L35

Author: patricklam

lectures/459.bib

@@ -1233,7 +1233,7 @@ @misc{joinelim
 
 @misc{sysdig,
   author = 	 {Crystal Morin},
-  title = 	 {Sysdig TRT uncovers massive cryptomining operation leveraging GitHub Actions},
+  title = 	 {Sysdig {TRT} uncovers massive cryptomining operation leveraging {GitHub} {Actions}},
   month = 	 {October},
   year = 	 2022,
   url = {https://sysdig.com/blog/massive-cryptomining-operation-github-actions/},
@@ -1405,3 +1405,11 @@ @ARTICLE{free-apps
   keywords={Computer crashes;Privacy;Mobile communication;Tagging;Computer applications;Software quality;Quality assurance;Software engineering;mobile applications;software quality;user reviews;quality assurance;software engineering},
   doi={10.1109/MS.2014.50}
 }
+
+@InProceedings{abdollahpour24:_enhan_secur_modul,
+  author = 	 {Mohammad Mahdi Abdollahpour and Jens Dietrich and Patrick Lam},
+  title = 	 {Enhancing Security through Modularization: A Counterfactual Analysis of Vulnerability Propagation and Detection Precision},
+  booktitle = {Proceedings of the IEEE Conference on Source Code Analysis and Manipulation},
+  year = 	 2024,
+  month = 	 {October},
+  address = 	 {Flagstaff, AZ, USA}}

lectures/L35-slides.tex

@@ -19,7 +19,7 @@
 \begin{frame}
 \frametitle{Devops, but Operations}
 
-Services are doing The Thing -- but how do we know if there's a problem?
+Services are doing The Thing---but how do we know if there's a problem?
 
 Monitoring and Alerting.
 
@@ -39,7 +39,7 @@
 
 Maybe automate testing the basic workflow.
 
-These don't show performance problems.
+But, that doesn't show performance problems.
 
 \end{frame}
 
@@ -108,7 +108,7 @@
 	\includegraphics[width=0.8\textwidth]{images/more-sherlock.jpg}
 \end{center}
 
-Remember also the lesson from Sherlock Holmes in ``The Adventure of Silver Blaze'' -- the dog that did \alert{not} bark was a clue as to who did the crime.
+Remember also the lesson from Sherlock Holmes in ``The Adventure of Silver Blaze''---the dog that did \alert{not} bark was a clue as to who did the crime.
 
 \end{frame}
 
@@ -118,7 +118,7 @@
 
 The final option for detecting a problem is customer support.
 
-Automated monitoring maybe can't find everything every time, but we shouldn't be relying on this as the primary mechanism.
+Automated monitoring maybe can't find everything every time, but we shouldn't be relying on reports from support as the primary mechanism.
 
 
 \end{frame}
@@ -130,7 +130,7 @@
 
 \begin{itemize}
 \item {\bf Alerts}: a human must take action now;
-\item {\bf Tickets}: a human must take action soon \\ \qquad (hours or days);
+\item {\bf Tickets}: a human must take action soon  (hours or days);
 \item {\bf Logging}: no need to look at this \\ \qquad except for forensic/diagnostic purposes.
 \end{itemize}
 
@@ -233,9 +233,9 @@
 
 Does not have to be exactly 5; use judgement.
 
-Too few times $\rightarrow$ superficial answers.
+Too few times $\Rightarrow$ superficial answers.
 
-Too many times $\rightarrow$ ``computers were a mistake.''
+Too many times $\Rightarrow$ ``computers were a mistake.''
 
 \end{frame}
 
@@ -275,7 +275,7 @@
 	\item Irrelevant detail
 	\item Speculation
 	\item Blaming
-	\item Blaming
+	\item Shaming
 \end{itemize}
 
 
@@ -298,9 +298,9 @@
 \begin{frame}
 \frametitle{Risk Enormous}
 
-You can run some program with tons of security vulnerabilities offline and feel that the security problems can be managed. 
+You can run some program with tons of security vulnerabilities offline and feel that the security problems can be managed (but you might be wrong). 
 
-When it's online the risk is enormous. 
+When it's online the risk is definitely enormous. 
 
 All kinds of vulnerabilities are a problem, but I'll call out two of them:
 
@@ -327,7 +327,7 @@
 
 Bypass signup limitations, browser scripting.
 
-Mining cryptocurrency -- inefficiently -- but works.
+Mining cryptocurrency---inefficiently---but works.
 
 
 Using \$103~000 of resources produces one coin worth about \$137: 0.13\% return.\\