Desicritics Author: Ganadeva Bandyopadhyay

Book Review: Practical Intrusion Analysis

Ganadeva Bandyopadhyay — Sun, 3 Jan 2010 19:00:33 EST

With a core emphasis on intrusion detection systems(IDS) in networks, the book includes further topics like wireless IDS, Intrusion Prevention System(IPS),etc.

SNORT and Bro are the two main IDS tools discussed. Both of them are open-source tools. While SNORT is representative of signature-based IDS, Bro is an example of anomaly-based IDS. A signature-based IDS looks for signatures in the network transmission indicating an attack in progress whereas an anomaly-based IDS goes by a normal traffic pattern and raises alert if there is an abnormality detected.

There is some discussion on writing signatures for SNORT. There are sites on the internet where signatures can be downloaded. However, any intrusion analyst using SNORT in detail, would need to know the techniques for writing signatures. There are methods discussed in this book for strategy to create good signatures while going through a vulnerability' life cycle.

Some of the other network analysis tools described in this book include vulnerability assessment scanners(ex. Nessus, Nikto, router audit tool a.k.a RAT), packet sniffers(ex. Wireshark, TCPDump), file integrity checker(ex. Tripwire, RANCID, AIDE), password auditing(ex. Cain and Able, Brutus, RainbowCrack), wireless security toolkits(ex. AirCrack, AirSnort, Kismet), vulnerability exploitation tools(ex. Metasploit), network reconnaissance toolkits(ex. Hping2, nmap, ngrep, ntop). The distinctions between these may be small and sometimes even overlapping such as an essential packet sniffer in an intrusion detection system.

There is some discussion on web application firewalls, wireless IDS/IPS, some other less frequent topics like physical intrusion detection and geospatial intrusion detection. Web Application Firewalls are specialized IDS to cater to the practicalities like more percentage of secure network protocols in use and wide variations from web applications across organizations. This makes the the general IDS tools practically ineffective as a intruder can go within a tunneled traffic which is not configured for monitoring out-of-the-box.

To summarize, the book covers a lot of topics within its scope. It is a good read for a introduction to current intrusion analysis,detection and prevention techniques. A more continuous discussion with more real-world examples and their solutions within the topics would have made this a delightful read.

Book Review: The Process of Software Architecting

Ganadeva Bandyopadhyay — Sun, 30 Aug 2009 07:26:24 EDT

Software architecture developed as a profession with the increasingly high-level and comprehensive understanding required for OOP paradigm. There is a plethora of definitions available for these two words in different contexts and mentioned in various standards and consulting company documentations.

In the The Process of Software Architecting, the authors start with discussions of the various definitions and terminologies associated th the Software Architecting field and go on to illustrative test cases and project scenarios where the issues and possible solutions are discussed.

The book is divided roughly into three parts. The first part gives briefly the core concepts of architecture, architect and architecting, documenting a software architecture, and reusable architecture assets. The second part provides a guided tour through a typical software development project. The last part brings out how the concepts described in the preceding parts apply to architecting complex systems.

The task of the software architect comes in between the requirements phase and the development phases in a software development project. Initially the architect has to make a logical architecture based on the requirements which have to be made into a logical detailed design in the development phase. Based on the inputs of requirements, logical architecture and logical detailed design, it is the job of the architect to create physical architecture taking the available technology into account.

Some of the architecture related best practices in the industry are the Rational Unified Process, IBM Unified Method Framework, OpenUP, eXtreme Programming(XP), Scrum, etc. In addition to these, one of the standardization initiatives like the Software and Systems Process Engineering Meta-model Specification(SPEM) is also considered for the discussion on method elements.

Few of the other notable aspects of this book is the need for accommodating differing viewpoints through accounting for the political landscape within the respective organization, the necessity to avoid ivory towers by a team of architects too engrossed in discussions to get the feedback from the end-users/management and taking the decision to reuse architecture assets or not based on several factors.

To summarize the review, with a highly condensed text and examples, an experienced software architect would keep coming back to this book to have the improved understanding of principles, best practices as well as avoiding the pitfalls in this developing field. Drawing heavily from the software engineering principles, the book goes beyond finalizing the perfect software architecture document into the evolution stage of software architecting as an art to software architecting as a science.

Book Review: The Blender GameKit, 2nd Ed.

Ganadeva Bandyopadhyay — Sun, 30 Aug 2009 03:49:59 EDT

The history of computer games is traced back to the autumn of 1961 when two MIT scientists developed such an application on DEC PDP-1 computer in MIT,Cambridge, Massachusetts. This was the first computer equipped with a cathode ray tube monitor and a keyboard. Other notable years include 1980 when Pac Man was released, success of QUAKE in 1996 and launch of Sony PS2 and Microsoft Xbox and their advanced versions into current decade.

Another category which is having a wide following in current times is the massively multiplayer online game (also called MMOG or simply MMO) is a computer game where hundreds or larger numbers play simultaneously. Examples of these include Toontown Online, Pirates of the Caribbean Online, RuneScape and Second Life.

There is an extensive list of game engines written in C++ programming language for most of them. These allow the game designer to easily code a game quickly without building from scratch.

Blender is the free open source 3D content creation suite, available for all major operating systems under the GNU Public License. The book under review, serves as a guide for the beginner through advanced game designers using this fully integrated 3D creation suite. This is a four-colour book including a CD having editable and playable Blender games,all files for the tutorials and Blender V2.48 for Windows,Mac OSX, and Linux.

Among the topics covered in this book is the introduction to 3D and Game Engines, Blender Basics, discussion of game concepts/games in pumpkin run, pin ball, subracer-an underwater racing game,the flying buddha memory game, “Yo Frankie!” Open Game Project, cooking basic network setups for using Blender on a network (using a matching Python installation). The book also includes a reference for the Blender Game Engine.

One of the interesting chapters in this book discusses the use of armatures in game character animation. Assuming the modelling of the character and armature is made using the correct coordinate system the game creator has to take care when working with bones, basic layout, mesh deformation vertex groups, creating a walk cycle before finally putting game logic on the armature object itself rather than on the mesh.

There are a large number of example games which can be edited for having a better understanding of the concepts as well as to use the Blender suite for more effective and advanced games.

With the large number of editable games and inputs from professional Blender artists, the book is a useful read for game designers/creators looking to use the Blender game engine.

Book Review: Android Application Development

Ganadeva Bandyopadhyay — Sat, 29 Aug 2009 21:46:15 EDT

Google initially announced the development of Android, a mobile operating system running on Linux Kernel. It is now the flagship software of the open handset alliance(OHA) committed to develop open standards for mobile devices. The OHA is a business alliance of more than 45 firms led by Google and established in November 2007.

The official Android developer documentation covers the basics of Android through publishing and best practices and some sample code.

Android Application Development is directed at Java programmers to develop useful and robust applications for Android. Familiarity for some of the technologies that Android uses is assumed as a pre-requisite for using this book to optimum. These include XML, SQL, GTalk(XMPP), OpenGL-ES, and HTTP.

There are two main sections in this book – Development Kit Walkthrough, to get started with the basics needed to write applications , and Programming Topics ,exploring the effective use of the libraries.

Most of the application development discussions are organized around MicroJobs which is this book's main sample application. The aim of the MicroJobs application is to help its user locate a temporary job in their proximity, so he/she can work for a few hours and make some money. The MJAndroid Application source code and project files are available from the O'Reilly website.

The Eclipse Java Editor is extensively used throughout this book with an entire chapter devoted to knowing its features. The discussion on signing and publishing the application to android market gives the details for using the keytool to generate a key pair and a signing certificate, getting a Map API key from Google, using jarsigner to sign the application to the last steps of signing up as an android developer paying a one-time fee and uploading the application.

The two distinct data access APIs that the Android framework offers is SQLiteDatabase and Content Provider. SQLiteDatabase is Android's Java interface to its relational database, SQLite and the latter is an interface used between applications.

Google Maps as one of the location based services is included as an application with Android itself. The MJAndroid discussed in this book uses the MapViews library. When using a MapView in the application, actual Google Maps data is used to draw the map. For this purpose the developer of the application using MapViews needs to obtain a Map apiKey from Google as a legal requirement.

Some of the other topics discussed in this book is about Drawing 2D and 3D Graphics and Inter-Process Communication. The important fact mentioned near the end of the last chapter is the keeping out VOIP from the core telephone functionality of the Android. This requires the designers of VOIP technologies for android to build add-ons instead of using the same APIs as mobile calls.

The book is a useful read in addition to the official documentation for Android developers.

Book Review: Data Warehousing with SAP BW7, BI in SAP Netweaver 2004s

Ganadeva Bandyopadhyay — Sat, 29 Aug 2009 13:59:37 EDT

SAP Netweaver is the technical foundation for all SAP Applications, part of the SAP Business Suite. The five constituents of SAP Business suite are SAP CRM, SAP ERP, SAP PLM, SAP SCM and SAP SRM. The core products that make up SAP NetWeaver include SAP NetWeaver Application Server, SAP NetWeaver Business Intelligence, SAP NetWeaver Composition Environment (CE), SAP NetWeaver Enterprise Portal (EP), SAP NetWeaver Master Data Management (MDM, SAP NetWeaver Mobile, SAP NetWeaver Process Integration (PI) .

The newer term of SAP NetweaverBusiness Intelligence, with the more popular abbreviation of SAP BI, has the SAP Business Information Warehouse(SAP BIW, later SAP BW) as its predecessor. The current book focuses on SAP BW as a data warehouse and ignores the BW-integrated decision support tools as far as possible. 'BW' is still used to describe the underlying Data Warehouse Area and Accelerator components.

There are six main sections in the book covering architecture, data model, analytical engine, extraction and staging, BW design and BW in Live Operation. There is a comprehensive appendix at the end, dealing with special topics such as currency conversion, transportation, migration and development of metadata content.

The discussion on performance tuning for improving data analysis performance is a lucid read. Focusing on data model of Basis Cubes, it starts with the assumption that there are no fundamental modeling errors for the Basis Cube. The four approaches to optimization in this chapter are aggregation, indexing, partitioning and clustering and use of dedicated OLAP memory(BIA).

Almost all the topics are accompanied by well placed illustrations and foot-notes. The book is an exhaustive reference manual covering most of the possible topics for architecture through concepts and implementation with a focus for data warehouse part of SAP BI. One of the good improvements for this book would be a possible soft-copy format to be included as a CD or downloadable for buyers of the book. This would increase the ease of using the matter as a reference without carrying along the book to a cluttered workplace desk.

Book Review: The Art of Concurrency

Ganadeva Bandyopadhyay — Mon, 3 Aug 2009 20:18:23 EDT

There is the interesting definition of a thread monkey in The Art of Concurrency. Approximately put, it is a term for the programmer well versed in writing code for parallel applications. There is the strong case made for practical use of parallel programming with the Moore's law starting to reach the limits of material causing the introduction of power efficient, practical designs of chips with multiple processor cores.

The author begins with the concepts like difference between parallelism and concurrency, the different approach to concurrent algorithms and multi threaded programming, comparison of shared-memory programming with distributed-memory programming before moving onto a discussion of two concurrent design models-task decomposition and data decomposition.

One of the central topics in this book is in the principles given as eight simple rules for designing multi threaded applications. These are the guidelines for the parallel programmer to keep in consideration for efficient code. Some of the tips are - To identify truly independent computations,Making use of the thread-safe libraries as per suitability and using the right threading model.

There are other topics such as discussion on MapReduce algorithmic framework ,concurrent implementations of graph algorithms and threading tools for the intermediate to advanced level programmer. The concurrent variations on the serial algorithms for common search and sort techniques are also discussed without much of a computer science jargon.

To sum up, this is a lucid text with practical guidance for writing parallel applications. The program code in the book is written in the C language allowing the easy understanding for readers down to the beginning computer engineering students interested in trying out the intricacies of parallel applications.

Book Review: Forgotten Wars

Ganadeva Bandyopadhyay — Mon, 27 Jul 2009 19:40:18 EDT

There's an old proverb that those who don't know history are bound to repeat it. Here is an excellent history text bringing to light the violent confusion and turmoil in the region from India through Indo-China into Indonesia as the second World War came to a close by the two atomic bombs. Arguably one of the factors allowing the rapid expression of new nations in this region from the long simmering discontent against colonial powers was the rampaging armies of much despised World War.

A reading through this book highlights the exceedingly complex fabric of revolutions and nationalistic movements intertwined across cultures and present-day borders shattering the sometimes simplistic view of history in school text-books of present-day nations in these parts

There are some interesting facts like the argument made during the trial of INA officers that the Eire recognized INA government controlling the Andaman and Nicobar was in effect a national government. Also that the majority of INA cadres being from NWFP, Punjab and South-east Asia rather than otherwise.

There is also mention of the extensive use of Indian military divisions during and after the war especially in South-east Asia for calming pre-WWII British colonial possessions from Kolkata through Singapore. This also stretched into Indo-China and Indonesia. The follies of the French and Dutch in trying to reclaim their colonial possessions of Vietnam and Indonesia with active or passive help from the sole British made a strong case for choosing the earliest right time to exit the colonies.

The important roles played by Lord Mountbatten and other men from military backgrounds with or without the required political and diplomatic acumen is clearly visible. As also is apparent that the heavy involvement of the Indian troops on both sides of the war effort put a tremendous and irrecoverable strain on the Indian Armies. This also made the task of suppressing violent communal politics of all hues all the more difficult as the time went by.

There is the very shrewd line taken by Burmese nationalist leaders to follow and avoid the follies of Indian leaders which caused the creation of multiple countries out of the British Indian colonies amongst much bloodshed and communal hatred feeding into nationalist animosities to the present days. Mention may also be made of some of the exceptions to the arguable rule of religion being the baseline for the drawing of new borders such as the passage of hindu-majority Khulna district into East Pakistan.

There are also the more poignant stories of the men of war who fought valiantly in distant lands at great personal and family sacrifices only to return in the middle of the civilian disturbances in their own towns and villages split along communal lines. More than any single planned effort, it is the dynamically changing nature of politics and nation craft in these volatile times which shaped the destinies of millions of people whether they wished it or not.

It is an undeniably lively way that a vast and sometime neglected subject is dealt in a factual manner in this book. This is a must read for the scholars , pundits and the layman looking for the best way of facing truth whether likeable or not.

Book Review: The Data Access Handbook

Ganadeva Bandyopadhyay — Sun, 5 Jul 2009 20:15:31 EDT

The Data Access Handbook is an unarguably interesting read for database practitioners of various database implementations. Starting with description of trends in performance tuning to present times going right up to middleware issues and looking at data access in service oriented architectures ,the book covers most of the relevant topics of interest for working on performance issues in database applications.

The performance of the large-scale database implementations at the start of the 80s could be only understood by a few specialized experts having an understanding of the theoretical models and technicalities of respective database types. With the increase in database features and streamlining of the knowledge disseminated from the earlier database and performance tuning experts, shifted a lot of the performance factors into the middleware.

The authors describe in detail the trends in the database industry from the monolithic to networked environments, the emergence of the database middleware, the necessity of connectivity standards and various database drivers.

The shift of performance tuning efforts from the database management system itself(in earlier times),to middleware in the current times is the major focus of the book. Part of this focus includes an explanation of the database middleware before moving on to discussions on developing performance optimized applications on ODBC, JDBC and .NET.

There are some good technical reasons and tips give throughout the book for performance across database implementations Oracle, DB2, MS SQL Server, etc. There is a separate chapter given to the clearly outline the concepts of connection pooling and statement pooling and how to use them for performance advantage.

One of the effective tips given while discussing the SOA environment is implementing a data services layer that centralizes data access code as a service. Among the benefits of this is to allow the best practices for data access within a data access service to be identified and used frequently.

To summarize, the book makes a good technical read and provides a large number of suggestions and technical advise for improving the database application performance and scalability. It would be a better book if it could have covered some recent developments like the typicalities of database applications running on cloud architectures.

Book Review: SQL and Relational Theory

Ganadeva Bandyopadhyay — Tue, 30 Jun 2009 20:08:28 EDT

This book is intended to be an improvement over an earlier book on the same topic by the same author, namely 'Database in Depth: Relational Theory for Practitioners' . As the author states, the current book is a product of his realization of SQL being such a difficult language that it was far from obvious how to use it without violating relational principles even when covered in much depth in this earlier book, primarily for database practitioners.

One of the main features of the current book hence is the additional effort taken to have enough elucidation to connect the theory with practical SQL examples. While the theory discussion about the relational database model remains largely similar to the earlier book, there are exercises at the end of each chapter for better connecting the concepts with more examples. The answers to these exercises are included towards the end of the book.

There are about half a dozen chapters in the center of the book starting with “SQL and Relational Algebra I:The original operators” through to “Miscellaneous SQL Topics” which are the highlight of this book. There are some really lucid examples of implementing the relational definitions and theory in proper SQL in these chapters.

The slightly sarcastic tone of discussion of the author on the popular and theoretically doubtful usage of relational terms seems to be a constant companion for use of terms such as “duplicate elimination” instead of the more correct “duplication elimination”. This seems to be an attempt to challenging the maintenance of a continuous approach to try and match the SQL implementations to the theoretical definitions and concepts of Relational Model for Database Management.

One of the recent implementations of newer database models seem to be the Google proprietary Bigtable distributed storage systems. Since such proprietary models are out of public domain, it would be interesting comparing the principles behind them and the widely used relational database management systems.

To summarize, the book is a recommended read for all the database practitioners and other related professionals looking to match their implementations with the theoretical concepts and hence improving usability of the relational database model implemented within the enterprise.

Book Review: Using Google App Engine

Ganadeva Bandyopadhyay — Mon, 29 Jun 2009 19:54:36 EDT

Using Google App Engine starts with introducing cloud computing and the App Engine as a concept within the Google Implementation of cloud architectures. There is some discussion about the basic ways of developing web applications in HTML and CSS, Python and enough concepts to begin interacting with App Engine server using HTTP protocol commands. Python is to be used as a sort of controller to the HTML and CSS in front-end.

The concept of mostly HTML template to be rendered from Python code uses the Django project for the default syntax used in Google App Engine. The database that is at the back end of the Google App Engine uses a hierarchical object-oriented storage approach called as Bigtable technology. The interaction with this type of database being different from the widely used relational database models, there is an entire chapter dedicated to interfacing with this database.

The memory cache comes between the web application and the datastore and is one of the mechanisms used to improve speed of web applications. There is an interesting discussion about using the memory cache of Google App Engine as a sort of large Python dictionary.

In addition to the all these topics, the book gives a good amount of information to properly using the App Engine webapp Framework, setting up and using Google Application Engine accounts, using JavaScript, jquery and Ajax and finally, downloading and installing Google App Engine Software Development Kit (SDK) for Windows XP,Windows Vista,Macintosh and Linux Systems.

Google App Engine is part of the Platform-as-a-service approach that the Google cloud uses. Adding to the rapidly growing technical literature dealing with implementation of applications to clouds, this O'Reilly-Google Press book is dealing with making the usage of Google App Engine as detailed as possible starting from budding application developers to advanced professionals. This is a recommended read for the professionals looking to begin and ramp up their web application deployments quickly and as cleanly as possible to the Google App Engine.