Risk calculation in IT software projects [simplified]

LOW:

Our developers know very good the use case and realized similar use cases very often. It exists a well documented standard library in framework for that use case or an inhouse framework.

MEDIUM:

Our developers principally understand the use case and can imagine well to realize it with a standard or inhouse library.

HIGH:

Our developers principally understand the use case, but never realized something similar. They need some none standard not well tested (and even maybe scanty documented) library to realize it Mr. X / Mrs. Y heared in a former company, that some of her co-workers already used an git open source library for something very similar to the most critical path in implementation for our use case. But that git repository looked more like freak made (that's is possible), rather than a well made university project concerning all security and performance issues including soft & hard limits.

(After contacting the author(ess) of git open source project, (s)he means: "I did this 9 years ago, you have to port it to the newest version of the framework and it will work only slacky with over 100.000 main data records! Feel free to implement a caching mechanism and re-deliver it to my git project tree.)

EPIC:

Our developers don't or won't understand that special use case.

They ask: "Are you crazy or on crystal meth?", when receiving the requirements.

There doesn't exist any library in the company's programming language for that. Maybe some international legends like Fefe or Alan Cox realized something similar in a totally different programming language.

IMPOSSIBLE:

Even Fefe, Linus or Alan (Cox) say: "This is science fiction!"

A crazy example of a Lazy singleton as strangest singelton pattern ever

A crazy example of a Lazy<T> singelton with privat constructor inherited form an protected DoubleLockInstance singelton with private empty and protected parameter constructor inherited form an abstract singelton template with protected constructor.

Application settings example:

BaseSets for basic settings as abstract singelton base

using System;using System.Reflection;
namespace work.darkstar.blog{    /// <summary>    /// abstract class BaseSets     /// </summary>    [Serializable]    public abstract class BaseSets    {        public string AssemblyName { get => Assembly.GetExecutingAssembly().GetName().ToString(); }        public string Copyright { get => "GNU LIGHT GENERAL PUBLIC LICENSE 2.0 LGPL"; }        public virtual string AssemblyCom { get => "darkstar.work"; }
        public virtual int AppId { get; protected set; }        public virtual string AppName { get; protected set; }        /// <summary>        /// protected empty constructor for inheritable singelton        /// </summary>        protected BaseSets() { }         /// <summary>        /// protected parameterized constructor for inheritable singelton        /// </summary>        protected BaseSets(int appId, string appName)        {            AppId = appId;  AppName = appName;        }    }}

AppSets for application settings as instancable singelton default app sets (settings):

using Microsoft.Win32;
using System;
using System.Reflection;
using System.Windows.Forms;

namespace work.darkstar.blog
{    public interface IAppSetsDomain : IAppDomainSetup    {        System.AppDomain AppCurrentDomain { get; }    }    /// <summary>
    /// application settings singelton    /// </summary>
    [Serializable]    public class AppSets : BaseSets, IAppDomainSetup
    {
        private static AppSets _appSets;        private static object  _initLock, _sndLock;
        protected static AppSets DoubleLockInstance {            get {                _sndLock = new System.Object();                lock (_sndLock)  {                    if (_initLock != null) _initLock = null;
                    if (_initLock == null) _initLock = new System.Object();                    lock (_initLock) {                       if (_appSets == null)                            _appSets = new AppSets();                    }                    return _appSets;                }            }        }        public string CodeBase { get => Assembly.GetExecutingAssembly().CodeBase; }
        public string BaseDirectory { get => AppDomain.CurrentDomain.BaseDirectory; }        public string AppDataPath { get => Application.CommonAppDataPath; }        public RegistryKey AppDataRegistry { get => Application.CommonAppDataRegistry; }

        #region implementing interface IAppSetsDomain, IAppDomainSetup        
        public AppDomain AppCurrentDomain { get => AppDomain.CurrentDomain; }
        public string ApplicationBase { get ; set; }
        public string ApplicationName{ get ; set; }
        public string CachePath{ get ; set; }
        public string ConfigurationFile{ get ; set; }
        public string DynamicBase { get ; set; }
        public string LicenseFile { get ; set; }
        public string PrivateBinPath { get ; set; }
        public string PrivateBinPathProbe { get ; set; }
        public string ShadowCopyDirectories { get ; set; }
        public string [] ShadowCopyDirectoryArray { 
                get => ShadowCopyDirectories.Split(';'); }
        public bool FilesShadowCopy { get ; set; }
        public string ShadowCopyFiles { 
            get => FilesShadowCopy.ToString().ToLower();
            set { FilesShadowCopy = Boolean.Parse(value); }
        }
        public bool FilesShadowCopy{ get ; set; }
        public string ShadowCopyFiles{ get => FilesShadowCopy.ToString() ; set; }
        #endregion implementing interface IAppSetsDomain, IAppDomainSetup        

        /// <summary>        /// static constructor         /// </summary>        static AppSets() {
            _initLock = new System.Object();
            lock (_initLock) { _appSets = new AppSets(); }
        }
        /// <summary>        /// private empty constructor         /// </summary>        private AppSets() {            AppId = AppDomain.CurrentDomain.Id;            AppName = Assembly.GetExecutingAssembly().FullName;                      }
        /// <summary>        /// protected parameter constructor         /// </summary>        protected AppSets(int appId, string appName) : base(appId, appName) { }
    }}

Sealed MyAppSets for application specialized appSets as Lazy<T> singelton:

using System;
using System.IO;
using System.Security;/* ... */using Microsoft.Win32;/* ... */using Windows.Forms;
namespace work.darkstar.blog
{
    /// <summary>
    /// my application settings singelton
    /// </summary>
    [Serializable]
    public sealed class MyAppSets : AppSets
    {
        /// <summary>
        /// private static readonly Lazy<T> self containing private real singelton unique instance
        /// </summary>
        private static readonly Lazy<MyAppSets> _instance = 
            new Lazy<MyAppSets>(() => new MyAppSets(AppDomain.CurrentDomain.Id, "LazyApp"));

        /// <summary>
        /// static instance getter for Singeltion
        /// </summary>
        public static MyAppSets Instance { get => _instance.Value; }

        public string UserAppDataPath { get => Application.UserAppDataPath; }
        public RegistryKey UserAppDataRegistry { get => Application.UserAppDataRegistry; }


        /// <summary>
        /// private constructor with partameters for sealed unique singelton
        /// </summary>
        private MyAppSets(int appId, string appName) : base(appId, appName) { }        

        /// <summary>
        /// Gets name value pair for application registry key saved in registry scope for current user
        /// </summary>
        /// <param name="regName">registry name identifier</param>
        /// <param name="subKey">subKey in scope of current user</param>
        /// <returns>object value</returns>
        /// <exception cref="ApplicationException">application exception with detailed inner exception</exception>
        public object GetUserRegValuey(string regName, string subKey = null) {
            object o = null;
            RegistryKey key = null;
            Exception ex = null;
            try {
                key = (subKey == null) ? UserAppDataRegistry 
                    : UserAppDataRegistry.OpenSubKey(subKey, false);
                o = key.GetValue(regName);
            }
            catch (SecurityException sex) { ex = sex; }
            catch (ObjectDisposedException odEx) { ex = odEx; }
            catch (UnauthorizedAccessException uaEx) { ex = uaEx; }
            catch (IOException ioeEx) { ex = ioeEx; }
            finally {
                if (key != null && subKey != null)
                    key.Close();
                if (ex != null) throw (new ApplicationException("Error accessing registy key: " + 
                    $"{UserAppDataRegistry}\t name: {regName}\t subkey: {subKey}", ex));            }
            return o;
        }

        /// <summary>
        /// Set Value for UserAppDataRegistry
        /// </summary>
        /// <param name="regName">registry name </param>
        /// <param name="value"value to set></param>
        /// <param name="subKey">subKey</param>
        /// <returns>void means nothing</returns>
        /// <exception cref="ApplicationException">application exception with detailed inner exception</exception>
        public void SetUserReg(string regName, object value, string subKey = null) {
            RegistryKey key = null;
            Exception ex = null;
            try {
                key = (subKey == null) ? UserAppDataRegistry 
                    : UserAppDataRegistry.OpenSubKey(subKey, true);
                key.SetValue(regName, value);
            } catch (Exception anyEx) {
                ex = new ApplicationException($"Error setting value=" +
                  $"{value} for name={regName} inside registry key: {key.Name}", 
                  anyEx);
            } finally {
                if (key != null && subKey != null)
                    key.Close();
                if (ex != null) throw ex;
            }
        }
    }
}

Accessing MyAppSets singelton inside any entity, framework,  helper, [...] class

using System; /*  ... */
using work.darkstar.blog;



public class MyEntity : IAppSetsDomain { 

  /* [ ... ]  */ 
  /* [Inject] */ 
  /* [ ... ]  */

  public AppDomain AppCurrentDomain {
    get => MyAppSets.Instance.AppCurrentDomain;
    set => MyAppSets.Instance.AppCurrentDomain = value;
  }
  /* ... */
}

some ideas to Azure & Microsoft SQL Servers [Draft]

What is missing?

It's missing, that we have unfortunatley no consistently implementation for Active Directory (see also: LDAPS, X.500) on Micrsoft SQL-Server.

How fast are Linked Servers & Distributed Transaction coordinator

Trust me, they are really fast and OAUTH and Azure Auth would be implemented in some weeks, if MS put some lower evangelists at work!

To be continued ...

 

Fact checking: What come from pirate party and socialist section8 and what from communists?

 In the years 2011 - 2014 I was an more left as (but still) liberal activst participating at serveral discussions in the free internet in different forums or social media. 

From my point of view, many ideas that were produced together in common with stakeholders from pirate party and section8, had the most politically and avangardistic value and also flowed partially into the party program of other parties (e.g. Neos, SPÖ, even partly Greens, ÖVP, FPÖ).

I will list here the most impactfully issues:

I. Transparency 

I.1. Transparency (freedom of information) Act

In Austria and Bavaria a law called Amtsgeheimnis exists, that protects any and implicitly all communications concerning any official task or issue in state sector between employes of the state as strong classified. (like police officers, judges, social and work service, politicans, public health service, ...). Private not state tasks or issues concerning smalltalk conversation is certainly not affected by that law. All that communication is forever protected, even for old statesmen, when leaving state service at 70 years, its strictly forbidden to tell anything under to relatives, family or journalists. The penalization

and punishment even for such old men is very hard and consistent. There is no such opening step like in US, where even GOD (the CIA) opens some classified files after 40 - 60 years. Because of that and keeping secret citizens data (like  medical data files, pensions and doctor payments, ..) a transparency act was claimed in Februar 2013. Many personal data are in between visible for citizen by digital goverment platforms, other not so strictly single person concerning cases, are furthermore deep secretly.

One of the big problems, that still exist, is that "Amtsgeheimnis" even  beats the EU public contracts tendering law and official gouvernemental state tenders and Privatization / sale of public goods!

Feb 12, 2013, 7:34 PM

Vor 10 Tagen haben Sektion8 & Piratenpartei die Petition zum Transparenzgesetz veröffentlicht:
https://blog.area23.at/2013/02/am-222013-machten-mich-sektion-8-und.html

Sektion 8 wollte doch Akkzente setzen und nicht nur reagieren.
In dem Fall ist das sehr gut gelungen.
Gratulation, bei so einer wichtigen Sache.

Liebe Grüße,

Betreute Personen => kein unabhängiger Patietenanwalt (rechtlich, medizinisch) und mangelnde Menschenrechte & Monitoring

 Viele Menschen in Österreich benötigen Betreuung, sind pflegebedürftig, in Lebenskrisen (durch Schicksalsschläge, Schocks, Obdachlosigkeit, Gewalteinwirkung, Resozialisierung nach Aufenthalt, Aufenthalt in einer psychiatrischen Anstalt oder im Strafvollzug, Betreung von schwer Demenzkranken oder (Halb-)Komapatienten, oder chronische schwere Seuchen bzw. Suchtkrankheiten).

Egal um welche vom Leid getroffenen Menschen es sich nun handelt (sehr alte Senioren mit schwerer Demenz, Härtefälle betreut vom psychosozialen Dienst, in psychiatrische Kliniken zwangseingewiesene oder wohnungslose, die jetzt im sozialen Wohnen Programm sind, betreute WGs für Menschen mit Behinderung, ...), es gibt KEINE unabhängige Kontrolle und Monitoring und es gibt keinen Garant, dass jeder dieser Menschen eine rechtlichen und medizinischen Patientanwalt regelmäßig kontaktieren kann.

Was sind die Konsequenzen des Fehlens einer unabhängigen Kontrolle und eines unabhängigen Patientenanwalt?

Ein par Fallstudien (leider aus der Realität)!

• Eine albanische Flüchtlingsfrau (ohne Bildung) steht nach Mißbrauch unter schwerem Schock. Aufgrund des Schocks gingen alle kommunikativen Fähigkeiten (einfache Sprache, Gebärden, Deuten, Nicken) bei ihr temporär oder ev. parmanent verloren. Die Frau hat permanent große Angst und wird in einer Einrichtung des PSD (Psychosozialen Dienst) betreut. Es ist unklar, ob Leute, die in den Mißbrauch verwickelt waren, sich auch in der Einrichtung befinden und keine Garantie, ob sich die Frau von dem Trauma unter gegebenen Umständen überhaupt abkapseln, erholen, regenerieren kann.

• Ein WG-Bewohner in einer betreuten WG für Menschen mit Behinderung fühlt sich von seinen Mitbewohnern und den Betreuern schikaniert und gequält. Dem armen ist es unmöglich sich nur 2 Stunden in der Woche zurückzuziehen, um Musik zu hören, ein par schöne Erinnerungsfotos anzusehen oder ein Buch ein par Seiten zu lesen.

• Ein auf einen Asylbescheid wartender nordafrikanischer Flüchtling wurde vom Flüchtlingslager aufgrund seiner Sexuakität und permanenten Stockschlägen in der Nacht auf eine psychiatrische Einrichtung verlegt. Zwar zufrieden über den besseren Schutz und keiner Folter, ist der Flüchtling in Sorge, dass er wichtige rechtliche Termine zu seinem Verfahren nun versäumt und so dann automatisch abgeschoben wird.

Wir sehen hier sehr gut, dass durch Fehlen einer unabhängigen Kontroll und Patientenanwaltschaft hier es zu leichten bis schweren Menschenrechtsverletzungen kommt.

Bitte diese Missstände umgehenst schleunigst beheben!

Risk of collecting biometric data

Authentication with biometric data intuitively appears extremely secure to the user, but biometric authentication is full of poisoned traps and deadly pitfalls.

Some general risks (not complete, add if you like more points)

1. If the digital fingerprint is saved anywhere in a central database, then you can fake fingerprints, by generating a blueprint.#
2. Same story, if the fingerprint is transmitted somewhere. 
3. Even, if stored on local devices unencrypted or reversible symmetrically encrypted, than biometric data as fingerprints, eye scans, are great risks.

 

Some general risks (not complete, add if you like more points)

The only method of storing and transmitting biometric data is to never store them plainly or reversible encrypted. We remember all good old unix single system auth (/etc/passwd, //etc/shadow) and  crypt(3), do we? Non-reversible encryption!

Well, that's exactly what we need for all biometric data.

Example of current used hardware for fingerprint sensors (Google Pixel3)

When taking a short look at currently used biometric fingerprint sensors (case study from my on ice ground broken google Pixel3), we see some sensors with ICs like that:

Android fingerprint hardware (no matter if from high end Google Pixel or cheapest Huawei) aren't really top high end technology for biometric fingerprints.

Mostley, they are based on something similiar like MIKROE-4265 

There are many different biometric scan detvices, from fully integrataed hardware with  own windows drivers & software like; Kensington VeriMark Desktop Fingerprint Key K62330WW

up to more hardware driven devices like at ELV.de; https://de.elv.com/search?sSearch=fingerprint

Case study: "digital gouvernement" from Austria

https://play.google.com/store/apps/details?id=at.gv.oe.app
https://apps.evozi.com/apk-downloader/?id=at.gv.oe.app
https://apkcombo.com/apk-downloader/?q=at.gv.oe.app

To be continued...

Most bogus random generator service for linux

try it here: https://darkstar.work/mono/fortune/od.aspx
on PasteBin: https://pastebin.com/6wfzR9NE

#!/bin/bash

nanos=`date +%N`; 
secIGSO=`date +%s` 
cursec=`date +%S`
randomseek=`echo "$secIGSO  - $nanos" |bc` 
urandomseek=`echo "$randomseek % 65536" |bc` 
readbytes=`echo "$cursec + 32" |bc` 

echo -en "\tsince_1970-01-01.secs:\t$secIGSO \n\tcurrent.nanos:\t$nanos \n";
echo -en "\trandomseek:\t$randomseek \n\turandomseek:\t$urandomseek \n";
echo -en "\tcursec:\t$cursec \n\treadbytes:\t$readbytes \n";

echo "exec od -A n -t x8 -w32 -j $urandomseek -N $readbytes /dev/urandom"
od -A n -t x8 -w32 -v -j $urandomseek -N $readbytes /dev/urandom

od    https://man7.org/linux/man-pages/man1/od.1.html (octal dump):

bc    https://man7.org/linux/man-pages/man1/bc.1p.html

date https://man7.org/linux/man-pages/man1/date.1.html