Reviews of C Primer Plus, 4th Ed, The Myth of Homeland Security, and Beyond Fear Posted

Amazon.com just publishes three new reviews. First, from the five star review of C Primer Plus, 4th Ed by Stephen Prata:

"Stephen Prata's C Primer Plus, 4th Ed (CPP4E) is an excellent book. I took a close look at the competition and even started reading O'Reilly's Practical C Programming before realizing CPP4E was the book for me. I had no C programming background, but had the knowledge of C-64 BASIC, Pascal, and other languages shared by many kids born in the 1970s. If you're looking for a well-conceived introduction to C, Prata's book is for you."

I plan to read books on secure coding and socket programming next, as these are my real interests. I also have books on C++, Java, and C# waiting. I'm reading these to gain familiarity with these languages for purposes of security, not contributing code to FreeBSD (yet).

Next are two more controversial reviews. Although I gave each book four stars, I make specific critiques of each book. From my four star review of The Myth of Homeland Security by Marcus Ranum:

"Let's set the record straight. This book is a 231 page political rant, regardless of the author's claim on p. 31 to be 'nonideological.' I have the slightly odd benefit of reading this book with a master's degree in public policy on the wall, but I work as a hands-on, FreeBSD-running computer security consultant. I imagine many readers are also members of the technical community, yet are unaware of books addressing similar topics. "The Myth of Homeland Security" cannot compare to a serious book like James Q. Wilson's Bureaucracy: What Government Agencies Do and Why They Do It. I'll tell you why and conclude with my rationale for 4 stars, nonetheless...

So why do I give The Myth 4 stars? At least somebody is raising important issues. Ranum may be the crazy guy yelling crude remarks at a quiet moment during a political rally, but thank goodness he's there. It's great to see someone realize what a mess our appropriations process has become, and decide to join the fray. Political scientists spend their entire lives chipping away at the same problems. Welcome to the party, Mr. Ranum, and thanks for your work. "

Finally, from my four star review of Beyond Fear by Bruce Schneier:

"Beyond Fear is a good book, but don't turn to it for proper definitions of security terms. Steer clear of this book's misuse of the words 'threat' and 'risk.' While I appreciate Schneier's overall discussion of security issues, I expect a book aimed at the layman to be more accurate...

I loved Secrets and Lies, and every time I see the author speak I learn something new. Am I off base with this review? You be the judge. I still gave it 4 stars, since the book's vignettes are informative and its scope impressive. Given the large number of reviewers I expected someone to challenge the author's terminology. Yes, this is semantics, but shouldn't a book by an expert set the record straight? I don't think my expectations are unrealistic, either; Schneier is a previously published 'thought leader,' and he deserves to be held to the highest possible standards."

Reading the full text of each review, especially those on Ranum and Schneier, will make these points clearer. As of the time of writing this report, Amazon.com has published an incorrectly edited version of the Schneier review missing the word "a" in the first sentence. I expect that to be fixed soon.

I'm sure I'm opening myself up to criticism by publishing these reviews, especially for Schneier's book. All the other reviews rave about it, so anything less than five stars will single me out. Nevertheless, I believe it's important to take a close look at Schneier's work in the interest of improving whatever comes next. Since so many people in the community pay attention to what he says, I want to make sure his message is clear.

Comments

Anonymous said…
This comment has been removed by a blog administrator.
4:48 PM
Anonymous said…
This comment has been removed by a blog administrator.
7:46 AM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more