Publishing on Designing Secure Software

Japanese translation is on sale

Tue, 15 Aug 2023 00:00:00 +0000

8月18日、新刊『セキュアなソフトウェアの設計と開発』を発刊

The Japanese translation of my book goes on sale this week. This is particularly rewarding for me because I lived and worked there for about ten years and speak the language well enough to read the text (but nowhere near ability write at a publishable level of quality). I’m quoted in the press release, wrote a special preface (English version), and there’s an interview with the translators in the book (all in Japanese, obviously).

On sale at Amazon Japan and other bookstores.

I know of two additional language translations in the works.

Polish translation is on sale

Fri, 05 May 2023 00:00:00 +0000

Wspaniale jest widzieć, że ukazało się polskie tłumaczenie mojej książki o bezpieczeństwie oprogramowania. (It’s great to see that the Polish translation of my book on software security is out. )

https://helion.pl/ksiazki/po-pierwsze-bezpieczenstwo-przewodnik-dla-tworcow-oprogramowania-loren-kohnfelder,popbez.htm#format/d

Dziękuję!

I know of three additional language translations in the works.

Epigrams in the book

Sun, 02 Jan 2022 00:00:00 +0000

I like clever sayings and wise proverbs, the shorter the better, so I wanted to work a number of them into the book. There are 45 of them in there, and for the most part I think they are at least relevant if not insightful. However, I admit that a few were just so good I bent the rules to include them. I hope the add a little spice to the book, provide useful perspective, perhaps educate or even provide a chuckle to readers.

When I felt stuck in the writing, it proved to be a nice technique to would spend a little time poking around the web for good quotes to go with the topic at hand, or sometimes to fill a gap elsewhere (from a list of places I wanted to find quotes). Usually, a few minutes searching was boring enough that I could return to writing afresh thanks to that slight diversion.

Also along the way I kept a file of good quotes that I had no spot for, and sometimes would find gold there later in a completely different context. I was very unsure if these would make it past the editors, but throughout the entire book there never was a single remark about any of the quotations.

My personal preference is for short quotations, and I wrote a simple script to sort a web page by word count (of <P> paragraphs) so I could skim the shorter ones quickly. A friend with a law degree advised me to strictly avoid song lyrics as those are particularly well defended. The other filter I applied was to avoid quoting people whom history has not been kind to, because we can move forward without their contributions.

Book on sale tomorrow

Tue, 21 Dec 2021 00:00:00 +0000

Finally my software security book is available for general sale tomorrow (December 21, 2021). Recent events such as the Log4j vulnerability demonstrate that our work is far from over (and the latest Microsoft security update lists 35 CVE).

In times when we click a button and then the book of our choice promptly appears, this year has been especially challenging. So I’m dedicating this announcement to everyone who made my book possible: the publisher, editors, proofreaders, designers, and many others at No Starch Press; the distributors; the printers; the truck drivers; the warehouse operations; the paper and ink suppliers; numerous booksellers large and small; and many more no doubt.

https://designingsecuresoftware.com/

Shipping

Fri, 12 Nov 2021 00:00:00 +0000

At last, print copies of my book Designing Secure Software: A Guide for Developers are now in stock, but only from the publisher. (The general on-sale date is in December.)

https://nostarch.com/designing-secure-software

In addition to getting the print book sooner, they provide downloads (no DRM) of the e-book at no extra cost.

My gratitude goes out to everyone who made everything happen, not just in creating the book, but also all the supply chains (currently under considerable strain and disruption) necessary to get the raw materials to the printers, print and assemble the book, and then ship it to the distribution center where thanks to another complicated set of logistics copies make their way to readers. It’s quite a feat, and this is just one of about a million books published annually in the United States.

References links checking

Tue, 09 Nov 2021 00:00:00 +0000

While writing this book I curated a list of web references for sources of material or details beyond what made sense to incorporate in the text. The publisher’s house style did not allow for footnotes, so the References appendix became a list of URLs organized by chapter.

Several times while exchanging drafts during the editing during the editing process, links that had worked when the first draft went out were broken by the time the editor responded. Link rot on the web was much faster and more common than I expected.

Rather than put a lot of URLs on paper that were liable to change we decided to move the References appendix online where it can be updated. From a brief search I did not find a good existing tool so I wrote some code (Python) to check, but it simple and ad hoc and doesn’t work well on a few sites (giving false negatives). I manually run it from time to time and it works well enough. (There’s a long discussion here: something about software that makes it easy to write a quick and dirty tool that works pretty well, but from there making it solid and generally useful and efficient and adding the obvious cool features quick becomes a major undertaking … and we quickly give up. The result is that there must be thousands (?) of one-off tools like this, but they aren’t good enough to share and grow into really slick tools.)

Since completing the book (late August 2021), here is a list of updates:

OpenSSL moved the web home of their git repository.
One link currently is temporarily broken (for over a week) as the company moves location.

The good news: We’re moving our headquarters to Potomac Yard in Alexandria, Virginia!
The bad news: This site is down for maintenance as we prepare to move our servers.
Thanks for your patience.
We expect to be up and running Tuesday, November 16, 2021.

Complete book proof review

Thu, 26 Aug 2021 00:00:00 +0000

This week I reviewed the complete book PDF, checking that previous changes were successfully made by the compositor. With luck that should be make it final.

The review consisted of comparing (with the handy DiffPDF tool) the previous proofs to the latest complete PDF, and also checking each annotation from the last review pass to see how it ended up. (Since the previous proof reviews were done on individual chapter PDF files, I used pdfunite command to make a full book PDF and then compared that. This worked exactly as I hoped.)

Most changes landed successfully, but there were a number of issues, mostly small. Copy editing happens through redlines (tracked changes) such that one can see the effect of all changes, or even make the redlines go away temporarily to confirm the end result. Working in PDF, however, one must describe the change and it isn’t actually visible until later when the compositor interprets the directions – and sometimes the result of what I asked for doesn’t work when it comes back in black and white.

At this point the index with page number references is in the proofs, so nothing can cause text flow that would cause page numbering to shift at all. Fortunately, all changes are tiny, and so long as paragraphs don’t change their length in number of lines everything is quite stable.

In addition to fine tuning the last set of changes, the inspection of diffs identified one new error that appeared (two characters " d" were inserted near one of the changes), possibly a cat walking on the compositor’s keyboard?

Index review

Wed, 18 Aug 2021 00:00:00 +0000

The penultimate review for the book is the index, and I just hit Save on it. Creating the index was a surprisingly interesting as well as challenging part of writing the book, and I’m very glad to have tackled it myself. Having taken book indexes for granted myself, I have a new appreciation.

During the copy editing phase I added index entries to the document (ODT format) and the copy editor checked those and often added some as well. (I assumed that often it was easier to just do some indexing than explain it.)

The publisher provided very specific guidance on indexing, and it certainly is an art. I think of indexing as akin to software design in that it requires anticipating how the user/reader will use it and then providing the necessary UI/entries they will look for to accomplish what they want to do/find. Different people certainly use indexes in various ways, so part of the job is to provide multiple paths to the same end. For example, the book includes many secure design patterns, and these are listed by name and also as sub-entries under “patterns”.

I reviewed the index in several passes corresponding to issues to look for.

Spelling: are all the words correctly spelled? (I used the hunspell(1) command and also scanned it manually.)
Acronyms: consistent use where applicable (usually in parens after the spelled out words).
Duplications: any duplications were cut or the entries combined.
Styling: index entry styling should match usage in the text. (For example, HTTP header names appear in monospace literal font in the text and in the index.)
“See” references: if there is a reference to another entry with just one page reference we provide that page number directly so as not to waste the reader’s time.
Visual: one last review to check that everything looks right, or to catch anything else that pops out.

What to index and how to construct the index entries is ultimately subjective and a matter of taste. In the process I developed my own sensibilities while trying to follow all the detailed guidance. It’s tempting to consider software tools to aid if not largely automate the process, but it is an art and depends on understanding the material, so as of yet there are no professional grade software solutions far as I know. With luck my knowledge of the subject matter will help me make the right choices more than my inexperience limits.

Sales categories adjustment

Thu, 15 Jul 2021 00:00:00 +0000

When the book appeared in the Amazon marketplace I set up an author’s page and claimed the title. I expected some sort of verification, but they just granted me the book I asked for. This allows me to publish my bio and also see reports on sales ranking and so forth.

I don’t know how the book gets assigned to categories, but it was listed in “Programming Languages” – while the book includes code and uses programming languages, it’s hardly about them. If anything, the book attempts to span many languages and operating systems, only using specific instances as examples. Additionally, the book was not in a security category though it clearly should be.

Books > Computers & Technology > Security & Encryption

This change must be made via the publisher (I learned) and I’ve requested that.

Still in pre-order and ahead of any public-facing marketing, the current ranking is what one would expect.

#609,529 in Books - Down 87,307 spots since yesterday

This is a great starting point with the only direction to go being up.

Publication date set

Mon, 05 Jul 2021 00:00:00 +0000

This Monday morning I started the week by discovering that a publication date is set for the book: October 19, 2021.

Three months out, there is a lot of work left to do reviewing proof pages and the index, but at the same time it should be very doable.

I used a Google Alert search with an RSS reader to track web references to my name, and this is how I learn the big news. One benefit of having an unusual last name and unpopular first name is that search references are (so far) always about me. The first webpage that I happened to stumble upon was this.

Having a specific date makes the publication of the book feel very real for the first time.

Cover design

Thu, 20 May 2021 00:00:00 +0000

Once the title was chosen by the publisher (in consultation, of course) the cover design becomes the next topic of discussion. Cover design is up to the publisher, and I’m quite happy with that having zero experience. My input was that I personally prefer the dark background style of their security book series, while being open to anything the publisher might propose.

It’s difficult to map from an abstract topic like secure software design to something in the physical world that can be portrayed on a book over. Some covers are just title text, and the “Matrix”-style spew of digital fixed width characters like a text dump is overdone.

My ideas for cover themes are admittedly not great, but I wanted to focus on secure by design as a central topic. (listed in no particular order)

A turtle with a nice shell beside a hermit crab with an shabby, ill-fitting shell
Someone building a house on bedrock
The construction of a Roman arch bridge (which was very clever for its time)

Update: From a subsequent cover discussion, a new idea of an armored robot came up that the publisher thought promising. The graphic artist evolved this concept into the final cover art that has generally received a very positive reaction.

Layout design for Appendix A

Mon, 10 May 2021 00:00:00 +0000

Writing about software design is difficult because there is little to no standard methodology or practice – everyone does it differently. So there is a challenge as to how to show secure software design.

The idea that I came up with was to write a software design, and then show via highlighting the parts of the design that address security. My original vision was that this would be an appendix in the book that would look like a real working software document that was included as an example.

Once again I was pleased that the No Starch folks immediately embraced the idea and helped me work out exactly how to do that. Here is the rough concept that I pitched.

Most important this is to have a different look and feel from the main text of the book to signal that it’s a separate document that’s attached.
I suggest using sans serif font as a primary indication that it’s different.
Design documents, like the link above, are very structured, have minimal styling, with emphasis on being functional (and hence a little ugly).
Perhaps an additional header as for the design document (in addition to the book’s footer showing page number, Appendix A).

The production editor worked with the compositor, and that’s basically how it turned out: sans serif, a different look and feel more like a design doc.

Copy edit of a chapter

Sat, 03 Apr 2021 00:00:00 +0000

Copy edit is the last chance to make significant changes to the text. Most chapters involve plenty of sentence rewriting and a few moves of a paragraph, but much of the delta is punctuation and word choice.

There are a handful of changes that I have made notes to weave in during this phase where I have a new story to tell that I just recently learned, or perhaps a new approach to a concept has occurred to me after the fact. Working on a book really dials the mind into this material, and when I read about a new exploit or other new development that fits into the work it’s worth considering incorporating it when it adds real value.

Chapter 10 was by far the most changed during copy edit, partly by plan, and also because the copy editor’s comments triggered some reassessment of the organization and coverage. This is a tricky chapter because the subject of untrusted inputs is very pervasive, potentially appearing in a variety of forms, so choosing what to write about – or not – is a challenge.

I replaced what I thought was a lame made-up story demonstrating the basic idea of injection attacks with the quirky story of Dmitry Agarkov. Additionally, I heard about the sneaky software team named “No Game Scheduled” and wanted to include that too. This was in addition to some tweaks in the path traversal section to provide a more systematic view of mitigations.

As if that wasn’t enough, while reviewing the first round copy edit I found a bug in my path traversal code that allowed an unlikely but possible attack. After testing the attack and confirming it on the code I had written to verify it, I then adjusted the code to the correct fix, tested it, and modified the code in the book.

Kudos to the copy editor gamely reviewing and editing all of this churn. Most importantly, these changes made the book better without causing great disruption to the process.

Artwork ready for review

Tue, 16 Mar 2021 00:00:00 +0000

The artwork came back as a PDF with one drawing per page, labeled by filename. The first batch was pretty good, considering that Richard (I learned the artist’s name) must have had no idea what the symbols meant.

I added annotations suggesting some changes, and it’s now off to be worked out. I’m not sure if I’ll next see artwork in the layout pages or get another batch to review.

The manuscript contains production directive lines saying where the graphics are to go, and the copy editor has diligently added comments about letter casing and such details.

Copy edit begins

Mon, 01 Mar 2021 00:00:00 +0000

Copy edit phase starts this week with two chapters (Ch 1 and 4). The chapters that resulted from developmental editing have been converted to a new style regime, and are now ODT instead of DOCX format. Each chapter arrives with edits and comments from the copy editor.

At her suggestion, in this process I review tracked changes but don’t accept or reject them because this would lose her edits. Instead, I comment or provide my own tracked changes for her review, with any edits left alone implicitly to be accepted.

For comments I reply to each and every one. Often comments will describe a change that I can agree to or counter with other ideas. The idea of using a comment to describe a change is it allows the copy editor to explain why for context, and this is quite valuable.

Since I’m conscientious about reviewing and responding this system immediately works well. Ch 4 takes three roundtrips of copy edit to finalize; Ch 1 takes two. We agree to proceed at two chapter per week pace.

Artwork help needed

Fri, 12 Feb 2021 00:00:00 +0000

Perhaps it was due to poor grades in Art class back in my school days, but I quickly realized that the sketches I did for graphics in the book we not going to be up to par. Having never worked with a pro, I didn’t invest a lot of time as the drawings were not getting better it seemed, and when production began the publisher sent them to a pro to fix up.

I did provide notes for each drawing listing the key points (I could describe in words better than render in art what I wanted to say) that I hoped would bridge the gap. The first batch was pretty good, considering that Richard (I later learned the artist’s name) surely had no idea what the symbols were meant to depict.

I was able to add three more graphics that came late in the process. During editing of the chapters a few places it because clear that what I wanted to say was difficult to convey, and a graphic depiction suggested itself. (Sometimes getting the words right is just hard.)

Katrina accepted my notes and the files containing my crude drawings, and was off finding somebody to make it all ship-shape.

Custom shading to highlight substrings

Tue, 12 Jan 2021 00:00:00 +0000

The section of the book on SQL injection needs to illustrate how an attack string gets inserted into a text string representing a SQL statement with unexpected results. The standard way of highlighting a part of a string available was to use bold like this:

INSERT INTO Grades (name, grade) VALUES (’Robert’, ‘A+’);–’, ‘F’);

However, it’s difficult to clearly distinguish a bold single quote, for example, because it’s so thin.

Edit: Again, the No Starch folks were eager to find a solution. I won’t attempt to match the font but here’s how it appears in proof pages:

Now it’s crystal clear.