Security: A proactive approach to more secure code (MSRC, article)

Security starts at the coding activity... See he quote:

A proactive approach to more secure code – Microsoft Security Response Center

Quoting:

"Since 2004, the Microsoft Security Response Centre (MSRC) has triaged every reported Microsoft security vulnerability. From all that triage one astonishing fact sticks out: as Matt Miller discussed in his 2019 presentation at BlueHat IL, the majority of vulnerabilities fixed and with a CVE assigned are caused by developers inadvertently inserting memory corruption bugs into their C and C++ code. As Microsoft increases its code base and uses more Open Source Software in its code, this problem isn’t getting better, it’s getting worse. And Microsoft isn’t the only one exposed to memory corruption bugs—those are just the ones that come to MSRC."

The PDF presentation can be found here:

https://github.com/microsoft/MSRC-Security-Research/raw/master/presentations/2019_02_BlueHatIL/2019_01%20-%20BlueHatIL%20-%20Trends%2C%20challenge%2C%20and%20shifts%20in%20software%20vulnerability%20mitigation.pdf

Wed applications: web beacons what?

Ok cookies could be problematic enough so that some persons block them. Now, what about web beacons?...

Quoting a MS term of use:
"(...) [We use] web beacons or similar technologies from third-party analytics providers, which help us compile aggregated statistics about the effectiveness of our promotional campaigns or other operations. These technologies enable the analytics providers to set or read their own cookies or other identifiers on your device, through which they can collect information about your online activities across applications, websites or other products. However, we prohibit these analytics providers from using web beacons on our sites to collect or access information that directly identifies you (such as your name or email address). You can opt out of data collection or use by some of these analytics providers by clicking the following links:

• AppsFlyer: www.appsflyer.com/optout (https://www.appsflyer.com/optout)

• Flurry Analytics: https://aim.yahoo.com/aim/us/en/optout/ (https://aim.yahoo.com/aim/us/en/optout/)

• Google Analytics: tools.google.com/dlpage/gaoptout (http://tools.google.com/dlpage/gaoptout) (requires you to install a browser add-on)

• Kissmetrics: kissmetrics.com/user-privacy (https://kissmetrics.com/user-privacy)

• Mixpanel: mixpanel.com/optout (https://mixpanel.com/optout)

• Nielsen: www.nielsen-online.com/corp.jsp?section=leg_prs&nav=1#Optoutchoices (http://www.nielsen-online.com/corp.jsp?section=leg_prs&nav=1#Optoutchoices)

• Omniture (Adobe): www.d1.sc.omtrdc.net/optout.html (http://www.d1.sc.omtrdc.net/optout.html)

• Visible Measures: www.visiblemeasures.com/viewer-settings-opt-out (http://www.visiblemeasures.com/viewer-settings-opt-out)

• WebTrends: ondemand.webtrends.com/support/optout.asp (https://ondemand.webtrends.com/support/optout.asp) "

Quoting wikpedia (link above): 

"A web beacon or web bug is one of the various techniques used on web pages or email, to unobtrusively (usually invisibly) allow checking that a user has accessed some content. Common uses are email tracking and page tagging for web analytics. Alternative names are tracking bug, tag, or page tag, tracking pixel, pixel tag, 1×1 gif, and clear gif. When implemented using JavaScript, they may be called JavaScript tags."

SW Development: Apple Revamps SW Development Lifecycle...

... after the problems with iOS11:
https://www.extremetech.com/computing/263795-apple-plans-revamp-software-development-cycle-adopt-slower-cadences

Quoting:
"Former Microsoft developer and head of Windows 7 and Windows 8 development, Steven Sinofsky, has published his own thoughts on the topic, and we recommend giving his article a read. One of the points Sinofsky makes is that Apple has, over the last decade, created an ecosystem that saw it go from a small phone vendor to a major player. It took an OS originally developed to run on the NeXT workstation, ported that OS to PowerPC, then to the x86 architecture, and finally to ARM. It ramped up its own CPU development team and now leads the mobile market in ARM single-threaded performance. It has done all this while simultaneously iterating on iOS, year after year.

As Sinofsky points out, we tend to talk about development as if its three goals — the so-called “iron triangle” of quality of release, pace of change, and the adding of new features — exist in a zero-sum game. It is, to be sure, much more difficult to develop solutions that balance all three of these requirements than to focus unilaterally on just one of them. But this is a balancing act that Apple has been performing fairly well for a decade, across an ecosystem Sinofsky considers without peer, save possibly for that of IBM and its System/360. The idea that companies choose one, and only one of these criteria to focus on is something he dismisses (...)"

Reuse: Statistical Data Processing

When in need of statistical data analysis, we will need to implement or reuse system components into our system.
Microsoft has been making available the (free until a certain point) open-source R statistical programming language (and servers):
http://www.infoworld.com/article/3156544/big-data/microsofts-r-tools-bring-data-science-to-the-masses.html


Quoting (the article focus on a new MS acquisition but provides us with an overview of the R programming language and the Development environment to support developers and Data Scientists):


"One of Microsoft’s more interesting recent acquisitions was Revolution Analytics, a company that built tools for working with big data problems using the open source statistical programming language R. Mixing an open source model with commercial tools, Revolution Analytics offered a range of tools supporting academic and personal use, alongside software that took advantage of massive amounts of data–including Hadoop. Under Microsoft’s stewardship, the now-renamed R Server has become a bridge between on-premises and cloud data.
Two years on, Microsoft has announced a set of major updates to its R tools. The R programming language has become an important part of its data strategy, with support in Azure and SQL Server—and, more important, in its Azure Machine Learning service, where it can be used to preprocess data before delivering it to a machine learning pipeline. It’s also one of Microsoft’s key cross-platform server products, with versions for both Red Hat Linux and Suse Linux." 

SW Construction: MVC Design Patterns (and related patterns | .Net)

Here are some MVVM, ASP.Net MVC resources, with something for the ones liking it on a video format:

ASP.Net MVC (Model-View-Controller):

• What is (the original GOF pattern): https://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93controller
• ...And the MS (open source) implementation: https://en.wikipedia.org/wiki/ASP.NET_MVC
• https://www.asp.net/mvc (the MS MVC site)
• https://channel9.msdn.com/Series/Introduction-to-ASP-NET-MVC
• https://mva.microsoft.com/en-us/training-courses/introduction-to-asp-net-mvc-8322?l=nKZwZ8Zy_3504984382

MVVM (Model-View-View-Model):

• What is: https://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93viewmodel
• http://www.learnmvvm.com/
• https://channel9.msdn.com/Search?term=mvvm#ch9Search&lang-en=en (all MVVM videos from Channel 9)

MVP (Model View Presenter):

• What is: https://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93presenter
• https://channel9.msdn.com/Search?term=model%20view%20presenter%20#lang-en=en&ch9Search (not much here around)

Remember to keep on checking the Channel 9 Videos as well as the Microsoft Virtual Academy.

The Biggest Software Flops of All Time - PCMag.com

Right on topic, one interesting feature from the PC Magazine site (Slideshow):

The Biggest Software Flops of All Time - Slideshow from PCMag.com

PS. Have [NOT] fun!

Quoting:
"Software is a funny thing. You can't touch it, but you can certainly pay for it. It weighs nothing, but takes dozens or even hundreds of people to make. And sometimes it just doesn't work out.

No matter how detailed your specs, how solid your market research, and how optimized your code, there are always winners and losers. Sometimes a competitor comes to market with something better. Sometimes unforeseen circumstances make your program useless or outdated. And sometimes you just screw things up to a point that no amount of patching can fix it.

In this feature, we'll crawl through the annals of computing history to showcase 10 software releases that went horribly wrong. Some of the biggest names in the industry show up here—Apple and Microsoft are both well-represented—which proves that there's always a second chance. And a third and a fourth if you play your cards right. For some of the other development houses on this list, though, their software flops sounded the death knell for their businesses."

BOOK: Introducing MS Power BI (Free PDF)

MS and the data visualization scene: Free interesting stuff - The Power BI tool and a free e-book available for download from the Microsoft site (google for it or use the link provided in the following blog article).

The long story:
https://blogs.msdn.microsoft.com/education/2016/06/17/getting-started-with-power-bia-free-e-book-from-microsoft-press/

Certifications Paths - Development (Examples)

Think "Development" (we could be talking of "Project Management" and related disciplines).

1. First: Choose what language / platform you want to focus: .Net / MS Technologies? Java? Front-end development? Database? Backend development (including database and/or other persistence means)?
2. Check the relevant entities providing certifications. 
3. Choose/plan carefully your certification path,
4. Start taking the courses (most of them are remote, or can be substitute / sped up by buying the right book)
5. Propose yourself to the certification exams (so that you can add them to your CV and linkedin profiles). Most exams can now be taken online. There are exams fees (fees vary greatly, starting from a few hundred dollars to... - check if your current company helps you on this or not).
6. After successful completion: Update your CVs and your professional profiles. 
7. If you chose well, new job proposals will be coming under way. Do not miss them. 

Examples of certification roadmaps (for Enterprise Application Frameworks):

• Microsoft (includes .Net): https://msdnshared.blob.core.windows.net/media/2016/01/Microsoft_CertRoadmap_Commercial_Dec20162.pdf
• Oracle (includes Java EE): https://education.oracle.com/education/pdf/OracleCertificationProgramDescription.pdf

TOOLS: Intermission: Mouse without borders

In this intermission I give you: "Mouse without borders". To be more exact it's Microsoft that gives you the utility for free here:

https://www.microsoft.com/en-us/download/details.aspx?id=35460

Grab it while you can (not that I believe that it will stop being free).

To Install and Configure it

You only need to download the utility on 2 computers, run (your favorite AV and then run) the setup; use the host name and software-generated key (that you'll have to write down in the second computer); after that the master computer performs a quick location config (so that "the mouse knows where to go").

What's it good for?

This is a productivity tool that allows you sharing a same mouse (and keyboard) in several computers without having to be switching between those hardware devices.
You just need to say where the other computers are (physically, in relation to the "master computer") and the mouse will move there (without borders). The tool will allow you also to copy text (and files!) easily between (up to) 4 computers. 

It's useful for some of these scenarios: 

- Testing (if you record results on a system and you need to test interactively on another). Grab text from that error on one place and paste it on the place you have the test management tool. Precious time saving.

- Programming: when you need to deploy files on servers or other Windows boxes.

- Whenever you have 2 PCs on your desk and you need to frequently change from one to another.

- (fill in your scenarios here). 

AOB

Another tool that works well is Synergy (and this is cross-platform).

(2016-04-21: Rephrases; added cross platform info)

BOOK: Xamarin (Charles Petzold) | Free

https://blogs.msdn.microsoft.com/microsoft_press/2016/03/31/free-ebook-creating-mobile-apps-with-xamarin-forms/

Quoting:
"Microsoft Press, in cooperation with Xamarin, is pleased to publish a new ebook by legendary author Charles Petzold: Creating Mobile Apps with Xamarin.Forms: Cross-platform C# programming for iOS, Android, and Windows."

Free PDF here: http://aka.ms/xamebook