<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: fires]]></title>
    <link>http://securityratty.com/tag/fires</link>
    <description></description>
    <pubDate>Thu, 29 May 2008 09:31:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Pentagon Shoots $22 Million into Guided Bullet Tech]]></title>
      <link>http://securityratty.com/article/bb25759405d7edcc65cd7a767c497bd6</link>
      <guid>http://securityratty.com/article/bb25759405d7edcc65cd7a767c497bd6</guid>
      <description><![CDATA[Darpa, the Defense Department's far-out research arm, announced a pair of contracts yesterday, to start designing a super, .50-caliber sniper rifle that fires guided bullets. Lockheed Martin recieved...]]></description>
      <content:encoded><![CDATA[Darpa, the Defense Department's far-out research arm, announced a pair of contracts yesterday, to start designing a super, .50-caliber sniper rifle that fires guided bullets. Lockheed Martin recieved $12.3 million for the "EXACTO" (EXtreme ACcuracy Tasked Ordnance) project, while Teledyne Scientific & Imaging, LLC got another $9.5 million.<img src="http://feedproxy.google.com/~r/digg/topic/security/popular/~4/ru7emzNJnnk" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 28 Nov 2008 00:20:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/million">million</category>
      <category domain="http://securityratty.com/tag/50-caliber sniper rifle">50-caliber sniper rifle</category>
      <category domain="http://securityratty.com/tag/far-out research arm">far-out research arm</category>
      <category domain="http://securityratty.com/tag/extreme accuracy">extreme accuracy</category>
      <category domain="http://securityratty.com/tag/contracts yesterday">contracts yesterday</category>
      <category domain="http://securityratty.com/tag/teledyne scientific">teledyne scientific</category>
      <category domain="http://securityratty.com/tag/defense department">defense department</category>
      <category domain="http://securityratty.com/tag/project">project</category>
      <category domain="http://securityratty.com/tag/exacto">exacto</category>
      <source url="http://feeds.digg.com/~r/digg/topic/security/popular/~3/ru7emzNJnnk/Pentagon_Shoots_22_Million_into_Guided_Bullet_Tech">Pentagon Shoots $22 Million into Guided Bullet Tech</source>
    </item>
    <item>
      <title><![CDATA[Accenture CIO Modruson is not just putting out fires]]></title>
      <link>http://securityratty.com/article/58836d9c09733dca1575325dc946aa94</link>
      <guid>http://securityratty.com/article/58836d9c09733dca1575325dc946aa94</guid>
      <description><![CDATA[Being an IT leader is tough enough at the best of times, but what do you do when your company is stacked with IT experts? 'Make the most of it' would appear to be the attitude of Frank Modruson, CIO...]]></description>
      <content:encoded><![CDATA[Being an IT leader is tough enough at the best of times, but what do you do when your company is stacked with IT experts? 'Make the most of it' would appear to be the attitude of Frank Modruson, CIO of Accenture, one of the world's biggest management consulting, technology services and outsourcing companies.]]></content:encoded>
      <pubDate>Mon, 27 Oct 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/frank modruson">frank modruson</category>
      <category domain="http://securityratty.com/tag/technology services">technology services</category>
      <category domain="http://securityratty.com/tag/cio">cio</category>
      <category domain="http://securityratty.com/tag/accenture">accenture</category>
      <category domain="http://securityratty.com/tag/leader">leader</category>
      <category domain="http://securityratty.com/tag/world">world</category>
      <category domain="http://securityratty.com/tag/companies">companies</category>
      <category domain="http://securityratty.com/tag/attitude">attitude</category>
      <category domain="http://securityratty.com/tag/tough">tough</category>
      <source url="http://www.networkworld.com/news/2008/102808-accenture-cio-modruson-is-not.html?fsrc=rss-security">Accenture CIO Modruson is not just putting out fires</source>
    </item>
    <item>
      <title><![CDATA[Turning off Fire Hydrants in the Name of Terrorism]]></title>
      <link>http://securityratty.com/article/f6930719122f72be0df5cd2f10adaea5</link>
      <guid>http://securityratty.com/article/f6930719122f72be0df5cd2f10adaea5</guid>
      <description><![CDATA[This really pegs the stupid meter: He explains all the district's hydrants, including those in Alexander Ranch, have had their water turned off since just after 9/11 -- something a trade association...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.wfaa.com/sharedcontent/dws/wfaa/latestnews/stories/wfaa080827_lj_hawes.1983f2d0.html">This</a> really pegs the stupid meter:</p>

<blockquote>He explains all the district's hydrants, including those in Alexander Ranch, have had their water turned off since just after 9/11 -- something a trade association spokesman tells us is common practice for rural systems.

<p>"These hydrants need to be cut off in a way to prevent vandalism or any kind of terrorist activity, including something in the water lines," Hodges said.</p>

<p>But Hodges says fire departments know, or should have known, the water valves can be turned back on with a tool.</blockquote></p>

<p>One, fires are much more common than terrorism -- keeping fire hydrants on makes much more sense than turning them off.  Two, what sort of terrorism is possible using working fire hydrants?  Three, if the water valves can be "turned back on with a tool," how does turning them off prevent fire-hydrant-related terrorism?</p>

<p>More and more, it seems as if public officials in this country have simply gone insane.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=65IeL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=65IeL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=A1h0L"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=A1h0L" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 11 Sep 2008 09:59:42 +0000</pubDate>
      <category domain="http://securityratty.com/tag/hydrants">hydrants</category>
      <category domain="http://securityratty.com/tag/fire hydrants">fire hydrants</category>
      <category domain="http://securityratty.com/tag/water valves">water valves</category>
      <category domain="http://securityratty.com/tag/water">water</category>
      <category domain="http://securityratty.com/tag/terrorism">terrorism</category>
      <category domain="http://securityratty.com/tag/water lines">water lines</category>
      <category domain="http://securityratty.com/tag/prevent">prevent</category>
      <category domain="http://securityratty.com/tag/common">common</category>
      <category domain="http://securityratty.com/tag/prevent vandalism">prevent vandalism</category>
      <source url="http://www.schneier.com/blog/archives/2008/09/turning_off_fir.html">Turning off Fire Hydrants in the Name of Terrorism</source>
    </item>
    <item>
      <title><![CDATA[EPTS: Proposed Event Processing Definitions, September 20, 2006]]></title>
      <link>http://securityratty.com/article/c90d53785950324b36b55747a92766da</link>
      <guid>http://securityratty.com/article/c90d53785950324b36b55747a92766da</guid>
      <description><![CDATA[For interested readers, here are the event processing definitions we provided to the (future) EPTS working group on September 20, 2006, coordinated (edited)by David Luckham and Roy Schulte
adaptive...]]></description>
      <content:encoded><![CDATA[<p>For interested readers, here are the <a href="http://www.thecepblog.com/pdf/EVENT.PROCESSING.DRAFT.GLOSSARY.V4.SEPT.pdf" target="_blank">event processing definitions</a> we provided to the (future) EPTS working group on September 20, 2006, <a href="http://complexevents.com/?p=195" target="_blank">coordinated (edited) by David Luckham and Roy Schulte</a>;</p>
<p><strong>adaptive process management</strong> (n.) an element of resource and business process management, adaptive search and event processing. Sometimes referred to as “Level 4” event processing or process refinement.</p>
<p><strong>application concept</strong> (n.) a definition of a set of properties that represent the data fields of an application entity. An application concept can describe relationships among themselves. For example, an order concept might have a parent/child relationship with an item concept. A department concept might be related to a purchase requisition concept based on the shared property, department_id. Application concepts can include an application state model.</p>
<p><strong>application state modeler</strong> (n.) a UML-compliant application that allows you to model the life cycle of a concept instance — that is, for each instance of a given concept, you can define which states it will pass through and how it will transition from state to state. States have entry actions, exit actions, and conditions, providing precision control over the behavior of an event processing agent. Transitions between states also may have rules. Multiple types of states and transitions maximize the versatility and power of the application state modeler.</p>
<p><strong>derived event</strong> (n.) an event that is created as a result of processing one or more other events.</p>
<p><strong>complex event</strong> (n.) an event that is a situation-entity abstraction of two or more simple, derived or other complex events.</p>
<p><strong>complex event processing</strong> (n.) CEP is a technology for extracting information from message-based systems. CEP is primarily an event processing concept that deals with the task of processing multiple events from an event cloud with the goal of identifying the meaningful events within the event cloud. CEP employs techniques such as detection of complex patterns of many events, event correlation and abstraction, event hierarchies, and relationships between events such as causality, membership, and timing, and event-driven processes.</p>
<p><strong>event</strong> (n.) a instance of an event definition. It is an immutable object that represents a business activity that happened at a single point in time. Just as one cannot change the fact that a given activity occurred, one cannot change an event — events are immutable.</p>
<p><strong>event aggregation</strong> (n.) the aggregation of simple, derived or complex events into higher levels of event abstractions.</p>
<p><strong>event definition</strong> (n.) a set of properties related to a given activity that represents an important or interesting change of state in a human, system or computational activity. An event definition includes event properties such as event priority, event time to live (TTL), and a description of the payload, which is comprehensive information related to the activity that occurred. Events expire when the TTL has elapsed, unless the event processing agent has instructions to consume them prior to that time.</p>
<p><strong>event channel</strong> (n.) a communications channel in which events are transmitted from event source to event receivers, typically received as electronic messages. Each channel can have multiple destination and. events can be configured to transmit to a default destination. JMS is an example of an event channel.</p>
<p><strong>event cloud</strong> (n.) a partially ordered set of events (poset), either bounded or unbounded, where the partial orderings are imposed by the causal, timing and other relationships between the events. Typically an event cloud is created by the events produced by one or more distributed systems. An event cloud may contain many event types, event streams and event channels. The difference between a cloud and a stream is that there is no event relationship that totally orders the events in a cloud.</p>
<p><strong>event-driven</strong> (n.) the behavior of a human, system or computational entity whose execution or actuation is in response to events, typically received as electronic messages.</p>
<p><strong>event-driven architecture</strong> (n.) an architectural style for distributed computing applications in which some of the components are event-driven and communicate by means of events.</p>
<p><strong>event processing</strong> (n.) computing that performs operations on events, including modifying, creating and destroying events.</p>
<p><strong>event-object</strong> (n.) an software object that represents an event, generally for the purpose of computer processing, that exhibits both encapsulation, inheritance and polymorphism.</p>
<p><strong>event prediction</strong> (n.) computational activity where the impact of events, complex events, and situations caused by events identified, including both opportunity or threat. Sometimes referred to as “Level 2” event processing, impact assessment or predictive analytics.</p>
<p><strong>event pre-processing</strong> (n.) computational activity where events are cleansed or normalized to produce semantically understandable data. Sometimes referred to as “Level 0” event processing.</p>
<p><strong>event processing</strong> (n.) computational activities on events dealing with the association, correlation, and combination of event data and information from single and multiple event sources to achieve refined identity and situation estimates for observed event objects, and to achieve complete and timely assessments of opportunities, threats, and their significance. Event processing is characterized by continuous refinements of event estimates and assessments and by evaluation of the need for additional sources, or modification of the process itself, to achieve improved results.</p>
<p><strong>event processing agent</strong> (n.) an EPA is a computational entity that performs event processing.</p>
<p><strong>event processing network</strong> (n.) a set of event processing agents and a set of event channels connecting them.</p>
<p><strong>event properties</strong> (n.) data representation of an event, typically by name-value pairs of type string, integer, real, boolean or a complex data type.</p>
<p><strong>event refinement</strong> (n.) filter, identify and track events &amp; make initial processing decisions based on association, correlation and state estimation. Sometimes referred to as “Level 1” event, or event-object, track and trace.</p>
<p><strong>event stream</strong> (n.) a time-ordered sequence of events. An event stream may be bounded by a certain time interval or other contextual dimension (content, space, source, certainty), or be open ended and unbounded.</p>
<p><strong>event stream processing</strong> (n.) a time-ordered sequence of events. An event stream may be bounded by a certain time interval or other contextual dimension (content, space, source, certainty), or be open ended and unbounded.</p>
<p><strong>rule</strong> (n.) defines what triggers unusual, suspicious, problematic, or advantageous activity within an event processing agent and what the EPA does when it discovers these types of activities. Rules execute actions based on certain conditions on events, instances, or a combination of both. A rule includes a group of condition-rule statements and action-rule statements. The condition statements instruct the EPA what to look for in events, and action statements instruct the EPA how to respond when conditions are met. If all the conditions in a rule are satisfied by events or instances or both, the EPA fires the actions. The action might be to execute tasks, create an event instance, modify property values in an event instance, create and send an event, or something else.</p>
<p><strong>rules engine</strong> (n.) a type of event processing agent that uses a declarative programming model to process events. Formally described as &#8220;an abstract structure that describes a formal language precisely, i.e., a set of rules that mathematically delineates a (usually infinite) set of finite-length strings over a (usually finite) alphabet“. Informally, it can be any system that uses rules, in any form, that can be applied to data to produce outcomes.</p>
<p><strong>rule language</strong> (n.) is an artificial language that is used to control the behavior of an event processing agent. Rules languages, like human languages, have syntactic and semantic rules to define meaning.</p>
<p><strong>situation refinement</strong> (n.) identify situations, or complex events, based on event clustering, event-event relationships and relationship analysis and context. Sometimes referred to as “Level 2” event processing.</p>
<p><strong>simple event</strong> (n.) an event that is not an abstraction or composition of other events.</p>
<p><strong>virtual event</strong> (n.) an event that is imagined, modeled or simulated.</p>
<hr />Note:  The Emerging Technologies Engineering Team at <a href="http://www.tibco.com" target="_blank">TIBCO Software </a>significantly contributed to these event processing terms and definitions.</p>
]]></content:encoded>
      <pubDate>Thu, 21 Aug 2008 01:47:11 +0000</pubDate>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/event-object">event-object</category>
      <category domain="http://securityratty.com/tag/business process management">business process management</category>
      <category domain="http://securityratty.com/tag/process">process</category>
      <category domain="http://securityratty.com/tag/event correlation">event correlation</category>
      <category domain="http://securityratty.com/tag/process refinement">process refinement</category>
      <category domain="http://securityratty.com/tag/simple">simple</category>
      <category domain="http://securityratty.com/tag/simple event">simple event</category>
      <category domain="http://securityratty.com/tag/process events">process events</category>
      <source url="http://www.thecepblog.com/2008/08/21/epts-proposed-event-processing-definitions-september-20-2006/">EPTS: Proposed Event Processing Definitions, September 20, 2006</source>
    </item>
    <item>
      <title><![CDATA[Video: Iran's Mega Missile Test]]></title>
      <link>http://securityratty.com/article/10565b03da6063f437ebcc11542f7281</link>
      <guid>http://securityratty.com/article/10565b03da6063f437ebcc11542f7281</guid>
      <description><![CDATA[Iran's Revolutionary Guards test fires a slew of missiles but there is one in particular Western observers are examining with particular care: a 56 foot-long Shahab-3 missile which, if it works as...]]></description>
      <content:encoded><![CDATA[Iran's Revolutionary Guards test fires a slew of missiles but there is one in particular Western observers are examining with particular care: a 56 foot-long Shahab-3 missile which, if it works as planned, has enough reported range to hit Israeli soil and some American bases overseas.<br style="clear: both;"/>
      <a href="http://www.pheedo.com/click.phdo?s=c675b0337de4dd428c634cc6ea18889b"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=c675b0337de4dd428c634cc6ea18889b"/></a>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=c675b0337de4dd428c634cc6ea18889b" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=76B5RJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=76B5RJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=hcwaMj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=hcwaMj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=R4Xwyj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=R4Xwyj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=ZEPSzJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=ZEPSzJ" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=6qo4vJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=6qo4vJ" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=bp5DIj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=bp5DIj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=oI2Lqj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=oI2Lqj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=uatp0J"><img src="http://feeds.wired.com/~f/wired/politics/security?i=uatp0J" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/330839532" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/330839547" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 09 Jul 2008 00:09:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/foot-long shahab-3 missile">foot-long shahab-3 missile</category>
      <category domain="http://securityratty.com/tag/american bases overseas">american bases overseas</category>
      <category domain="http://securityratty.com/tag/hit israeli soil">hit israeli soil</category>
      <category domain="http://securityratty.com/tag/western observers">western observers</category>
      <category domain="http://securityratty.com/tag/iran">iran</category>
      <category domain="http://securityratty.com/tag/missiles">missiles</category>
      <category domain="http://securityratty.com/tag/range">range</category>
      <category domain="http://securityratty.com/tag/care">care</category>
      <category domain="http://securityratty.com/tag/slew">slew</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/330839547/video-irans-mis.html">Video: Iran's Mega Missile Test</source>
    </item>
    <item>
      <title><![CDATA[Mashup of the Titans]]></title>
      <link>http://securityratty.com/article/6289294023616c0d4219941919c976a5</link>
      <guid>http://securityratty.com/article/6289294023616c0d4219941919c976a5</guid>
      <description><![CDATA[Information Security - an Oxymoron for the information age

Always the beautiful answer who asks a more beautiful question. e. e. cummings
or why i am with Gelernter

This is a mashup of Saltzer &amp;...]]></description>
      <content:encoded><![CDATA[<div>Information Security - an Oxymoron for the information age</div><br /><div>“Always the beautiful answer who asks a more beautiful question.” e. e. cummings</div><div>...or why i am with Gelernter</div><br /><div>This is a mashup of Saltzer &amp; Schroeder&#39;s famous <a href="http://www.cs.virginia.edu/~evans/cs551/saltzer/">information security principles</a> with David Gelernter&#39;s <a href="http://www.edge.org/documents/archive/edge70.html">Manifesto</a>.</div><br /><div>The premise of this mashup is to examine the paper by Saltzer and Schroeder which was written in 1975 and serves as the basis for most information security programs against the Gelernter&#39;s manifesto as to where computing is actually going. Each of the eight principles in Saltzer and Schroeder&#39;s paper is listed in order, and followed by select excerpts of Gelernter&#39;s manifesto. This comparison is to examine theoretical information security principles vis a vis the actual utility of modern information systems. I will not make an attempt to reconcile theory and practice, but will point out where the two schools of thought agree. In fairness, Saltzer and Schroeder&#39;s paper was written 25 years before Gelernter&#39;s, however Saltzer and Schroeder&#39;s principles dominate the thinking about information security to this day and so its important to view them side by side with Gelernter&#39;s thinking on the direction of computing.</div><br /><div style="color: #bf5f00; ">Saltzer and Schroeder:</div><div>&quot;a) Economy of mechanism: Keep the design as simple and small as possible. This well-known principle applies to any aspect of a system, but it deserves emphasis for protection mechanisms for this reason: design and implementation errors that result in unwanted access paths will not be noticed during normal use (since normal use usually does not include attempts to exercise improper access paths). As a result, techniques such as line-by-line inspection of software and physical examination of hardware that implements protection mechanisms are necessary. For such techniques to be successful, a small and simple design is essential.&quot;</div><br /><div style="color: #0060bf; ">Gelernter:</div><div>&quot;9. The computing future is based on &quot;cyberbodies&quot; — self-contained, neatly-ordered, beautifully-laid-out collections of information, like immaculate giant gardens.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;So far, so good</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;b) Fail-safe defaults: Base access decisions on permission rather than exclusion. This principle, suggested by E. Glaser in 1965,8 means that the default situation is lack of access, and the protection scheme identifies conditions under which access is permitted. The alternative, in which mechanisms attempt to identify conditions under which access should be refused, presents the wrong psychological base for secure system design. A conservative design must be based on arguments why objects should be accessible, rather than why they should not. In a large system some objects will be inadequately considered, so a default of lack of permission is safer. A design or implementation mistake in a mechanism that gives explicit permission tends to fail by refusing permission, a safe situation, since it will be quickly detected. On the other hand, a design or implementation mistake in a mechanism that explicitly excludes access tends to fail by allowing access, a failure which may go unnoticed in normal use. This principle applies both to the outward appearance of the protection mechanism and to its underlying implementation.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;A conservative design principle that puts the object&#39;s owner in control of permissions. This makes a lot of sense from the object point of view, but does little to address the use case in which it executes.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;c) Complete mediation: Every access to every object must be checked for authority. This principle, when systematically applied, is the primary underpinning of the protection system. It forces a system-wide view of access control, which in addition to normal operation includes initialization, recovery, shutdown, and maintenance. It implies that a foolproof method of identifying the source of every request must be devised. It also requires that proposals to gain performance by remembering the result of an authority check be examined skeptically. If a change in authority occurs, such remembered results must be systematically updated.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;8. The software systems we depend on most today are operating systems (Unix, the Macintosh OS, Windows et. al.) and browsers (Internet Explorer, Netscape Communicator...). Operating systems are connectors that fasten users to computers; they attach to the computer at one end, the user at the other. Browsers fasten users to remote computers, to &quot;servers&quot; on the internet.</div><br /><div>Today&#39;s operating systems and browsers are obsolete because people no longer want to be connected to computers — near ones OR remote ones. (They probably never did). They want to be connected to information. In the future, people are connected to cyberbodies; cyberbodies drift in the computational cosmos — also known as the Swarm, the Cybersphere.</div><br /><div>13. Any well-designed next-generation electronic gadget will come with a ``Disable Omniscience&#39;&#39; button.</div><br /><div>17. A cyberbody can be replicated or distributed over many computers; can inhabit many computers at the same time. If the Cybersphere&#39;s computers are tiles in a paved courtyard, a cyberbody is a cloud&#39;s drifting shadow covering many tiles simultaneously.</div><br /><div>20. If a million people use a Web site simultaneously, doesn&#39;t that mean that we must have a heavy-duty remote server to keep them all happy? No; we could move the site onto a million desktops and use the internet for coordination. The &quot;site&quot; is like a military unit in the field, the general moving with his troops (or like a hockey team in constant swarming motion). (We used essentially this technique to build the first tuple space implementations. They seemed to depend on a shared server, but the server was an illusion; there was no server, just a swarm of clients.) Could Amazon.com be an itinerant horde instead of a fixed Central Command Post? Yes.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;Complete mediation provides the underpinning for Saltzer and Schroeder&#39;s system, but does not appear to scale to the desired itinerant horde at least in common interpretation.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;d) Open design: The design should not be secret. The mechanisms should not depend on the ignorance of potential attackers, but rather on the possession of specific, more easily protected, keys or passwords. This decoupling of protection mechanisms from protection keys permits the mechanisms to be examined by many reviewers without concern that the review may itself compromise the safeguards. In addition, any skeptical user may be allowed to convince himself that the system he is about to use is adequate for his purpose. Finally, it is simply not realistic to attempt to maintain secrecy for any system which receives wide distribution.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;both seem to agree, hard to get the itinerant horde moving in a swarm without open standards.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;e) Separation of privilege: Where feasible, a protection mechanism that requires two keys to unlock it is more robust and flexible than one that allows access to the presenter of only a single key. The relevance of this observation to computer systems was pointed out by R. Needham in 1973. The reason is that, once the mechanism is locked, the two keys can be physically separated and distinct programs, organizations, or individuals made responsible for them. From then on, no single accident, deception, or breach of trust is sufficient to compromise the protected information. This principle is often used in bank safe-deposit boxes. It is also at work in the defense system that fires a nuclear weapon only if two different people both give the correct command. In a computer system, separated keys apply to any situation in which two or more conditions must be met before access should be permitted. For example, systems providing user-extendible protected data types usually depend on separation of privilege for their implementation.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;37. Elements stored in a mind do not have names and are not organized into folders; are retrieved not by name or folder but by contents. (Hear a voice, think of a face: you&#39;ve retrieved a memory that contains the voice as one component.) You can see everything in your memory from the standpoint of past, present and future. Using a file cabinet, you classify information when you put it in; minds classify information when it is taken out. (Yesterday afternoon at four you stood with Natasha on Fifth Avenue in the rain — as you might recall when you are thinking about &quot;Fifth Avenue,&quot; &quot;rain,&quot; &quot;Natasha&quot; or many other things. But you attached no such labels to the memory when you acquired it. The classification happened retrospectively.)&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;Information Security models tend to look at things statically through information classification lenses, but its how information is used that makes it valuable. In practice this is how information security theory breaks down in the face of reality - what does an access control matrix look like for a mashup? What does it look like for a data mining app?</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;f) Least privilege: Every program and every user of the system should operate using the least set of privileges necessary to complete the job. Primarily, this principle limits the damage that can result from an accident or error. It also reduces the number of potential interactions among privileged programs to the minimum for correct operation, so that unintentional, unwanted, or improper uses of privilege are less likely to occur. Thus, if a question arises related to misuse of a privilege, the number of programs that must be audited is minimized. Put another way, if a mechanism can provide &quot;firewalls,&quot; the principle of least privilege provides a rationale for where to install the firewalls. The military security rule of &quot;need-to-know&quot; is an example of this principle.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;28. Metaphors have a profound effect on computing: the file-cabinet metaphor traps us in a &quot;passive&quot; instead of &quot;active&quot; view of information management that is fundamentally wrong for computers.</div><br /><div>29. The rigid file and directory system you are stuck with on your Mac or PC was designed by programmers for programmers — and is still a good system for programmers. It is no good for non-programmers. It never was, and was never intended to be.</div><br /><div>30. If you have three pet dogs, give them names. If you have 10,000 head of cattle, don&#39;t bother. Nowadays the idea of giving a name to every file on your computer is ridiculous.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;Least Privilege is the point where the practical matter of applying Saltzer and Schroeder&#39;s principles breaks down in modern systems. Its a deployment issue, and a matter of insufficient models and modes.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;g) Least common mechanism: Minimize the amount of mechanism common to more than one user and depended on by all users [28]. Every shared mechanism (especially one involving shared variables) represents a potential information path between users and must be designed with great care to be sure it does not unintentionally compromise security. Further, any mechanism serving all users must be certified to the satisfaction of every user, a job presumably harder than satisfying only one or a few users. For example, given the choice of implementing a new function as a supervisor procedure shared by all users or as a library procedure that can be handled as though it were the user&#39;s own, choose the latter course. Then, if one or a few users are not satisfied with the level of certification of the function, they can provide a substitute or not use it at all. Either way, they can avoid being harmed by a mistake in it.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;6. Miniaturization was the big theme in the first age of computers: rising power, falling prices, computers for everybody. Theme of the Second Age now approaching: computing transcends computers. Information travels through a sea of anonymous, interchangeable computers like a breeze through tall grass. A dekstop computer is a scooped-out hole in the beach where information from the Cybersphere wells up like seawater.</div><br /><div>16. The future is dense with computers. They will hang around everywhere in lush growths like Spanish moss. They will swarm like locusts. But a swarm is not merely a big crowd. The individuals in the swarm lose their identities. The computers that make up this global swarm will blend together into the seamless substance of the Cybersphere. Within the swarm, individual computers will be as anonymous as molecules of air.</div><br /><div>55. Software can solve hard problems in two ways: by algorithm or by making connections — by delivering the problem to exactly the right human problem-solver. The second technique is just as powerful as the first, but so far we have ignored it.</div><br /><div>56. Lifestreams and microcosms are the two most important cyberbody types; they relate to each other as a single musical line relates to a single chord. The stream is a &quot;moment in space,&quot; the microcosm a moment in time.&quot;</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;h) Psychological acceptability: It is essential that the human interface be designed for ease of use, so that users routinely and automatically apply the protection mechanisms correctly. Also, to the extent that the user&#39;s mental image of his protection goals matches the mechanisms he must use, mistakes will be minimized. If he must translate his image of his protection needs into a radically different specification language, he will make errors.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;7. &quot;The network is the computer&quot; — yes; but we&#39;re less interested in computers all the time. The real topic in astronomy is the cosmos, not telescopes. The real topic in computing is the Cybersphere and the cyberstructures in it, not the computers we use as telescopes and tuners.</div><br /><div>27. Modern computing is based on an analogy between computers and file cabinets that is fundamentally wrong and affects nearly every move we make. (We store &quot;files&quot; on disks, write &quot;records,&quot; organize files into &quot;folders&quot; — file-cabinet language.) Computers are fundamentally unlike file cabinets because they can take action.</div><br /><div>31. Our standard policy on file names has far-reaching consequences: doesn&#39;t merely force us to make up names where no name is called for; also imposes strong limits on our handling of an important class of documents — ones that arrive from the outside world. A newly-arrived email message (for example) can&#39;t stand on its own as a separate document — can&#39;t show up alongside other files in searches, sit by itself on the desktop, be opened or printed independently; it has no name, so it must be buried on arrival inside some existing file (the mail file) that does have a name. The same holds for incoming photos and faxes, Web bookmarks, scanned images...</div><br /><div>32. You shouldn&#39;t have to put files in directories. The directories should reach out and take them. If a file belongs in six directories, all six should reach out and grab it automatically, simultaneously.</div><br /><div>33. A file should be allowed to have no name, one name or many names. Many files should be allowed to share one name. A file should be allowed to be in no directory, one directory, or many directories. Many files should be allowed to share one directory. Of these eight possibilities, only three are legal and the other five are banned — for no good reason.</div><br /><div>53. Your car, your school, your company and yourself are all one-track vehicles moving forward through time, and they will each leave a stream-shaped cyberbody (like an aircraft&#39;s contrail) behind them as they go. These vapor-trails of crystallized experience will represent our first concrete answer to a hard question: what is a company, a university, any sort of ongoing organization or institution, if its staff and customers and owners can all change, its buildings be bulldozed, its site relocated — what&#39;s left? What is it? The answer: a lifestream in cyberspace.&quot;</div><br /><br /><div>**</div><div style="color: #00bf00; ">Conclusion(gp):</div><br /><div>The Saltzer and Schroeder principles of Open Design and Economy of Mechanism hold up well in the face of modern computing realities, and to a certain extent Fail Safe Defaults does as well; however if we information security people are to be effective we need to re-think the other principles.</div><br /><div>**</div><br /><div>Last word:&#0160;<span style="color: #0060bf; ">Gelernter:</span></div><div>We&#39;ll know the system is working when a butterfly wanders into the in-box and (a few wingbeats later) flutters out — and in that brief interval the system has transcribed the creature&#39;s appearance and analyzed its way of moving, and the real butterfly leaves a shadow-butterfly behind. Some time soon afterward you&#39;ll be examining some tedious electronic document and a cyber-butterfly will appear at the bottom left corner of your screen (maybe a Hamearis lucina) and pause there, briefly hiding the text (and showing its neatly-folded rusty-chocolate wings like Victorian paisley, with orange eyespots) — and moments later will have crossed the screen and be gone.</div>]]></content:encoded>
      <pubDate>Wed, 25 Jun 2008 13:29:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/protection mechanisms">protection mechanisms</category>
      <category domain="http://securityratty.com/tag/protection mechanisms correctly">protection mechanisms correctly</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/implements protection mechanisms">implements protection mechanisms</category>
      <category domain="http://securityratty.com/tag/information travels">information travels</category>
      <category domain="http://securityratty.com/tag/information security people">information security people</category>
      <category domain="http://securityratty.com/tag/protection">protection</category>
      <category domain="http://securityratty.com/tag/potential information path">potential information path</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/06/mashup-of-the-titans.html">Mashup of the Titans</source>
    </item>
    <item>
      <title><![CDATA[Those wild and crazy guys are back! - SSAATY #54]]></title>
      <link>http://securityratty.com/article/8c6fcc85d8c366a2f97a5951b05987d8</link>
      <guid>http://securityratty.com/article/8c6fcc85d8c366a2f97a5951b05987d8</guid>
      <description><![CDATA[Mitchell and I are back! It has been a few months, but the stars finally lined up to allow us to record a show. It was great being back behind the microphone again. Mitchell and I discussed a number...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><a onclick="window.open(this.href, '_blank', 'width=298,height=300,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false" href="http://www.stillsecureafteralltheseyears.com/.shared/image.html?/photos/uncategorized/2008/05/30/podcast.jpg"><img title="Podcast" height="181" alt="Podcast" src="http://www.stillsecureafteralltheseyears.com/ashimmy/images/2008/05/30/podcast.jpg" width="180" border="0" style="FLOAT: left; MARGIN: 0px 5px 5px 0px" /></a>Mitchell and I are back!&nbsp; It has been a few months, but the stars finally lined up to allow us to record a show.&nbsp; It was great being back behind the microphone again.&nbsp; Mitchell and I discussed a number of topics:</p>

<p>1. Recent penetration of the FBI<br />2. TJX fires an employee for disclosing lax security<br />3. Barracuda makes an offer for Sourcefire<br />4. G.hos.st</p>

<p>Along with the usual back and forth. Hopefully it will spur us on to do more of podcasts!.</p>

<p>If you like the content of these shows or have any other comments or questions, please drop us a line at <a href="mailto:podcast@stillsecure.com"><strong><span style="color: #366848;">podcast@stillsecure.com</span></strong></a></p>

<p>Thanks to <a href="http://www.clickcaster.com/" target="_blank"><strong><span style="color: #366848;">ClickCaster</span></strong></a> for hosting our podcast. Tonights music is the usual, To the Summit by Jon Schmidt. You can hear more from Jon at <a href="http://www.jonschmidt.com/" target="_blank"><strong><span style="color: #366848;">http://www.jonschmidt.com</span></strong></a>. Music transitions between segments are by our own Mitchell Ashley!</p>

<div style="WIDTH: 552px; HEIGHT: 50px"><embed id="oneplayer" name="oneplayer" pluginspage="http://www.macromedia.com/go/getflashplayer" src="http://www.clickcaster.com/plugin_assets/clickcaster_engine/players/player.swf?file=http://clickcaster.com/resource/ashimmy/54.mp3&amp;item_slug=those-wild-and-crazy-gus-are-back--ssaaty--54&amp;slug=ss&amp;autostart=true&amp;bgcolor=f5f5f5&amp;autostart=false" type="application/x-shockwave-flash" wmode="transparent" allowfullscreen="true" quality="high" style="WIDTH: 552px; POSITION: relative; HEIGHT: 50px"></embed></div>

<p>Or download here:</p>

<p mk_b="19" sth_t="33" mk_i="950"><img title="Icon_enclosure_music_7" alt="Icon_enclosure_music_7" src="http://www.stillsecureafteralltheseyears.com/photos/uncategorized/icon_enclosure_music_7.gif" border="0" mk_b="19" sth_t="33" mk_i="951" href="http://www.clickcaster.com/users/ashimmy/assets/54.mp3" style="FLOAT: left; MARGIN: 0px 5px 5px 0px" /><img title="listen" height="12" src="http://images.del.icio.us/static/img/mp3/play.gif" width="12" mk_b="19" sth_t="33" mk_i="952" style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; BORDER-LEFT: medium none; CURSOR: pointer; MARGIN-RIGHT: 0.5em; BORDER-BOTTOM: medium none" /><a href="http://www.clickcaster.com/users/ashimmy/assets/54.mp3" target="_blank" mk_b="19" sth_t="33" mk_i="953">mp3</a>&nbsp; </p>

<div></div></div>
]]></content:encoded>
      <pubDate>Fri, 30 May 2008 08:03:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mitchell">mitchell</category>
      <category domain="http://securityratty.com/tag/mitchell ashley">mitchell ashley</category>
      <category domain="http://securityratty.com/tag/jon schmidt">jon schmidt</category>
      <category domain="http://securityratty.com/tag/jon">jon</category>
      <category domain="http://securityratty.com/tag/music transitions">music transitions</category>
      <category domain="http://securityratty.com/tag/tonights music">tonights music</category>
      <category domain="http://securityratty.com/tag/tjx fires">tjx fires</category>
      <category domain="http://securityratty.com/tag/usual">usual</category>
      <category domain="http://securityratty.com/tag/lax security">lax security</category>
      <source url="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/05/those-wild-and.html">Those wild and crazy guys are back! - SSAATY #54</source>
    </item>
    <item>
      <title><![CDATA[Those wild and crazy guys are back! - SSAATY #54]]></title>
      <link>http://securityratty.com/article/472009451b31f7e4c2882ac72b470c54</link>
      <guid>http://securityratty.com/article/472009451b31f7e4c2882ac72b470c54</guid>
      <description><![CDATA[Mitchell and I are back! It has been a few months, but the stars finally lined up to allow us to record a show. It was great being back behind the microphone again. Mitchell and I discussed a number...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><a onclick="window.open(this.href, '_blank', 'width=298,height=300,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false" href="http://www.stillsecureafteralltheseyears.com/.shared/image.html?/photos/uncategorized/2008/05/30/podcast.jpg"><img title="Podcast" height="181" alt="Podcast" src="http://www.stillsecureafteralltheseyears.com/ashimmy/images/2008/05/30/podcast.jpg" width="180" border="0" style="FLOAT: left; MARGIN: 0px 5px 5px 0px" /></a>Mitchell and I are back!&nbsp; It has been a few months, but the stars finally lined up to allow us to record a show.&nbsp; It was great being back behind the microphone again.&nbsp; Mitchell and I discussed a number of topics:</p>

<p>1. Recent penetration of the FBI<br />2. TJX fires an employee for disclosing lax security<br />3. Barracuda makes an offer for Sourcefire<br />4. G.hos.st</p>

<p>Along with the usual back and forth. Hopefully it will spur us on to do more of podcasts!.</p>

<p>If you like the content of these shows or have any other comments or questions, please drop us a line at <a href="mailto:podcast@stillsecure.com"><strong><span style="color: #366848;">podcast@stillsecure.com</span></strong></a></p>

<p>Thanks to <a href="http://www.clickcaster.com/" target="_blank"><strong><span style="color: #366848;">ClickCaster</span></strong></a> for hosting our podcast. Tonights music is the usual, To the Summit by Jon Schmidt. You can hear more from Jon at <a href="http://www.jonschmidt.com/" target="_blank"><strong><span style="color: #366848;">http://www.jonschmidt.com</span></strong></a>. Music transitions between segments are by our own Mitchell Ashley!</p>

<div style="WIDTH: 552px; HEIGHT: 50px"><embed id="oneplayer" name="oneplayer" pluginspage="http://www.macromedia.com/go/getflashplayer" src="http://www.clickcaster.com/plugin_assets/clickcaster_engine/players/player.swf?file=http://clickcaster.com/resource/ashimmy/54.mp3&amp;item_slug=those-wild-and-crazy-gus-are-back--ssaaty--54&amp;slug=ss&amp;autostart=true&amp;bgcolor=f5f5f5&amp;autostart=false" type="application/x-shockwave-flash" wmode="transparent" allowfullscreen="true" quality="high" style="WIDTH: 552px; POSITION: relative; HEIGHT: 50px"></embed></div>

<p>Or download here:</p>

<p mk_b="19" sth_t="33" mk_i="950"><img title="Icon_enclosure_music_7" alt="Icon_enclosure_music_7" src="http://www.stillsecureafteralltheseyears.com/photos/uncategorized/icon_enclosure_music_7.gif" border="0" mk_b="19" sth_t="33" mk_i="951" href="http://www.clickcaster.com/users/ashimmy/assets/54.mp3" style="FLOAT: left; MARGIN: 0px 5px 5px 0px" /><img title="listen" height="12" src="http://images.del.icio.us/static/img/mp3/play.gif" width="12" mk_b="19" sth_t="33" mk_i="952" style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; BORDER-LEFT: medium none; CURSOR: pointer; MARGIN-RIGHT: 0.5em; BORDER-BOTTOM: medium none" /><a href="http://www.clickcaster.com/users/ashimmy/assets/54.mp3" target="_blank" mk_b="19" sth_t="33" mk_i="953">mp3</a>&nbsp; </p>

<div></div></div>

<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=8Gjq59"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=8Gjq59" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=pSAMbH"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=pSAMbH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=ZdmnhH"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=ZdmnhH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=JCflRH"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=JCflRH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=fLZeUH"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=fLZeUH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=PbDrPh"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=PbDrPh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=HpfzIh"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=HpfzIh" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/301346470" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 30 May 2008 07:04:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mitchell">mitchell</category>
      <category domain="http://securityratty.com/tag/mitchell ashley">mitchell ashley</category>
      <category domain="http://securityratty.com/tag/jon schmidt">jon schmidt</category>
      <category domain="http://securityratty.com/tag/jon">jon</category>
      <category domain="http://securityratty.com/tag/music transitions">music transitions</category>
      <category domain="http://securityratty.com/tag/tonights music">tonights music</category>
      <category domain="http://securityratty.com/tag/tjx fires">tjx fires</category>
      <category domain="http://securityratty.com/tag/usual">usual</category>
      <category domain="http://securityratty.com/tag/lax security">lax security</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/301346470/those-wild-and.html">Those wild and crazy guys are back! - SSAATY #54</source>
    </item>
    <item>
      <title><![CDATA[When does Declarative Data Binding Happen?]]></title>
      <link>http://securityratty.com/article/1ffb23ec7f70a30daf34af87875839e6</link>
      <guid>http://securityratty.com/article/1ffb23ec7f70a30daf34af87875839e6</guid>
      <description><![CDATA[I try to use declarative data binding (let's call it DDB for short) wherever I can in my ASP.NET apps, but there's one pain point I've run into in the past. It has to do with lists
Let's say you want...]]></description>
      <content:encoded><![CDATA[<P>I try to use declarative data binding (let's call it DDB for short) wherever I can in my ASP.NET apps, but there's one pain point I've run into in the past. It has to do with lists.</P>
<P>Let's say you want to populate a list box or drop down list of choices by calling a static method - you can wire up an ObjectDataSource to do that. But then in your Page's Load event, you may want to look up a record and <EM>select one of those choices</EM> based on data from that record. Maybe the user chose the item in the past and you're looking in the user's profile to recall her choice. Well, you'll quickly find that Load fires <EM>before</EM> declarative data binding has occurred. You'll probably discover this like I did when you get an error because there are no items in the list to select from. In the past I've simply avoided declarative data binding when I ran into this problem and used programmatic data binding instead (control.DataSource=collection; control.DataBind; control.SelectedIndex=whatever;).</P>
<P>But today I talked with <A href="http://www.pluralsight.com/fritz/" target=_blank><A title="Fritz Onion, author of Essential ASP.NET" href="/fritz">Fritz</A> Onion</A>, ASP.NET guru, and we figured out when declarative data binding actually occurs. We tested LoadComplete, and that wasn't late enough. Then we figured certainly DDB would happen before PreRender. No such luck. So finally Fritz suggested testing out PreRenderComplete, and that worked like a charm. So by the time PreRenderComplete has fired, DDB has already taken place and you can safely make list selections for lists that have been populated via DDB.</P>
<P>My current solution looks like this:</P>
<BLOCKQUOTE><PRE>protected void Page_Load(object sender, EventArgs args) {
    if (!IsPostBack)
        PreRenderComplete += PopulateControlsFromUserData;
}
void PopulateControlsFromUserData(object sender, EventArgs args) {
    // DDB has already happened, so party on!
}
</PRE></BLOCKQUOTE>
<P>I hope this helps someone else who also searches for "when does declarative data binding happen", which didn't used to bring up any results :-)</P><div style="clear:both;"></div><img src="http://pluralsight.com/community/aggbug.aspx?PostID=51070" width="1" height="1">]]></content:encoded>
      <pubDate>Thu, 29 May 2008 09:31:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/declarative data">declarative data</category>
      <category domain="http://securityratty.com/tag/programmatic data">programmatic data</category>
      <category domain="http://securityratty.com/tag/list">list</category>
      <category domain="http://securityratty.com/tag/list box">list box</category>
      <category domain="http://securityratty.com/tag/ddb">ddb</category>
      <category domain="http://securityratty.com/tag/void">void</category>
      <category domain="http://securityratty.com/tag/void page load">void page load</category>
      <category domain="http://securityratty.com/tag/page">page</category>
      <source url="http://pluralsight.com/community/blogs/keith/archive/2008/05/29/51070.aspx">When does Declarative Data Binding Happen?</source>
    </item>
    <item>
      <title><![CDATA[When does Declarative Data Binding Happen?]]></title>
      <link>http://securityratty.com/article/2e94a8a3ffd300bca283b93199173b08</link>
      <guid>http://securityratty.com/article/2e94a8a3ffd300bca283b93199173b08</guid>
      <description><![CDATA[I try to use declarative data binding (let's call it DDB for short) wherever I can in my ASP.NET apps, but there's one pain point I've run into in the past. It has to do with lists
Let's say you want...]]></description>
      <content:encoded><![CDATA[<P>I try to use declarative data binding (let's call it DDB for short) wherever I can in my ASP.NET apps, but there's one pain point I've run into in the past. It has to do with lists.</P>
<P>Let's say you want to populate a list box or drop down list of choices by calling a static method - you can wire up an ObjectDataSource to do that. But then in your Page's Load event, you may want to look up a record and <EM>select one of those choices</EM> based on data from that record. Maybe the user chose the item in the past and you're looking in the user's profile to recall her choice. Well, you'll quickly find that Load fires <EM>before</EM> declarative data binding has occurred. You'll probably discover this like I did when you get an error because there are no items in the list to select from. In the past I've simply avoided declarative data binding when I ran into this problem and used programmatic data binding instead (control.DataSource=collection; control.DataBind; control.SelectedIndex=whatever;).</P>
<P>But today I talked with <A href="http://www.pluralsight.com/fritz/" target=_blank><A title="Fritz Onion, author of Essential ASP.NET" href="/fritz">Fritz</A> Onion</A>, ASP.NET guru, and we figured out when declarative data binding actually occurs. We tested LoadComplete, and that wasn't late enough. Then we figured certainly DDB would happen before PreRender. No such luck. So finally Fritz suggested testing out PreRenderComplete, and that worked like a charm. So by the time PreRenderComplete has fired, DDB has already taken place and you can safely make list selections for lists that have been populated via DDB.</P>
<P>My current solution looks like this:</P>
<BLOCKQUOTE><PRE>protected void Page_Load(object sender, EventArgs args) {
    if (!IsPostBack)
        PreRenderComplete += PopulateControlsFromUserData;
}
void PopulateControlsFromUserData(object sender, EventArgs args) {
    // DDB has already happened, so party on!
}
</PRE></BLOCKQUOTE>
<P>I hope this helps someone else who also searches for "when does declarative data binding happen", which didn't used to bring up any results :-)</P><div style="clear:both;"></div><img src="http://www.pluralsight.com/community/aggbug.aspx?PostID=51070" width="1" height="1">]]></content:encoded>
      <pubDate>Thu, 29 May 2008 09:31:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/declarative data">declarative data</category>
      <category domain="http://securityratty.com/tag/programmatic data">programmatic data</category>
      <category domain="http://securityratty.com/tag/list">list</category>
      <category domain="http://securityratty.com/tag/list box">list box</category>
      <category domain="http://securityratty.com/tag/ddb">ddb</category>
      <category domain="http://securityratty.com/tag/void">void</category>
      <category domain="http://securityratty.com/tag/void page load">void page load</category>
      <category domain="http://securityratty.com/tag/page">page</category>
      <source url="http://www.pluralsight.com/community/blogs/keith/archive/2008/05/29/51070.aspx">When does Declarative Data Binding Happen?</source>
    </item>
  </channel>
</rss>
