5 Sil and Software Engineering

[await... cartoon image]

I was not at the temple last Full moon Poyaday. Unfortunately it wasn't something rare either. I was going somewhere, speeding past a temple and on the loud speaker I hear "… anaakulaa cha kammanthaa…" of Maha Mangala Sutra, meaning "Do righteous occupation".

Having the driving partially handed over to a thread that run's in background of my head, I took a moment to think of at jobs we see around in the modern day. In many occupations, I could think of many scenarios where people have to push across white lies or minor unethical conducts just to make sure everything runs smoother. Even if one doesn't have to lie, it might be beneficial to not to say some true facts, knowing that mentioning or exposing them would be an disadvantage. Not exposing the truth, that the other person would be interested in, might be a deal breaker as well. Hence one tells half truth.

I think of what I do for a living. A coder, a developer, if I may - a software engineer. I was happy to comprehend to myself that we, software guys face very much less scenarios in our daily work life that we have to do such minor unethical conducts. Isn't that indeed a great thing? When we write some code,we try to produce some quality code with passion, do the justification to the best design and project itself. If you are not skipping any null checks as a habit, I think its less likely a software guy would be doing anything that is a sin.

Software engineering seems to be one "anakulaa cha kammanthaa".

But wait…! (to be continued.)

Social media in your organization?

On a fine Friday evening... I was enjoying the company of good friends. Two were bankers, another a regional manager for a local brewery company, an accountant of a well established law firm, a treasury bond broker, few were marketeers and of course bunch of engineers mostly out of software industry.... the point: it was a good sample of professionals from different kind of organizations and job roles. Topic in discussion was work environments and cultures, I narrowed it down to use of social media inside corporates.

In many organizations, social networking sites were blocked. Bankers had networks that made them feel like they were kept in sandboxes, this was the same case for the well established law firm, some of the software houses were flexible while some were rigid. Marketeers seems to enjoy all the cyber realm.

Looking at so many variables that are in effect, I realize it is not very smart to generalize how different industries look at social media. But there were some facts that were so obvious therefore it was worth noticing. Coporates such as banks, law firms, brokers simply could not afford the risk of having their networks open to social networking sites, especially due to security seasons. On the other end, marketeers needed to have unblocked visibility of what-ever they want to look at. In the middle ground were software engineers, who's work environments and cultures were mostly varied due to way of thinking of their company founders. How they trusted their employees with their productivity and use of social media. Interesting!

Wait a minute! I said. Why our thinking is limited to "social networking sites" when we say "Social media"?! The way I see this, it's a most common limitation in our views. Social media should be about any media that let people socialize. Can it be just plain company web intranet? Or status message in internal messenger, a coperate micro blogging tool such as Yammer, sticky note that you paste on somebody's cubical, or the notice board on cafeteria? Yes, all of that. All of that can be ways one can express him or her self socially, so that they can make identity among the community in context. All those will reflect who you are, and ultimately it'll define the organizational culture.

I concluded the chat with my friends, with something that Dileepa pointed out at once of EC tech talk debates...  when world wide web was becoming popular on internet, companies wanted to block access to it. But today, we can't do much productive work without the world wide web! Perspectives do change, coporate policies evolve and the way we look at tools at our disposal should change. It's time to rethink, are you making most effective use of social media for your organization?

A tread of "Secure enough" after thoughts

An interesting techtalk on security at work got me into tread of thoughts on security. The popular paradigm on security is that there is no such thing called secured. From my perspective what this explain is that the reality of secure is based on the factor: “secure enough”. This is also a very debatable relative measure hence it is open for discussion.

In my opinion, the entity which needs to be secured should be “secure enough” so that the effort that requires to compromise the entity, exceeds the benefits of compromising by a highly discouraging or technically challenging gap. This leaves us at the question how we can define this gap and to do that we will have to look at how attractive the entity to be subject to a security threat. 

When we consider influences for security offenses, I believe they would fall into same categories that influence espionage as a crime. MICE! According to Ira Winkler the acronym MICE stands for Money, Ideology, Coercion and Ego that sums up influences for crime. These would make an entity more or less attractive for a security attack and depending on that it would set the price for the head - how much momentum or expense is worthwhile for the compromising process (monetary or other means). At operational stage, the momentum or expense would be converted into dollars, computation power, elapse for decrypting/brute-forcing or the size of a botnet employed.

As a developer I believe in adhering to best security practices for development from the ground level. But in realistic business scenarios, where time and money are highly appreciated and controlled resources, I believe it would be beneficial to identify a set of matrices that would roughly quantify and elaborate the security necessities for a given software or a system, to make it “secure enough”. Derived matrices and requirements, of course, would be focused on current context, will be agile and in need of constant improvement over the time like any other software requirement. If deriving such matrices is feasible, it should be possible to include that in estimations and planning frameworks that essentially provide great insight at project initiations. It would also be good support material to convince non-technical clients on resources they should spend for security aspects of their products. At the end of the day, no developer nor architect would complain having another tool to reduce the unaccounted risk and burden of software security from back their minds to a version-ed documentation.

Micro Evolution

Mobitel Internet and MMS Settings for Android 4.1

EDIT: Updated with latest settings I got from Mobitel on Aug 2012. Thanks Jani for verifying settings for Android 4.1 Jelly Beans.

Few days back I've got Internet and MMS settings configured on my Nexus S at the Mobitel Flagship Center. (its the mobitel headoffice @ Gangarama, Col 02). Let me share the setting here, probably would become helpful those who use android 2.3 phones (and above).

First to locate these settings in your phone;
Go to Settings.
Tap on Wireless & Networks.
Scroll down and tap on Mobile Networks.Tap on Access Point Names.Tap on Options key and select New APN.Now create two APNs with settings listed below, you have the Save function in Options key menu to save the values after entering.

Internet:
Name: (MobitelInternet or something you fancy)
APN:mobitel3g
Proxy: 192.168.050.163
Port: 8080
MCC: 413
MNC: 01
Authentication Type: None
APN Type: Internet
rest of the fields i kept default values.

MMS:
Name: (MobitelMMS or something you fancy)
APN: wapmms
MMSC: http://192.168.050.165
MMS proxy: 192.168.050.163
MMS port: 8080
MCC: 413
MNC : 01
APN Type: mms
Authentication Type: None
rest of the fields i kept default values.

This configuration works but it seems ideally both of these settings should be configured in one APN. But the trouble is mobitel uses two different APN values (mobitel3g & wapmms) for internet and MMS therefore we cant use one configuration for both.

In the Access point names screen there's a radio button like selection, which i assume its there to select the default Access Point. I kept my Internet settings selected as default.
DONE!

Everything works fine but I see that phone has delays downloading MMS sometimes. Probably the phone switches between two Access Points upon failure trying to download MMS using Internet APN. If using the same APN for both becomes the standard then I believe Mobitel would adapt to that (sooner or) later!

Happy browsing!