim Routh, CISO, The Depository Trust & Clearing Corporation
      Microsoft:
      "The 2009 CWE/SANS Top 25 Programming Errors project is a great resource to help software developers identify which security vulnerabilities are the most important to understand, prevent and fix."
      - Michael Howard, Principal Security Program Manager, Security Development Lifecycle Team, Microsoft Corp.
      OWASP Foundation:
      "When facing a huge application portfolio that could contain many thousands of instances of over 700 different types of weaknesses, knowing where to start is a daunting task. Done right, stamping out the CWE Top 25 can not only make you significantly more secure but can cut your software development costs."
      - Jeff Williams, Aspect Security CEO and The OWASP Foundation Chair
      Symantec:
      "The 2009 CWE/SANS Top 25 Programming Errors reflects the kinds of issues we've seen in application software and helps provide us with actionable direction to continuously improve the security of our software."
      - Wesley H. Higaki, Director, Software Assurance, Office of the CTO, Symantec Corporation
      Software Assurance Consortium:
      "As an advocate for the consumer, this is viewed as a giant step forward in providing security for all users. It increases awareness of the various levels of secure software by highlighting its effects on our daily use of all software products. The CWE/SANS Top 25 effort adds the capability to our tool box which in turn aids the SwAC in our mission to bring together Industry and Government to transform the security and dependability of all software products."
      - Dan Wolf, Director, Software Assurance Consortium.
      EMC:
      "The Top 25 List puts a powerful tool into the hands of the programmers along with every person involved in designing and developing software. The simple fact that such a list now exists will allow software assurance to be practiced more effectively."
      - Dan Reddy, Consulting Product Manager, EMC Product Security Office
      Purdue:
      "The CWE Top 25 should be watched because targeting the most troublesome programming mistakes can potentially reduce the occurrence of vulnerabilities and our exposure at a national level, while diminishing our undesirable dependence on patches."
      - Pascal Meunier, CERIAS, Purdue University
      Secunia:
      "This Top 25 is without a doubt one of the most useful compilations of common coding mistakes leading to vulnerabilities in software. The list, which has been created based on feedback from many experts in the security industry, focuses on selection criteria like severity and prevalence, thus covering a broad range of the most critical errors commonly introduced in applications today. The Top 25 is compiled in a easy-to-read and entertaining language and does not only provide a good understanding of common coding mistakes, but also how to avoid them. I can therefore highly recommend this read to anyone involved in software design to ensure that they won't make the same mistakes in 2009 as they've made previously."
      - Carsten Eiram, Chief Security Specialist, Secunia.
      Ken van Wyk:
      "This list of programming errors should be enormously useful to the community. It serves to help us all get our collective "arms around" understanding the most common security defects in our code, just as the OWASP Top 10 helps us understand the attacks against those defects."
      - Kenneth R. van Wyk, KRvW Associates, LLC
      Veracode:
      "A prioritized list of security issues is the starting point to make software security practical in the business world of resource constraints and ship dates. The Top 25 list gives developers a minimum set of coding errors that must be eradicated before software is used by customers."
      - Chris Wysopal, Co-Founder and CTO of Veracode, Inc.
      Core Security Technologies:
      "This is the first serious attempt at building a taxonomy of software security weaknesses and flaws with an emphasis on the practical application of identifying, preventing and fixing or mitigating the issues they pose. It is a necessary and long overdue step towards creating a common language for the software development and security communities in need of a more rational way to address what are currently the most urgent and relevant software security problems."
      - Ivan Arce, CTO of Core Security Technologies Inc.
      Breach Security:
      "The CWE/SANS Top 25 List is an excellent tactical resource for organizations to prioritize and remediate the root causes of today's successful attacks. This should be required reading for all developers as it is a "Cliff Notes" version of essential secure coding principles."
      - Ryan C. Barnett, Director of Application Security Research, Breach Security
      McAfee:
      "The 2009 CWE/SANS Top 25 Programming Errors effort is right on target. By educating software developers on the most important issues and showing them how to avoid writing security bugs, this effort will help programmers correct code issues before they become security problems."
      - Kent Landfield, Director, Risk and Compliance Security Research, McAfee, Inc.
      Ounce Lab:
      "Let's use this list as a way to jumpstart the solutions - make 2009 a year to make things happen and solve these problems that have been around way too long. Far too many solutions exist out there to help address these all-too-common errors. Start using this list to secure your software today because if the last few years have been any indication, tomorrow is already too late."
      - Ryan Berg, Co-Founder and Chief Scientist, Ounce Labs
      Grammatech:
      "Bugs in software are a plague on our profession and bad for business. They are inevitable, yet understanding of which bugs are most important is often gained the hard and expensive way when they show up in the field. The CWE/SANS Top 25 effort will raise awareness of the huge variety of different kinds of defects that can occur, and will help programmers focus on those that matter most to application quality and security."
      - Paul Anderson - Vice President of Engineering, Grammatech Inc.

      What Errors Are Included in the Top 25?

      The Top 25 Errors are listed below in three categories:

      Clicking "MORE" in any of the listings takes you to the relevant spot in the MITRE CWE site where you will find the following:

      • links to the full CWE entry data,
      • data fields for weakness prevalence and consequences,
      • remediation cost,
      • ease of detection,
      • attack frequency and attacker awareness
      • related CWE entries
      • related patterns of attack for this weakness.

      Each entry at the Top 25 Errors site also includes fairly extensive prevention and remediation steps that developers can take to mitigate or eliminate the weakness.

      CATEGORY: Insecure Interaction Between Components

      CWE-20: Improper Input Validation

      It's the number one killer of healthy software, so you're just asking for trouble if you don't ensure that your input conforms to expectations...MORE >>

      CWE-116: Improper Encoding or Escaping of Output

      Computers have a strange habit of doing what you say, not what you mean. Insufficient output encoding is the often-ignored sibling to poor input validation, but it is at the root of most injection-based attacks, which are all the rage these days...MORE >>

      CWE-89: Failure to Preserve SQL Query Structure (aka 'SQL Injection')

      If attackers can influence the SQL that you use to communicate with your database, then they can...MORE >>

      CWE-79: Failure to Preserve Web Page Structure (aka 'Cross-site Scripting')

      Cross-site scripting (XSS) is one of the most prevalent, obstinate, and dangerous vulnerabilities in web applications...If you're not careful, attackers can...MORE >>

      CWE-78: Failure to Preserve OS Command Structure (aka 'OS Command Injection')

      When you invoke another program on the operating system, but you allow untrusted inputs to be fed into the command string that you generate for executing the program, then you are inviting attackers...MORE >>

      CWE-319: Cleartext Transmission of Sensitive Information

      If your software sends sensitive information across a network, such as private data or authentication credentials, that information crosses many...MORE >>

      CWE-352: Cross-Site Request Forgery (CSRF)

      With cross-site request forgery, the attacker gets the victim to activate a request that goes to your site. Thanks to scripting and the way the web works in general, the victim...MORE >>

      CWE-362: Race Condition

      Attackers will consciously look to exploit race conditions to cause chaos or get your application to cough up something valuable...MORE >>

      CWE-209: Error Message Information Leak

      If you use chatty error messages, then they could disclose secrets to any attacker who dares to misuse your software. The secrets could cover a wide range of valuable data...MORE >>

      CATEGORY: Risky Resource Management

      CWE-119: Failure to Constrain Operations within the Bounds of a Memory Buffer

      Buffer overflows are Mother Nature's little reminder of that law of physics that says if you try to put more stuff into a container than it can hold, you're...MORE >>

      CWE-642: External Control of Critical State Data

      There are many ways to store user state data without the overhead of a database. Unfortunately, if you store that data in a place where an attacker can...MORE >>

      CWE-73: External Control of File Name or Path

      When you use an outsider's input while constructing a filename, you're taking a chance. If you're not careful, an attacker could... MORE >>

      CWE-426: Untrusted Search Path

      If a resource search path is under attacker control, then the attacker can modify it to point to resources of the attacker's choosing. This causes the software to access the wrong resources at the wrong time...MORE >>

      CWE-94: Failure to Control Generation of Code (aka 'Code Injection')

      For ease of development, sometimes you can't beat using a couple lines of code to employ lots of functionality. It's even cooler when...MORE >>

      CWE-494: Download of Code Without Integrity Check

      You don't need to be a guru to realize that if you download code and execute it, you're trusting that the source of that code isn't malicious. But attackers can perform all sorts of tricks...MORE >>

      CWE-404: Improper Resource Shutdown or Release

      When your precious system resources have reached their end-of-life, you need to...MORE >>

      CWE-665: Improper Initialization

      Just as you should start your day with a healthy breakfast, proper initialization helps to ensure...MORE >>

      CWE-682: Incorrect Calculation

      When attackers have some control over the inputs that are used in numeric calculations, this weakness can lead to vulnerabilities. It could cause you to make incorrect security decisions. It might cause you to...MORE >>

      CATEGORY: Porous Defenses

      CWE-285: Improper Access Control (Authorization)

      If you don't ensure that your software's users are only doing what they're allowed to, then attackers will try to exploit your improper authorization and...MORE >>

      CWE-327: Use of a Broken or Risky Cryptographic Algorithm

      You may be tempted to develop your own encryption scheme in the hopes of making it difficult for attackers to crack. This kind of grow-your-own cryptography is a welcome sight to attackers...MORE >>

      CWE-259: Hard-Coded Password

      Hard-coding a secret account and password into your software's authentication module is...MORE >>

      CWE-732: Insecure Permission Assignment for Critical Resource

      If you have critical programs, data stores, or configuration files with permissions that make your resources accessible to the world - well, that's just what they'll become...MORE >>

      CWE-330: Use of Insufficiently Random Values

      If you use security features that require good randomness, but you don't provide it, then you'll have attackers laughing all the way to the bank...MORE >>

      CWE-250: Execution with Unnecessary Privileges

      Spider Man, the well-known comic superhero, lives by the motto "With great power comes great responsibility." Your software may need special privileges to perform certain operations, but wielding those privileges longer than necessary can be extremely risky...MORE >>

      CWE-602: Client-Side Enforcement of Server-Side Security

      Remember that underneath that fancy GUI, it's just code. Attackers can reverse engineer your client and write their own custom clients that leave out certain inconvenient features like all those pesky security controls...MORE >>

      Resources to Help Eliminate The Top 25 Errors

      The TOP 25 Errors List will be updated regularly and will be posted at both the SANS and MITRE sites
      www.sans.org/top25
      cwe.mitre.org/top25/

      MITRE maintains the CWE (Common Weakness Enumeration) web site, with the support of the US Department of Homeland Security's National Cyber Security Division, presenting detailed descriptions of the top 25 programming errors along with authoritative guidance for mitigating and avoiding them. That site also contains data on more than 700 additional programming errors, design errors and architecture errors that can lead to exploitable vulnerabilities. cwe.mitre.org/

      SANS maintains a series of assessments of secure coding skills in three languages along with certification exams that allow programmers to determine gaps in their knowledge of secure coding and allows buyers to ensure outsourced programmers have sufficient programming skills. Organizations with more than 500 programmers can assess the secure coding skills of up to 100 programmers at no cost.
      Email spa@sans.org for details
      And see www.sans-ssi.org/certification/ for the GSSP Blueprints

      SAFECode - The Software Assurance Forum for Excellence in Code (members include EMC, Juniper, Microsoft, Nokia, SAP and Symantec) has produced two excellent publications outlining industry best practices for software assurance and providing practical advice for implementing proven methods for secure software development.
      http://www.safecode.org/publications/SAFECode_BestPractices0208.pdf http://www.safecode.org/publications/SAFECode_Dev_Practices1108.pdf

      Nearly a dozen software companies offer automated tools that test programs for these errors. SANS maintains case studies of user experience with these and other security tools at www.sans.org/whatworks.

      New York State has produced draft procurement standards to allow companies to buy software with security baked in.

      Draft New York State procurement language will be posted at www.sans.org/appseccontract.

      For additional information on any of these:
      SANS: Mason Brown, mbrown@sans.org
      MITRE: Bob Martin, ramartin@mitre.org
      MITRE: Steve Christey, coley@mitre.org


    • Contact us: (301) 654-SANS(7267)
      Monday - Friday 9am-8pm EST/EDT