- Create clearly defined, small chunks of work (i.e., user stores)
- Hold daily “standups” before starting work each day
- Keep track of how long it takes you to do tasks and how many tasks get completed in a sprint
- Communicate frequently with the client, to provide regular updates and product releases and solicit feedback and input
POST http://bank.com/transfer.do HTTP/1.1 ... ... ... Content-Length: 19; acct=BOB&amount=100However, Maria notices that the same web application will execute the same transfer using URL parameters as follows:
GET http://bank.com/transfer.do?acct=BOB&amount=100 HTTP/1.1Maria now decides to exploit this web application vulnerability using Alice as her victim. Maria first constructs the following URL which will transfer $100,000 from Alice's account to her account:
http://bank.com/transfer.do?acct=MARIA&amount=100000Now that her malicious request is generated, Maria must trick Alice into submitting the request. The most basic method is to send Alice an HTML email containing the following:
<a href="http://bank.com/transfer.do?acct=MARIA&amount=100000">View my Pictures!</a>Assuming Alice is authenticated with the application when she clicks the link, the transfer of $100,000 to Maria's account will occur. However, Maria realizes that if Alice clicks the link, then Alice will notice that a transfer has occurred. Therefore, Maria decides to hide the attack in a zero-byte image:
<img src="http://bank.com/transfer.do?acct=MARIA&amount=100000" width="1" height="1" border="0">If this image tag were included in the email, Alice would only see a little box indicating that the browser could not render the image. However, the browser will still submit the request to bank.com without any visual indication that the transfer has taken place.
import java.io.*;
public class Foo implements AutoCloseable {
private final ObjectInputStream in;
public Foo() throws IOException {
in = new ObjectInputStream(
new BufferedInputStream(
new FileInputStream("data.bin")));
}
public void close() throws IOException {
in.close();
}
protected void finalize() throws Throwable {
close();
super.finalize();
}
}
However, did you know that you could also construct the
ObjectInputStream inside the field, as long as you had a
constructor that threw the IOException? I knew this was
possible, but to my shame I had not tried it out. Here is
what you could do:
import java.io.*;
public class Foo implements AutoCloseable {
private final ObjectInputStream in =
new ObjectInputStream(
new BufferedInputStream(
new FileInputStream("data.bin")));
public Foo() throws IOException {
}
public void close() throws IOException {
in.close();
}
protected void finalize() throws Throwable {
close();
super.finalize();
}
}
Premature optimization is the source of all evil
-Donald Knuth
There are two ways of constructing a software design:
One way is to make it so simple that there are obviously no deficiencies and the other way is to make it so complicated that there are no obvious deficiencies.
-C.A.R. Hoare, The 1980 ACM Turing Award Lecture
Any fool can write code that a computer can understand. Good programmers write code that humans can understand.
-Martin Fowler
Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it.
-Brian W. Kernighan and P. J. Plauger in The Elements of Programming Style.
[Most managers] may defend the schedule and requirements with passion; but that’s their job. It’s your job to defend the code with equal passion
-Robert Martin (Uncle Bob), Clean code
The first 90% of the code accounts for the first 90% of the development time. The remaining 10% of the code accounts for the other 90% of the development time
-Tom Cargil Bell labs
Before software can be reusable it first has to be usable.
-Ralph Johnson
Always code as if the guy who ends up maintaining your code will be a violent psychopath who knows where you live.
-Rick Osborne
The best way to predict the future is to implement it.
-Alan Key
Talk is cheap. Show me the code.
-Linus Torvalds
Perl – The only language that looks the same before and after RSA encryption.
-Keith Bostic
I invented the term ‘Object-Oriented’, and I can tell you I did not have C++ in mind.
-Alan Kay
Most good programmers do programming not because they expect to get paid or get adulation by the public, but because it is fun to program.
-Linus Torvalds
Controlling complexity is the essence of computer programming.
-Brian Kernighan
