Mar 31, 2006

Webcast on Design Principles

Thanks for attending the Webcast today. For those of you have attended the webcast, you can send the answers to
 
If you have any questions on the issues discussed today, please drop them on this blog, and I will try and answer them to best of my ability.
 
Thanks for taking out your time for the webcast today, hope to see you again same time, same day, next week!

Mar 30, 2006

Astrology and The Solar Eclipse Yesterday

Yesterday was the first Solar Eclipse of the year. The attached pic, courtsey APOD, captures the phenomenon beautifully.

 

"The track of totality for the first solar eclipse of 2006 began early yesterday on the east coast of Brazil and ended half a world away at sunset in western Mongolia. In between, the shadow of the Moon crossed the Atlantic Ocean, northern Africa, and central Asia, and so came for a moment to the small Greek island of Kastelorizo in the eastern Aegean. Astronomer Anthony Ayiomamitis reports that the islanders and many eclipse-watching visitors were indeed treated to an inspiring display of the beautiful solar corona as totality lasted about three minutes. As the total phase of the eclipse ended, he was able to capture this striking "diamond ring" image. In it, the first rays of sunlight shining through edge-on lunar valleys create the fleeting appearance of glistening diamonds set in a bright ring around the Moon's silhouette."

 

In India, the eclipse was parital. But our superstition was in its full glory. Newspapers carried advise for pregnant women to not go outside during the eclipse to avoid having a blind baby or one with a cleft lip, asked people to throw food cooked before the eclipse since it would become impure, and warned that those holding a knife or axe during the eclipse would cut themselves. A TV News channel linked horoscopes to solar eclipse superstitions.

 

Note that these are newspapers and News channels, whose job, I would imagine, is to report fact and not entertain. One would expect them to dispel such superstition and educate the masses. But no, such stories get attention, and that means ad-revenue. That's why the daily horoscope is still one of the most popular columns in any newspaper, and carried by all newspapers and TV channels. Worse, even educated people seem to believe in it. One of my close friends, an ace programmer with a razor sharp mind, is a keen practitioner of astrology. I keep asking him how such far off objects could potentially exert an influence on my body. The answer is typically about gravity: it causes tides in fluids, and the human body is 70% water. There is a gravitational tug exerted by all these objects, and that's how they influence us. This is about where we have gotten our discussion to, so far. One of these days, I hope to have a long chat with him and find out why he has a belief in astrology. Somewhere it has to do with plain faith and belief in the empirical evidence, not gravity.

 

 

But how did astrology come into being? One can imagine how the ancient man, sleeping under a clear sky, not covered with the haze of smoke and electric light, would have been fascinated with the movement of the stars and the planets. It is natural for him to think of those objects as having divine powers, influencing us. Continued observation would have led him to associate certain phenomena with the movement of these objects. Once you have faith in a certain association, your mind invents evidence where there is none. Why, even as late as 20th century we had Sir Arthur Edington performing an experiment during the solar eclipse in Brazil and West Africa to measure the deflection of light as predicted by the General Theory of Relativity, and found the measurement to be true to the theoretical prediction. Later, it was found that the error in the instrumentation was higher than the measurement actual, rendering the experiment useless. A classic case of the experimenter finding the evidence he was looking for. (It was only fifty years later that we had experimental proof of the GTR which has since been proven true over and over again.) The human mind loves the mystical for some reason. And to invent evidence is easy. Especially on something as immeasurable as human behavior. It is this aspect of the human nature which has led to Astrology, and its continued survival in this age of the Hubble Telescope.

 

I am not against astrology per se. It is entertaining and interesting, especially in the context of its impact on human history and social evolution. What I am against is its acceptance as a science and being used as a basis for taking decisions. In this sense, it is no better than a Crystall Ball - utterly useless.

 

However, at times, astrology has been put to good use. Four hundred years ago, Johannes Kepler (who gave us the laws of planetary motion and observed the last supernova) used to fund his astromony by practising astrology as a day-job.  He once described astrology as "Astronomy's wanton little sister, who goes out and sells herself so that older, wiser sister may keep her Virtue." Thankfully today, an astronomer does not have to resort to astrology to finance his scientific pursuits. But it is sad that our media still needs money badly enough to earn it by such dubious means.

 

Mar 24, 2006

Common Mistakes Webcast

Thanks for attending the Webcast today. I realized some of us faced problems in viewing the slides. We will put up the slides and the recording shortly on the webcasts page.

 

I will also put the security webcasts quiz on this blog in another post shortly. You can send the answers to

 

If you have any questions on the issues discussed today, please drop them on this blog, and I will try and answer them to best of my ability.

 

Thanks for taking out your time for the webcast today, hope to see you again same time, same day, next week!

 

 

Mar 23, 2006

The Inflating Universe

Check out the photograph below. This is from http://antwrp.gsfc.nasa.gov/apod/ap060323.html

 

"Schematically, this diagram traces the 13.7 billion year (plus a trillionth of a second ...) history of the Universe from the quantum scale to the formation of stars, galaxies, planets, and WMAP."

 

Wow!

 

 

 

 

Mar 22, 2006

Web Platform Roadshow Ppts

The ppts for the Web Platform Roadshow held in Feb are now available at http://www.microsoft.com/india/msdn/events/presentations.aspx#February_2006. 

 

The feedback we got from this show was really great. Almost everybody appreciated all the sessions. The feedback ratings on my sessions was 7.7 / 9 on average, which is remarkably high. And guess what, we had about 2000 attendees for the web-platform sessions, which is only second to TechEd. Overall, a very satisfying event.

 

Thanks to all those who took out time to join us!

 

Webcast Ppt Available

The ppt for the webcast we did on Input Trust Issues is now available at http://www.microsoft.com/india/webcasts/ 

 

BTW, the response for the webcast last week was phenomenal - we had over 180 attendees on the call. For the webcast on Fri, the number of registrations has already gone beyond 600!

 

Given the feedback last time, we are making a couple of changes to the webcast page: putting up a manual on live-meeting, and an app for submitting quiz answers. The team is working hard at it, let's hope this gets live before the Fri webcast.

 

 

 

 

Mar 17, 2006

Input Trust Webcast

Just concluded the webcast on Input Trust Issues. Some of the attendees were not able to hear the audio or see the visuals. We will put up a manual on configuring Live Meeting. That should make it work.

 

For those who submitted answers to the Quiz and got a bounce back, the address is 

 

For those whose questions I did not answer, or who didn't get a chance to ask questions, please put them up here and I'll try and answer them to the best of my ability.

 

Thanks to everyone who joined today, I hope it was useful and hope to see you next week!

Building Secure Software: Input Trust Issues

We kick off the Building Secure Software series of Webcasts tomorrow at 2:30 pm with our first topic: Input Trust Issues.

 

In this session, we will discuss about the biggest issue in building secure code - that of trusting input which has not been validated. We see some of the most common attacks which exploit this weakness: SQL Injection, Cross-Site Scripting and Canonicalization attacks, and also discuss some of the best-practices in implementing Input Validation, including the use of Regular Expressions.

 

If you haven't registered so far, visit the link above!

 

 

 

Mar 16, 2006

Code Secure: Contest, Labs, Webcasts and More!

Want to find out how much you know about secure coding? And win prizes and recognition on the way? Check out the Microsoft Security Shootout contest. You can register right now (There are some cool early bird prizes!!), but the real contest begins only on Mar 20.

 

What's the contest wanna look like? From the Security Shootout site:

Stage I:  It will start from 20th March & end on 19th April 2006. Results to be announced on 22nd April. Top 1000 participants will move to stage -2. Stage 1 will have 30 objective and multiple choice questions. Stage 1 will have negative marking. Correct answer will be awarded 4 marks where as 1 mark will be deducted for every wrong answer. Duration for Stage I will be 60 minutes.

Stage II:  It will start from 22nd April and end on 30th April 2006. The results will be announced on 2nd May 2006. Top 100 participants will move to stage - 3.

Stage III: It will start from 2nd May 2006 and end on 15th may 2006. The top 10 winners will be announced on 1st June 2006. Contestant has to secure the code provided by Microsoft. This code will be in a format of zip file. Contestant will download zip file, extract it, analyze the code, and secure the code. Contestant will have to upload this secure code. Winners of stage III will win many attractive prizes mentioned in prizes section.

The top 3 and subsequently the winner will be announced during Microsoft tech Ed in June 2006.

 

We are putting up a bunch of resourcs for you to help win the contest. The first one is a series of webcasts thruout May. The first webcast is tomorrow. Check out the details here. We will follow up with a series of labs and other interesting things too. Stay tuned!


 

Cosmological Thoughts on Turning 29 ...


I turned 29 on Tue. Himani was very enthusiastic about it, got me some terrific gifts, things which, now that I have them, I realize I quite like, but would probably never have got for myself. And that's maybe the essence of a good gift: it has to be stuff that people like, but would never buy for themselves. In fact, that's one big grouse she has: I don't seem to need / want anything at all, so it's very difficult to get me a gift. Except maybe a book. And I quite agree - I am a difficult person to get a gift for. But she does an admirable job of buying me something useful very well, every time. She also managed a surprise party. Nothing big, just our whole family. But it was a very nice surprise. I quite enjoyed all the attention.

 

But after it got all over, late in the night, I was reflecting on what does it really mean to have a birthday. It means that the our planet is almost in the same position with respect to the Sun as it was when I was born. But w.r.t. the milky-way, it has moved about 20 billion km in its journey around the super-blackhole at the galactic core (a progress of about 0.0000125% in a journey which takes about 250 million years to complete), and has moved alongwith the whole galaxy, about 600 billion km in the direction of the constellation Hydra - a journey unabated since the birth of our galaxy.  If you take the Virgo Supercluster as a frame of reference, the spaceship called Earth has moved a long way indeed.

 

Thinking forward in time, this journey will continue long after I die, long after the chemicals constituing my body are absorbed by the earth to be broken down into simpler hydrocarbons and oxides. This journey would continue till earth itself lasts:  till our sun expands to become a red-giant and almost swallows our planet, some 4 billion years in the future, by which time our solar system will have gone around the galaxy sixteen times, and our galaxy would have merged with the Andromeda galaxy (which is coming towards us at 300 km/s) to form a much larger, irregular galaxy.

 

When the sun becomes a red-giant, it would maybe just stop short of engulfing the earth. To the unfortunately observer present on earth at that time, the Sun would appear huge, occupying 80% of the sky. It will have a hue of deep red, deeper than reddest sunset. The heat will be extreme. The atomsphere would have long evaporated. So would the oceans. Earth will be a hot rock, with a fierce red sun beating down on it. The extreme heat will break all the compounds which make our biosphere into the constituent atoms: mostly carbon, hydrogen and oxygen. The sun would eventually go nova, blasting out its outer layers to create a planetary nebula. None of the planets would survive this and would be blown to bits which would continue traveling outwards till the Sun's gravity pulls them back, eventually settling down to an orbit far outside the orbit of pluto today. The kickback of the explosion would compress the star, making it crush on itself to form a white dwarf star. Somewhere outside the orbit of Pluto, my body constituents would continue to revolve around this white dwarf, not able to escape its gravitational well.  

 

Our sun, now a white dwarf, would not be able to carry out any further fusion - it's just not large enough to have a gravitational crunch strong enough to overcome the repulsion of positively charged helium nuclei. This white dwarf, made of degenerate matter and held together by the degenerency pressure, would continue to radiate heat for the next several billion years, warming the planetary nebula around it, becoming dimmer and dimmer till it becomes a black dwarf. We do not know today what will happen then to our sun then. Our universe, at a ripe 14 billion years, is not old enough to have black dwarfs.

 

What may happen after that is dependent on the fate of the Universe, which we don't know today. The possibilities are based on the geometry of the Universe, whether it is open or closed:

 

1. The Big Crunch: The human-mind loves beauty. Central to beauty is the idea of symmetry. The symmetrical opposite of the Big Bang is the Big Crunch. If the Universe is closed, i.e. it has a geometry of a four-dimensional sphere, and if the average density of the universe is large enough, the expansion caused by the Big Bang may get arrested and a contraction may begin. This contraction, slow at first would get faster and faster as matter collapses on itself forming a larger gravitational mass to pull even harder. The obvious extrapolation is that the all matter, energy, space and time would collapse into a dimensionless singularity. All our laws of physics and maths cease to have a meaning here. The oscillatory universe theory says that this singularity would result in another Big Bang. In fact if that happens, it does not make sense to talk about Big Crunch or Big Bang. There are just repeating singularities between contraction and expansion. The human love for symmetry has great affection for such a view. Most religions of the world subsribe to such a view too. At least Hinduism and Christianity do - the notion of "Pralaya" and "Armageddon". So do, I suspect, Islam and Sikhism. But we don't know whether this will happen. If this happens, my elemental constituents of my body would become one with that singularity.

 

2. The Big Freeze: If the Universe is open, and has a flat geometry, that of a four-dimensional plane, it would die a heat-death, i.e. it would run down to a state of no free energy. Here, entropy or disorder has reached it maximum value. My body constituents would forever be suspended at zero K.

 

3. The Big Rip: If the Universe is open, and has the geometry of a hyperbola, a kind of four-dimensional saddle, the general theory of relativity predicts that the rate of expansion would keep on increasing. Everything would keep on getting farther away from everything else ever faster. This is already happening with galaxies getting away from each other. The geometry of the Universe would eventually start stretching the gaseous nebulae apart. Then galaxies would get ripped, losing their structure, as stars get further away from each other. Moons would be pulled away from the planets. Planets would be pulled away from the stars. Planets themselves will be ripped, streteched by the hyperbolic geometry. Stars would not be spared either. Even a star will be ripped. So would be a backhole. Everything would be ripped apart, stretching on the 4-D hyperbolic geometry of the Universe. The matter would keep getting stretched further and further apart. Even atoms would be stretched apart, breaking into nucleii and electrons. And even these will be stretched apart by the geometry into elementary particles. The universe would become an ever expanding very thin gas of photons and leptons, getting thinner. My body constituents would keep getting farther apart, ever faster, forever in eternity.

 

Right now we don't even know whether the Universe is closed or not. The Universe is so large that the four dimensional curvature is not obvious. Measuring the density is another matter altogether (pun-unintended). Apparently 96% of the mass of the Universe is dark matter - something which only manifests itself thru its gravitational effect, and does not interact with ordinary matter at all. Then there is the issue of dark energy: the energy of the vacuum. Lots of unanswered questions.

 

 

But while my material-self may or may not last, what about my consciousness?

 

The Law of accelerating returns, proposed by Ray Kurzweil, predicts a technological singularity before the end of the 21st century. What it means is this: our ability to compute is going to accelerate faster and faster, going beyond the ICs to future forms of computation. Everytime a technology approaches a barrier, a new technology will be invented to cross that barrier. BTW, the essay was written in 2001. As of today, we are looking at a barrier in increasing the silicon density, which is leading to the compromise called multi-core. Nano-technology and Quantum computing are two promising technologies which can help cross this barrier. Anyway, coming back to the law, such paradigm shifts would happen faster and faster. "Within a few decades, machine intelligence will surpass human intelligence, leading to The Singularity—technological change so rapid and profound it represents a rupture in the fabric of human history. The implications include the merger of biological and nonbiological intelligence, immortal software-based humans, and ultra-high levels of intelligence that expand outward in the universe at the speed of light."

 

John Von Neumann visualized this technological singularity as a "prediction wall" in which humans would be a part of a complex social structure of which no one understands, but a small part. This then is but a step removed from the noosphere - the sphere of human thought - proposed by Vladimir Vernadsky. Just the way the biosphere is composed of all organisms on earth, the noosphere is composed of all minds on the earth. The big question is whether the noosphere will integrate further to evolve into a collective consciousness? The theologian Pierre Teilhard de Chardin likes to think so, and predicts its culmination in what is called the Omega Point - the ultimate maximum level of complexity-consciousness. The mathematical physicist Frank J Tipler lend credence to this view in his book "The Physics of Immortality." In this book he proposed that the human-race will evolve into a singular consciousness and will eventually gain control over even the largest structures in the Universe. He equates the Omega point with God. But of course the theory is based on a number of assumptions, and most physicists agree with the theory only in parts.

 

In another of his book (co-authored with physicist John D. Barrow), Tipler proposes the Final Anthropic Principle: "Intelligent information-processing (of which life is but a form), must come into existence in the Universe, and, once it comes into existence, it will never die out." In conclusion, "We see that if life evolves in all of the many universes in a quantum cosmology, and if life continues to exist in all of these universes, then all of these universes, which include all possible histories among them, will approach the Omega Point. At the instant the Omega Point is reached, life will have gained control of all matter and forces not only in a single universe, but in all universes whose existence is logically possible; life will have spread into all spatial regions in all universes which could logically exist, and will have stored an infinite amount of information, including all bits of knowledge which it is logically possible to know. And this is the end."

 

Crtics of the FAP dismiss it as being metaphyics made to sound plausible by using flawed phyics. Same for the Omega point.  Do I believe it? I wish I could, but it is too fantastic to be believable. It certainly sounds attractive: the idea of evolving into a Universe-pervading, all powerful collective force of consciousness. This is the stuff one read about in all science fiction stories. In fact, when I read this for the first time, I was immediately reminded of the Issac Asimov short story titled, "The Last Question," which in my mind is the best piece of science fiction I have ever read, bringing together religion, philosophy and science, all together in a beautifully written climax. It is supposed to be Asimov's own favorite too, and I am hardly surprised. Check out the e-text available at http://adin.dyndns.org/adin/TheLastQ.htm. You will find out too.

 

 

 

So this is all that I thought yesterday night before falling off to sleep around 5 am, thinking of Asimov and all his other stories, and the way he brought together the Foundation Series, the Robot Series and the Galactic Empire series in that final novel: "Foundation and Earth," where R Daneel Oliwav, the positronic robot who discovers the fourth law of Robotics, is getting a choice made on the future of humanity, and the Human Lightning Rod choose Collective Consciousness.

 

It was fun, but also humbling, thinking all this thru. On this vast a scale, one realizes that our lives are nothing in the eye of the Universe - one blink and you miss the entire Human History. I fell asleep thinking all this. And now I have spent this night recounting all this. Its almost 5:30 in the morning. Time to retire to bed!

 

Mar 14, 2006

Secure Coding - Recommended Reading

After my post on what I've been upto these last few months, a couple of people asked me the names of the books I read on secure coding. Here's the list:

 

1. Writing Secure Code 2nd Edition: If there is one book you could read on secure coding, this will be it. Favourite chapters: 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 17, 18, 19, 20

 

2. 19 Deadly Sins of Software Security: Short, simple, concise. If you find Writing Secure Code lengthy, take this instead. Can be read thru in one day. Repeat after every two days till it sinks in. Favourite chapters: 1, 3, 4, 6, 7, 9, 11, 12, 13, 14, 18

 

3. Threat Modeling: Everything you wanted to know about Threat Modeling. Applying this book to daily coding shapes your mind differently.

 

4. Applied Cryptography: If there is one book you could read on Crypto, this will be it. Or atleast that's what everyone says. A little dated. Requires that you understand C. But explains everything very clearly. Fav chapters: 2, 3, 7, 8, 10 (couldn't go to Part III, it was getting too esoteric and I didn't have enough time)

 

5. Programming Windows Security: Everything you wanted to know about Windows Security by the Dark Prince of Security himself - Keith Brown. Fav chapters: 1, 2, 3, 4, 6, 7, 9, 10 (This book uses C++ and COM. Its .Net version is The .Net Developer's Guide to Windows Security, and is also available online)

 

6. Improving Web Application Security: Threats and Countermeasures. Available online on the link. Very pragmatic and directly applicable. A must read.

 

Mar 13, 2006

A Historical Day

It is not every day that history gets created. Today was not every day. South Africa and Australia made cricketing history of the kind which is seldom witnessed. First Australia set a  score of 434 - the highest ever in a one-day match. And then, South Africa chased it successfully. I am not sure of the number of world records broken today: highest scores, max numbers of sixers, fours in a match, max runs conceded by a bowler ... Incredible!!

 

But it does reflect on what the modern game has become. Dominated by batsmen like never before, it is no longer an even contest between the batsman and the bowler, the way it was supposed to be.  The number of aspiring bowlers surely got reduced today!

 

While the Australians must get credit for setting such a high score, the laurels would forever rest with South Africa. Not just because they were the winners, but because they overcame the sheer pressure which such a daunting score would have mounted. In some ways, it is sweet revenge for the South Africans who lost to Australia in the 96 World cup semi-finals because of a freak rain rule. Not many people would remember that world cup, but this performance would never be forgotten.

Mar 12, 2006

First visual db dev tool by Oracle!

This is funny. Oracle finally has a visual db dev tool.

 

"My God, it's about time. It's way late," Mike Hichwa, vice president of software development at Oracle, said in a phone interview Thursday. "We should've had this four to five years ago."

 

I couldn't agree more. Welcome to civilization folks!

 

 

Back to Blogging

I am back! It's been over three months since I last posted something significant, there was just an odd post in between on the Oracle flaw. And its been a very busy three months. What I have been upto? Let's see:

 

1. Reading everything I could find and trying out a LOT of code on secure coding. That's six books and about 8 GB of reading, audio-visual material. Plus writing about 2000 odd lines of code over about 50 odd small apps. All in one month. Have you heard of mental indigestion?

 

2. A three-day deep, intensive security workshop with ISV developers. (Overall rating 7.7 / 9, which is very cool, patting my own back ...)

 

3. The first-ever IT Professionals Conference in Mumbai. This was the first time I not only spoke but also managed an event. Now I know which one is easier. And it is not speaking.

 

4. A grueling two-week six-city yatra alongwith Jani and Nikhil on what we called the Web Platform Roadshow. For those of you who don't know of him, Nikhil is a software architect on the IIS+ASP.Net team, the author of WebMatrix, the person responsible for the Atlas framework, and one of the nicest guys around. For someone so gifted and knowledgable, he is very humble too. While all of us were cribbing about the schedule, he never complained! I hardly slept during this time, trying to catch the morning flight, and then waiting for the flight to get off four hours late in the Delhi fog. Oh BTW, the ppts, incase you want them are at http://www.microsoft.com/india/technet/presentations.aspx. Their rightful place is http://www.microsoft.com/india/msdn/events/presentations.aspx. So they may move there. Check both!

 

5. Building questions for a forthcoming contest. Can't say any more!

 

6. Preparing for a series of webcasts on Building Secure Code. You can register by searching for them at http://msevents-as.microsoft.com/cui/search.aspx?culture=en-IN. (We don't yet have a webpage for this on http://www.microsoft.com/india/msdn/events, should be up soon)

 

Besides a whole bunch of meetings, conf-calls and other very interesting things we all love doing!


So yes, its been a very busy three months. The good part is that I've been learning a lot of new stuff, which is always fun. The next quarter is looking equally packed, but I hope to be little more regular on my blogging (and that's only the fifth time I have promised myself to be regular!!)