Close
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Subscribe
Logo
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Subscribe
    Home Development
    • Development
    • IT Management

    Keep Web Services on a Diet

    Written by

    Peter Coffee
    Published February 7, 2005
    Share
    Facebook
    Twitter
    Linkedin

      eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

      Nobel Prize winner Robert Solow once warned of the hazards of oversimplification, saying that one could call it the occupational hazard of being an economist—except that it was actually the occupation.

      In the same way, one could say that its the occupation of the Web services developer to make a companys intellectual property available to a wider range of users in a broader variety of ways. Unfortunately, theres no clear boundary between that occupation and the corresponding hazard of doing it too well.

      Attacks on Web-based assets are hardest to block when they work by taking “success” too far: when a server gets more hits than it can handle in a simple denial-of-service attack, or when a file access method turns out to be more general-case than intended.

      Moreover, we quickly put ourselves into a domain of diminishing returns when we try to define, ever more precisely, the things that we wont permit to a human user or a client application. We might call this the Kerr effect, in honor of the late Jean Kerr, author of “Please Dont Eat the Daisies”—a book whose name came from the hard-learned lesson that a rule-based approach to regulating behavior will never get to the last necessary rule.

      “I had a dinner party and told the twins and Christopher not to go in the living room, not to use the guest towels in the bathroom, and not to leave the bicycles on the front step. However, I neglected to tell them not to eat the daisies on the dining-room table. This was a serious omission, as I discovered when I came upon my centerpiece—a charming three-point arrangement of green stems,” Kerr ruefully reported to her readers.

      /zimages/2/28571.gifCustomer-facing systems must be designed to doubt. Click here to read more.

      My wary appreciation of the Kerr effect explains, I suspect, many of my preferences when it comes to software and system security. I favor the Java and .Net approach, for example, of stating specifically what privileges a piece of code enjoys, and which resources its allowed to engage, rather than trying to envision every “thou shalt not” that needs to be stated to keep anyone from using my code to eat my daisies.

      We see another approach along these lines in the content management technologies described in this mornings story by eWEEKs Dennis Fisher, who describes new tools for content analysis and event recognition to safeguard valuable files against unauthorized use or transfer. The determined will still find ways to get past such systems, for example using tools of steganography, and security professionals must stay abreast of these techniques—but bread-and-butter enterprise developers can at least lock more doors against accidental or opportunistic leaks.

      We dont want to find ourselves following Jean Kerrs path toward ever-more-explicit prohibitions. “Christopher gets up ahead of the rest of us on Sunday mornings, and he has long since been given a list of clear directives: Dont wake the baby, Dont go outside in your pajamas, Dont eat cookies before breakfast. But I never told him, Dont make flour paste and glue together all the pages of the magazine section of the Sunday Times. Now I tell him, of course,” she reported. We can write rules and invoke APIs forever—Im pretty sure thats a literal and formally provable statement—and still not prevent every possible exploit of the loopholes that will remain.

      The affirmative approach, “This is what youre allowed to do,” and the exception-detecting approach, “This would be odd and should be reported if it happens,” seem to me a much more attractive set of strategies.

      Tell me what rules you didnt realize you needed, until they were broken, at [email protected]

      /zimages/2/28571.gifCheck out eWEEK.coms for the latest news, reviews and analysis in Web services.

      Peter Coffee
      Peter Coffee
      Peter Coffee is Director of Platform Research at salesforce.com, where he serves as a liaison with the developer community to define the opportunity and clarify developers' technical requirements on the company's evolving Apex Platform. Peter previously spent 18 years with eWEEK (formerly PC Week), the national news magazine of enterprise technology practice, where he reviewed software development tools and methods and wrote regular columns on emerging technologies and professional community issues.Before he began writing full-time in 1989, Peter spent eleven years in technical and management positions at Exxon and The Aerospace Corporation, including management of the latter company's first desktop computing planning team and applied research in applications of artificial intelligence techniques. He holds an engineering degree from MIT and an MBA from Pepperdine University, he has held teaching appointments in computer science, business analytics and information systems management at Pepperdine, UCLA, and Chapman College.

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      MOST POPULAR ARTICLES

      Artificial Intelligence

      9 Best AI 3D Generators You Need...

      Sam Rinko - June 25, 2024 0
      AI 3D Generators are powerful tools for many different industries. Discover the best AI 3D Generators, and learn which is best for your specific use case.
      Read more
      Cloud

      RingCentral Expands Its Collaboration Platform

      Zeus Kerravala - November 22, 2023 0
      RingCentral adds AI-enabled contact center and hybrid event products to its suite of collaboration services.
      Read more
      Artificial Intelligence

      8 Best AI Data Analytics Software &...

      Aminu Abdullahi - January 18, 2024 0
      Learn the top AI data analytics software to use. Compare AI data analytics solutions & features to make the best choice for your business.
      Read more
      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Video

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2024 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×