Recently in Software Quality Category

Lessons from a lost Kindle

| No Comments
| More
Two days ago I left my Kindle 3G somewhere - probably in the pub or or the train - and of course it is most likely now gone for good. 

We hear a lot about IT consumerisation, and the biggest issue with the Kindle, apart from the loss of the actual device, is that it is connected to a credit card thanks Amazon's One-Click purchase feature. So someone finding my Kindle, would instantly be able to start buying ebooks on my credit card.

Fortunately, Amazon provides two ways to prevent this. First, through the Manage your Kindle portal, it is possible to deregister the device. Second, by calling Amazon (it's 08445456508 in the UK), Amazon can block the device completely, stopping it from being reregisterd under a different account. Amazon customer service then sends a confirmation email:

Hello xxxx,

I'm sorry to hear that your Kindle was lost. I've deregistered this Kindle from your account and noted this in our systems so that it can't be registered by another person. 

Your Kindle's Serial Number is: xxxxxxxxxx. If you find your Kindle, please contact us again and we can reinstate your registration.


I have now downloaded the Kindle app from the Android Marketplace - and while the screen is rubbish compared to E.Ink on the Kindle, I have full access to my library of books - which is quite amazing really.

So here's the lesson: the Kindle is only valuable because of the books (ie content)  that are installed. Once the Kindle is deregistered and blocked, the hardware is actually worthless (good luck to any hacker willing to take it apart and install a new OS). The Kindle is essentially a one application thin client that connects wirelessly to the Amazon bookstore.People will inevitable ask why such devices exist because the new iPad can do everything. But it just goes to show how a simple operating environment can be locked down and secured, reducing data theft should the device be lost or stolen.

Video: code quality

| No Comments
| More
Matt Peachey, vice president, Emea, Veracode - says eight out of 10 applications will be insecure. In this video he discusses why developers do not relate security to code quality. Peachey believes it is not just in-house code that may be insecure...do not trust suppliers. "You need to hold suppliers accountable.," he adds. "Do not assume that the software you buy from third parties is secure. It probably is not secure."


He says, "Organisations do not insist an application is secure - they should push this responsibility down to their suppliers"

Companies are poor at measuring quality. "How do you know you are getting better over time."

Enhanced by Zemanta

Cern video: The quality Root

| No Comments
| More

The Large Hadron Collider (LHC) needs sophisticated software to analyse the massive amounts of data the experiment generates.

Root is 2.5 million lines of C++, which offers a data analysis framework used by physicists working on the LHC experiment. I recently spoke to Axel Naumann, who works as part of the six-person team, developing Root for 10,000 users worldwide.

 

Video: Why won't applications run on a hypervisor?

| No Comments
| More

I spoke to Greg Lambert, chier fechnical architect at ChangeBase, about application comaptibility. Compatibility is not only about getting things to work on Windows. Hypervisors can also pose app compatibility issues. And, as I mentioned in recent posts, browsers like IE9  can also present problems.

 

Video booth: Ed Amoroso calls for software developers to raise their game

| No Comments
| More
I recently asked Ed Amoroso, chief security officer at AT&T about what kept him awake at night. He says software produced by the best developers using the very best tools still produces vulnerability. Ed wants to see software developement becomes more of an engineering profession. He says:

Over the next 20 years, software engineers will become much more formal, so we can depend on developers to produce code that is resilient to cyber attack."

Microsoft Patch Tuesday Update - 14th December 2010

| No Comments
| More

With this week's Microsoft Patch Tuesday update, we see the largest collection of updates ever delivered by Microsoft in a single Patch Tuesday release with 17 updates having the following rating; 2 Critical, 14 Important and 1 Moderate. Aside from the significant number of Security and Application updates with this Patch Tuesday release cycle, we see a moderate number of issues affecting a small number of applications. The ChangeBASE team recommends a particular focus on the Microsoft Security Update MS10-106 as it raised a significant number of issues on the AOK sample server platform portfolio.

Here is a sample of the results for one application and a summary of the Patch Tuesday results for one of our AOK Sample databases:


MS10-105 Vulnerabilities in Microsoft Office Graphics Filters Could Allow for Remote Code Execution
Patch Tuesday - image 1.JPG


And here is a sample AOK Summary report for a sample database where the AOK Patch Impact team has run the latest Microsoft Updates against a small application portfolio:


Patch Tuesday - image 2.JPG


You can read a full analysis of the AOK Patch Impact Testing Summary here.




Windows 7: 12 Months On

| 2 Comments
| More

The 22nd of October 2009 represented one of the most eagerly anticipated dates in the history of desktop computing. The launch of Windows 7 promised easier, faster and more secure computing for all. And, boy oh boy, did Windows 7 deliver.

Over the past 12 months, we've worked with more than 200 global organisations to assist them in their Windows 7 migrations and during this time, we've started to see a number of emerging trends.

To celebrate the anniversary of Windows 7, we've put together a brief report, which you can request a copy of here. In the report we look at the emerging application compatibility trends, the primary issues and give some suggestions on how organisations can best approach their Windows 7 migration.

Over the past 12 months I experienced a number of situations with organisations that have made me really think again. Here is a quick synopsis of those surprises:

  • Windows 7 adoption rates have been higher than expected, which has been led by 64-bit as the primary delivery platform.
  • The introduction of IE8 has added another layer of complexity into the migration. Organisations need to address compatibility issues for core web applications and browser presentation and rendering issues for internal and external websites and portals.
  • Virtualisation has not been embraced as quickly as expected and organisations are looking towards a hybrid model of virtualised platforms to suit application capabilities
  • Windows 7 migration is easier than previous migrations, such as XP to Vista
  • Shims are not the answer to application compatibility issues
  • You need a level of technical expertise to fully use Microsoft's application compatibility issue fixes

And, as you have probably seen already, we are still seeing the same top five application compatibility issues across all verticals and industry sectors including:

Windows 7 - 12 months on.JPG

So, now that Windows 7 is a year old, has it met market expectations? In my view, Windows 7 has been a great success, with a rapid adoption rate, good industry acceptance, a stable OS, a small number of resolvable issues and it delivers some great benefits such as increased security.

Given these factors and our experience to date, we estimate that at least 60% of global organisations will have fully deployed Windows 7 in the next three years.

Microsoft Patch Tuesday - 12th October 2010

| No Comments
| More

Application Compatibility Update

With this Microsoft Patch Tuesday update, we see the largest collection of updates ever delivered by Microsoft in a single Patch Tuesday release. In total, there are 16 updates with the following rating; 2 Critical, 12 Important and 2 Moderate. Aside from the significant number of Security and Application updates with this Patch Tuesday release cycle, we also see a significant number of applications dependent on this large tranche of changes. The ChangeBase team recommends that the testing cycle for these particular releases is especially thorough due to application dependencies on almost all of the security patches included in this release. Given the nature of the changes and updates included in each of these patches, most systems will require a reboot to successfully implement any and all of the patches and updates released in this October Patch Tuesday release cycle.

Here is a sample of the results for one application and a summary of the Patch Tuesday results for one of our AOK Sample databases.

MS10-074: Vulnerability in Microsoft Foundation Classes Could Allow Remote Code Execution.

Patch Tuesday - image1.JPG

Testing Summary
Patch Tuesday - image2.JPG

Patch Tuesday - image3.JPG
Patch Tuesday - image4.JPG

Security Update - Detailed Summary
Patch Tuesday - image5.JPG

Patch Tuesday - image6.JPG

Patch Tuesday - image7.JPG

Patch Tuesday - image8.JPG

Patch Tuesday - image9.JPG

Patch Tuesday - image10.JPG

Patch Tuesday - image11.JPG

Patch Tuesday - image12.JPG

*All results are based on an AOK Application Compatibility Lab's test portfolio of over 1,000 applications.





Microsoft Patch Tuesday - 15th September 2010

| No Comments
| More

The month of September sees nine Security bulletin updates that tackle a total of 13 vulnerabilities for Windows, Microsoft Office and Internet Explorer. With these nine updates, we see four rated as Critical and the remaining five updates rated as Important. We have included a sample screen-shot from the ChangeBASE AOK Workbench application that depicts one of the issues raised by one these Microsoft patches:


MS10-0063: Vulnerability in Unicode Scripts Processor Could Allow Remote Code Execution 

Image1.JPG

Testing Summary

Image2.JPG


Image3.JPG


Security Update Detailed Summary

Image4.JPG

Image7.JPG

Image8.JPG

Image9.JPG

Image10.JPG



August Patch Tuesday - a busy time for the deployment team

| No Comments
| More
Within the next 24 hours we'll get to see the latest security patch update from Microsoft. Those who find these notifications of use will already know that this month, August, is going to be a big one. Looking at the list of 14 security patches that are due to be released tomorrow, there's going to be a lot of companies that will need to do a lot of work if they are to ensure they maintain their stringent levels of security and avoid opening up the gates of vulnerability.

 

What's interesting to me is the fact that eight out of the 14 patches are ranked as critical. This further highlights the need for companies to be extra vigilant during the holiday session. Once again this is an area which organisations can't avoid or be complacent about. It will be all hands to the pump on Wednesday and we'll be issuing the ChangeBASE AOK Patch report as usual to highlight any application compatibility issues that the updates might cause.

About this Archive

This page is a archive of recent entries in the Software Quality category.

Software Choices is the previous category.

The next big thing is the next category.

Find recent content on the main index or look in the archives to find all content.

Archives

Category Archives

 

-- Advertisement --