Software-Engineering

Posted on June 8, 2025 I’ve been exploring AI code generation while building a Domain Driven Design framework focused on security. Implementing a HashPassword value object revealed significant challenges with how AI handles sensitive data patterns. Why Value Objects Matter (The Good News First) Value objects strengthen secure software development in several ways: Strong Typing That Actually Types Instead of passing generic String parameters, value objects create distinct types. IDEs and compilers catch type mismatches before runtime, preventing developers from accidentally swapping usernames for password hashes. ...

Posted on January 17, 2025 Understanding Software Complexity Software is inherently complex—composed of many interconnected parts that weave together like “spaghetti code.” To manage this complexity, engineers have developed organizational strategies and higher-level programming languages that abstract machine code, making systems more readable and maintainable. However, this capability has enabled increasingly complex software, which in turn has driven reliance on additional organizational techniques and third-party libraries. The Evolution of Encryption Encryption technology has undergone significant transformation. Previously, encryption was computationally expensive and impacted user experience, so organizations limited its use to high-threat scenarios. This preference for disk-level encryption over data-level encryption meant internal network traffic was often considered trusted. ...

Posted on June 3, 2024 You all know Murphy, right? The one whose law revolves around anything that can go wrong will go wrong. And you probably know the Law of Unintended Consequences: all actions have consequences, whether intentional or unintentional. One of the reasons I have remained in software security is because I have a knack for finding those unintended consequences. This time, I found many of them. In many disparate but related systems. Including myself. ...

“AI created software is coming faster and faster. And the technology to do it is already here. All that is needed is training data and a focus.” Artificial Intelligence will create, test, and deliver software products with accuracy, efficiency, and security. Specialized AI agents will coordinate development across distinct lifecycle phases at inhuman speeds. How Will It Work? A software creator describes their product to an Application Generator (AG), which uses large language models to analyze requirements and interact with the creator to refine them. The AG works alongside a Domain Modeler to establish specifications using domain-specific language. ...

Human Computer Interaction is difficult. Options are endless. Software frequently impedes user workflows, creating frustration that erodes trust between users and systems. This problem extends beyond mere inconvenience—it carries security implications that deserve attention. The Challenge of Modern User Experience Contemporary software attempts to serve multiple contexts simultaneously: desktop browsers, tablets, and mobile devices. User interface designers must balance countless factors including accessibility standards, evolving authentication methods (from passwords to facial recognition and passkeys), and rapidly shifting technology capabilities. ...

Introduction In software development and security, reachability and exploitability often influence vulnerability management decisions. However, relying on these factors to delay prioritizing or reporting security findings is fundamentally flawed. Using such justifications amounts to “lying to those who want to be lied to.” The Flawed Test of Reachability and Exploitability Testing methodologies based on immediate reachability or exploitability are inherently flawed. The Log4Shell incident exemplifies how dynamic code execution creates false negatives. Modern software’s complex data flows obscure attack pathways, leading to underestimating vulnerability reach. Dismissing findings based on these tests merely obscures risk rather than eliminating it. ...

Overview Creating trustworthy software demands deliberate attention to three core security principles: availability, integrity, and confidentiality. The article outlines practical habits developers can adopt throughout the software lifecycle. Building Phase Practices Threat Modeling involves considering potential failures and appropriate responses. Coding Standards establish consistency but require careful balance between enforcement and practicality. Code Reviews leverage peer expertise, though effectiveness depends on reviewer skill. Code Quality Scans automate detection of poor practices. SAST (Static Analysis Software Testing) identifies vulnerabilities in source code quickly, though complexity and framework support present challenges. Various testing approaches—unit tests, integration tests, and end-to-end testing—validate functionality at different levels. ...

All software design decisions influence security outcomes. Multiple factors affect the overall security posture of an application. Key Design Considerations Programming Languages Each language carries distinct security tradeoffs. C and C++ provide performance advantages but introduce memory management vulnerabilities like buffer overflows. Java prevents those errors but may retain sensitive data in memory longer than intended. DRY Principle “Don’t Repeat Yourself” promotes code reuse, reducing the need to fix vulnerabilities multiple times. Leveraging existing solutions—such as established encryption libraries—prevents recreating complex, mathematically intensive systems. ...

Software design combines artistic vision with scientific principles. Like woodworking, it involves envisioning a final product and executing it through methodical processes, with adjustments made throughout. Design as Continuous Process Design isn’t a single event but rather “a continuous thread that runs through the entire creation process.” It spans from high-level concepts to intricate algorithmic details, driven primarily by product requirements. Educational Software Example When designing educational systems, the student becomes the primary user. Designers must consider enrollment processes, assignment distribution, and evaluation methods—details that often require prototyping to clarify. ...

The Craftsmanship Parallel The author draws an extended analogy between woodworking and software development. Just as a skilled woodworker must understand wood grain, joint construction, and material selection, software developers must prioritize the details that matter—particularly data protection and security. Quality Standards and Rigor The piece emphasizes that software intended for mass consumption requires rigorous testing across multiple development lifecycle phases. A simple workshop project differs fundamentally from products serving thousands of users, teachers, parents, and students who depend on reliability and confidentiality. ...