"Generation Z Developers" - new Leanpub Book

In the last couple weeks I been been working on a book called "Generation Z Developers" which you can now get it for free from Leanpub

As with all my books, the content is released under an creative commons license and hosted on this GitHub repo

One difference with this book, is that I'm using Hugo for the static site generation of the book and the leanpub content generation (and it is helping a lot)

I'm including below the current introduction to the book which provides a good explanation of why I wrote it.

Let me know what you think of it, and what other topics or ideas should be included.

https://leanpub.com/generation-z

SI Open Sources the Eclipse Plugin-development toolkit that I developed for TeamMentor

For the past couple months I have been working on a Eclipse plug-in for TeamMentor (see Programming Eclipse in Real-Time (using an 'Groovy based' Eclipse Plug-in) , Opening up a native Chrome Browser window inside Eclipse (raw version) , Injecting HP Fortify Eclipse Plug-in Views into HP’s WebInspect UI  and Two Videos showing TeamMentor Eclipse Plugin integration with Fortify Eclipse Plugin (as shown in HP Protect 2013 conference) ).

I had a number of culture chocks coming from a C#/VisualStudio/O2Platform/REPL world into a Java/Eclipse one. The biggest one by far was the loss of 'semi-real-time' code execution that I have in Windows/C#. I used the O2 Platform REPL (and Resharper+Ncrunch VS plugins) to have a proper TDD development mode (i.e. high effectiveness and productivity), and in the Eclipse world (specially in plugin development) I had a 10 to 30 sec delay before seeing the result of any code or UnitTests execution! (which is 95% slower than what I was used to)

So, as I guess it is typical of me, I didn't just create an Eclipse Plugin. I created an 'Eclipse Plugin to create/develop Eclipse Plugins' (think of it as a 'Groovy based Eclipse Plugin where the Groovy scripts have access to the Eclipse Objects of the Eclipse instance running those Groovy scripts' :)

Why should a developer care about security training?

I was asked this question via SI (who has a bunch of application security focused CBT course) and since google was not able to find a good answer, here are my views on this.

Firstly I want to say that I have the utmost respect for developers who ship-code (even before I became one). I have done a lot of developer training, and always took the view that blaming the developers for security problems was making the developers a scape-goat, there are far too many moving parts in the development of Secure Coding, and the developer is just one of them.

And although I argue that Secure coding (and Application Security) must be invisible to developers, it doesn't mean that developers should not be aware of it and should not learn about it.

They absolutely should, since just like Quality and Testing, security is the responsibility of everybody that writes code (see Security evolution into Engineering Productivity).

So why why should a developer care about security training? Here are my top reasons:

• Increase Knowledge
• Learn new Tricks and Techniques
• Improve Testing Skills
• Improve Productivity
• Improve Career
• Have Fun
• Learn the 'Application Security' language
• Write more robust code
• Write more secure code

Let's expand on these:

Increase Knowledge:  
The security field is filled with amazing techniques to break or protect an application's security.

I remember being massively impressed when I really figured out how Buffer Overflows, SQL Injection , XSS or CSP actually worked. There is so much to learn on this field and in a lot of cases we are really looking at pure knowledge.

Developers usually tend to have a focused approach on their learning paths, and security is more about the entire ecosystem, where the whole depends on the security of the parts (and how their interact).

Learn new Tricks and Techniques

This is something I can completely relate, since I am a much better .NET/Web developer due to my security research.

I feel I have a 3D view of the CLR and Browser/Http/Server world, and when I have a problem my bag of tricks (even before O2) is enormous

Improve Testing Skills

More and more Security is connected with Testing and UnitTests, and a lot of the code created by security analysis, can (and should) be reused in Testing.

One area that is often overlooked when talking about secure coding, is the need to have tests that validate the assurance made: ":....so this XYZ code is secure ??? ok prove it!  ok... what about in 6 months time, will it still be secure?"

Improve Productivity

The developers should pay very close attention to the tools and techniques used in the application security world, since they can help to solve a lot of problems and increase their productivity.

What I like the most about the Security evolution into Engineering Productivity concept, is that it uses Testing/Security as a was to push Engineering excellence into an application (and improve the developer's productivity).

Improve Career

There is a MASSIVE career opportunity for the developers that are able to pick up application security skills. Not only they will become much better developers, they can also become the 'internal security expert' which is role that needs to happen in all development teams.

They will also be able to join security teams or companies (who cannot find enough resources to hire), since it is much easer to teach a developer security, than it is to teach development to 'security professional'

Have Fun

Both exploiting and fixing code is a lot of fun. There is a kind of wild-wide-west/game environment, and when thing work, the feeling is just amazing 

Why do you think that the application security field is made of much passionate crowed, for example look at these 180 crazy ones from OWASP that went all the way to Portugal to work non-stop on Application Security issues

Learn the 'Application Security' language

The Application security field is really good at coming up with crazy names (XSS, CSRF/XSRF, Frame-jacking, SQLi, Off-by-One, AutoBinding/OverPosting, etc...), and its always good to have an idea of what the other side is talking about (same thing happens on the reverse, and I will be wary of a 'application security expert' that doesn't know what TDD, Git or MVC is)

Write more robust code

The end result, is that the new security techniques/knowledge will make the developers actually write more robust code, which will be tested much more thoroughly and harder to break

Write more secure code

And finally, what will also happen, is that we will end up with more secure code. A developer with Security Knowledge has a much better view of the side-effects of the code he/she is writing and is able to code in much stronger/safer paths.

... final comment: if it is mandated, make the most out of it....

Sometimes a developer will find itself in a position where there is a mandate to take 'Security Training' and there is no way out. I would say that those developers should remember that 'in life usually you cannot change your tasks, but you can always change your attitude in executing those tasks'. Security training should be seen as an opportunity, and it's on the developer's best interest to make the most out of the investment made in his/hers education

Code Mirror and TeamMentor's Html Code Editor

Code Mirror (online code editor) is great, I used it on TeamMentor (TM) to create an web editor for server side content (one of the gems hidden inside it :)  ).

Code Mirror was really easy to integrate and you can see it in action below or at: jsbin.com , sourcelair.com or wescheme.org

Yes, I can edit HTML directly from the browser :)

This is a great 'admin' feature and has helped me to solve a lot of problems in real-time on remote deployments. It also has a number of security features/requirements, which I want to cover on later posts.

Btw, I would like to package this module as a separate project, since this HTML/Ashx code editor is already packaged as a stand alone unit inside TM (if anybody wants to do it ping me directly, this would be a great mini-project to do)

At TM, the code is the WebEditor folder and the real action happens inside the WebEditorService.ashx file.

Here it is in action:

Light Table - Amazing PoC of IDE

Couple days ago Chris Grangers posted Light Table - a new IDE concept (inspired by Bret Victor - Inventing on Principle presentation) , and its Light Table's numbers follow-up post shows how well his ideas where received by the developer community.

In a way a number of these concepts are already present in the latest version of O2 and its REPL C# environment (note to self: start blogging about O2's scripting environment)

These two videos are well worth the time to see them

Chris Grangers - Light Table
 

Bret Victor - Inventing on Principle

Adding Gaug.es to Blogger, XSS by design?

I just added Gaug.es monitoring to this blog (hosted by Blogger). That can easily be done by:

• going to the Blogger Layout page (via the admin panel)
• at the bottom click on 'Add a Gadget'
• chose the HTML/Javascript gadget from the 'Basics' list
• add the Guag.es tracking code, that look something like this:

For this to work, Blogger is in essence allowing me to inject Javascript into this blogging site, which is basically persistent XSS :)

In fact , the code sample above (GIST from GitHub) is also an XSS injection, so one can also put script execution on normal posts:


So what are the security implications of this?

• The javascriopt code will be executed under the http://diniscruz.blogspot.com/ domain, so (in principle) any script on it should not be able to affect any other *.blogspot.com domain
• The injection of code via the blog Layout means that any blog admins can take over this blog (so that is OKish)
• But what about Javascript on the blog post? Doesn't that mean that any author of this blog can take over the blog (by putting a payload on a page and waiting for an admin to see it?)
• What about visitors to this blog? Is there a way to 'attack' them? 
• For example: will it be possible to auto-post a comment (or vote) for them? It looks like comments are made from http://www.blogger.com/comment.g?... so that could prevent it

Question: Is there a write-up somewhere on the interweb about the security implications, threads and countermeasures of allowing user Script injection in a user-driven site like blogger?

This question is very relevant to me at the moment, since the 3.1 beta version of TeamMentor allows raw HTML (and Scripts) to be used on TM Articles (this is a feature requested). And I need to figure out the best way to handle it

"Making Security Invisible by Becoming the Developer's Best Friends" presentation

I just uploaded my "Making Security Invisible by Becoming the Developer's Best Friends" presentation (Oct 2011  at OWASP AppSec Brazil) to SpeakerDeck and it looks really good :)

http://speakerdeck.com/u/diniscruz/p/making-security-invisible-by-becoming-the-developers-best-friends

I'm really linking SpeakerDeck , it just fell right :)

Related Posts:

• Secure coding (and Application Security) must be invisible to developers
• Security evolution into Engineering Productivity

Traits of a great developers (by Justin Searls)

Justin Searls The Mythical Team-Month presentation is really spectacular, and inside it there a section on Observable traits of great developers.

Since I'm a developer (currently on the O2 Platform and TeamMentor), I wonder if I have these traits? and since I'm hiring, the question is how to identify them?

• Empathetic: vigorously defends the interests of users by adopting their perspective
• Analytical: breaks down large objectives, ideas, and problems into small manageable ones
• Visionary: identifies a singular idea & fights for its simplicity, yet plans for growth
• Scientific: methodically attacks problems, reducing paths of inquiry efficiently
• Creative: dreams up new ideas & approaches, continuously and asynchronously
• Professional: invests time in long-term effectiveness, maintainablility of their work
• Entrepreneurial: willfully kills projects that don't success before over-investing on them
• Hungry: relentlessly improves, thorough learning, practising and sharing 

Well I'm not the one that should be evaluating my our performance (I think I do most of those :)  ) , but if you're a developer, this is really want adds value when creating applications.