I’m porting over my review of Ruby Under a Microscope from Amazon.com (link to the review) because I was in the process of migrating my content from my old blog to this blog and did not have a platform where I could post reviews. Enjoy!
The Review
TL;DR: » This book does an excellent job of explaining the C implementation of Ruby. It’s very well organized and takes you on a step by step journey through Ruby. It’s mainly focused on the C implementation but it does describe other implementations, albeit with not as much detail as I would have liked.
If you’re curious for how things work (like me), you’ll really enjoy this book. The seemingly “magic” things that Ruby does all have a clear and straightforward, step-by-step, explanation.
What I liked:
The book is well organized and explains some very complicated topics in a very understandable way.
Figures are repeated so you don’t have to flip back and forth (a little thing but very helpful)
Has a very computer-science-like feel to it. It’s a fun read if you’re a computer science geek like me.
What I didn’t like:
The chapter on JRuby is severely lacking in my opinion. Given that the other chapters did a nice deep dive on the given topic, I felt a little bit cheated on the JRuby chapter. This was more of a really broad overview of JRuby with one or two examples.
The book explains a complicated topic in several chapters but you’re left to put everything together on your own. I would have liked to have seen one additional chapter that took a sufficient Ruby program and did a full walk through of all the concepts you’d learned in the previous chapters; basically, a top to bottom overview chapter.
Who can/should read this:
Anyone interested in programming languages or implementing your own programming language.
Those who want to become better Ruby developers.
Prereqs:
You’ll need to know a little bit of C to understand the standard Ruby implementation examples but other than that, there’s no prereqs. You don’t really even need to know Ruby that well ( I don’t ). If you don’t understand what the piece of Ruby code is doing, it’s easy to look up online to quickly figure out what it does.
I’m back with another book review. This time I’ll be reviewing Java Coding Guidelines by Fred Long, et al. This is sort of the 2nd edition of The CERT Oracle Secure Coding Standard for Java. I had previously done a review on the “1st edition” and was asked to follow up with a review on this latest edition. I must say, I enjoyed this version much more. It’s substantially shorter, better organized, and to the point.
TL;DR »
Java has had a bad rap for security lately (particularly around it’s ancient Applet technology).
Read chapter 1 to learn how to become a more secure Java Developer. Read the remaining chapters to learn how to become a better Java developer overall.
About the Book: Audience, Skill Level, Prerequisites
The subtitle for this book is
"75 Recommendations for Reliable and Secure Program."
It’s an accurate description with one chapter on security and the remaining three chapters on reliability. This book is geared towards professional Java developers and goes through many of the idiosyncrasies of Java that you have to watch out for. Some of those idiosyncrasies can lead to catastrophic bugs and vulnerabilities, others may just lead to many hours of annoying-debugging-only-to-find-out-that-you’ve-done-something-really-really-stupid™ ;). I’d recommend that you’ve had experience programming Java for 1 to 2 years before you read this as anything before that and you might not fully grasp the importance of some of the recommendations.
Thoughts on the book
I think a better name for this book would have been, “How to be a Extremely Paranoid, Secure, and Awesome Java Developer.”
This book is all about dotting your i’s and crossing your t’s. Similar to how I mentioned that the previous edition was like Josh Bloch’s Effective Java, this book is all about teaching you how to a be a better Java developer and how to avoid mistakes that only a seasoned Java developer would know. Given that my day job is being a Software Engineer, programing in Java, I plan to hold on to this book at my desk for a couple of reasons.
Whenever I need to teach a junior developer about “a bad way of doing things,” I can pull out this book and refer them to an example, along with a compliant solution.
I can lend it to junior developers looking to improve and learn more.
Side note: Shout out to the Authors for using Utah (my home state) in their #8 recommendation: Prevent XPath Injection. Come visit and hit the slopes some time ;)
Applicability to Security
Given that the focus of this blog is on computer security, I’ll touch on the security points throughout the book.
Chapter 1 is all about security. Many of the recommendations are general security advice with an example of how they’d apply in Java. There are some interesting recommendations that are more Java specific though.
Recommendation #18: "Do not expose methods that use reduced-security checks to unstrusted code,"
is particularly interesting as this recommendation actually has real applicability. Failure to follow this recommendation resulted in a couple of CVE’s (CVE-2012-4681, CVE-2013-0422).
Outside of the explicit chapter on security, you actually might be amazed at how a seemingly minor bug or action can result in a serious security vulnerability. There are a couple of examples worth mentioning.
Recommendation #46: "Do not serialize direct handles to system resources."
In retrospect, this one seems glaringly obvious, however, I had never given any thought to it. Essentially, if you serialize a Java object, that opens a file, to disk, you can edit the bytes representing the object to change what file is accessed when the file is deserialized. The first thing that comes to mind with this is Minecraft. It’d be interesting to see if anyone has ever leveraged this for exploitation.
At first, this one doesn’t seem like it’s that big of a deal, however, it has resulted in many security vulnerabilities over the years. What it recommends, is to not return values that represent an error, and instead throw an Exception. The reason for this is that calling code often does not check for failing return values resulting in the succeeding code accessing a file or data that may be in an inconsistent state. This type of vulnerability is leftover from the earlier languages like ‘C’ which would return -1 or other negative values to indicate an error.
Conclusion
Overall, great book and easy book to read if you’re familiar with Java. Final rating, 4.5 out of 5. Dustin
I’ve been dying to get this review out for a while now. There’s so much good and deep content in this book, that reading it on nights after work and weekends took longer than expected! I’ll tell you now that if you’re into computers and computer security, this book won’t let you down. This book is like having your very own personal malware analysis teacher without the expensive training costs.
About the Book
The book material is exhaustingly complete with 21 chapters + appendices covering everything from static analysis, environment setup, x86 assembly to anti-disassembly and anti-virtual machine practices. Total book content, minus lab solutions comes in at an enormous 475 pages (with lab solutions, 732 pages) . Let’s just say that you better be prepared to eat, breathe, and live malware analysis for quite some time.
The skill level for the book is targeted at someone with experience in programming and security although an ambitious beginner should do fine.
My Review & Recommendation
The authors, Michael Sikorski and Andrew Honig, do a great job of teaching the concepts and not just the tools. They want you to develop the skills necessary to think on your own as a malware analyst so that when new techniques come out that aren’t in the book, you’ll have the mental tools to figure out the challenges. Don’t worry though, this book isn’t filled with boring theory like those books you read back in school, the concepts taught have actual practical uses.
Better yet, the book gives you the opportunity to apply the concepts with labs at the end of each chapter. You’ll actually be dissecting “real malware” written by the authors for the purposes of this book.
Equally as awesome is that each lab comes with a “quick solution” and a “detailed solution.” I learn best when I can fight through a tough problem and check with the solution when I’m stuck.
The book is entirely centered around Windows based malware, particularly malware written for Windows XP. This was a good learning experience for me because I’m not familiar with the internal Windows APIs and features. It’d actually be very interesting if the authors included a section on Linux-based and/or Mac-based malware. On that note, I did actually try to run some of the lab malware on Windows 7 32 and 64 bit thinking that it would be no big deal but I received an APPCRASH error every time. I spoke with one of the authors over email and he was very helpful. He said that the malware was designed for Windows XP for teaching purposes that will be revealed when reading the book. With this slight limitation comes some positive: it leaves room for a 2nd edition of the book focused on the newer Vista/7 features as malware becomes more prominent on these machines.
Book content aside, the physical paperback book itself is a pleasant surprise. NoStarch Press is one of my favorite publishers because they use the “lay-flat” type binding (they also published one of my other favorite books: Hacking the Art of Exploitation. You’ll be praising this when you want to set the book down and copy some code.
The book does also come in digital formats. I used a combination of both for the review. You won’t be an expert in malware analysis when you’re done with this book but it sure as hell will give you the information you need to get there.
This book is broad, covering a ton of topics. Each Chapter could have likely been a book in and of itself. As I’ve said in a previous post, this book will become the de facto standard for learning about malware analysis.
Thanks to No Starch Press for the review copy, this book is awesome!
