Here are a few quick thoughts about what I liked and disliked about the exam:

LIKES

1. Focus on fundamentals – The exam focuses much more on fundamentals and less on exact knowledge of the various standards. This is on the whole good because a good professional should have solid fundamentals. Standards one can always refer to and interpret as and when the occasion arises. Also there are so many standards in the security space that it is virtually impossible and impractical to remember more than the basic details of each one.
2. Exam duration just about right – At 4 hours and 175 questions the length seems just about right. For those of you familiar with the CISSP exam you would have recognised that this is a snipe at the 250-question, 6-hour, marathon exam that is the CISSP
3. Hands-on experience more valuable for exam purposes than the CISSP exam – For a professional who has been in the secure software support role (in any capacity) for 4-5 years (which is actually one of the pre-requisites to the certification) this will be a fairly easy exam. Again this is quite unlike the CISSP where there are 10 overarching domains and even experienced professionals have to devote a decent amount of time in reading up about the domains that they have little hands-on experience in.

DISLIKES

1. Severe language and grammar ambiguity – All good multiple-choice exams have ambiguity in the exact choices, this is what differentiates candidates who have just studied for the exam from the candidates who actually know their stuff. This is the kind of ambiguity that makes you think before answering. However this ambiguity should be in the content, not in the interpretation of the questions. I think  the quality of the CSSLP questions was very poor from a language and grammar perspective. Security is a deep field where an extra word or a missing word can change the meaning of the statement altogether. I spent a lot of time guessing whether the framer of the question meant a certain thing or another thing altogether. I could not use the question comment forms too due to lack of time. However I do plan to contact ISC2 through more formal channels and give them this feedback as well as volunteering my time in improving the questions.
2. No official guide yet – The CSSLP certification was announced in September 2008. However the ISC2 Official Guide to the CSSLP is expected to be available only in May 2010. 1.5+ is a long time to put out an official guide. ISC2 should pull up its socks and should ideally put out an official guide within 3-6 months of a new certification being announced.

Right now there is just 1 book available for the CSSLP exam – The CSSLP Prep Guide by Ronald L. Krutz and Alexander J. Fry The book’s strength is coverage. It’s weaknesses are lack of depth, lack of consistency amongst various chapters, a tendency to regurgitate content from existing documents without explaining them, non-existent chapter-end summaries and very very poor practice questions both in the book and on the CD. In spite of these shortcoming on the whole I am glad I used this book and I highly recommend it if you plan to take the CSSLP soon. If the official guide were available I would have preferred it but till may 2010 this books seems to be your best bet for a single consolidated resource.

I have a number of tips, observations and resources on the preparation for the exam itself but that will be the topic for another post soon. Ciao!

Read the long but interesting comic announcing what it is or go ahead and download it and try it out.

Google has a finger in every online service pie – it has a nearly complete suite of online services – check out Google Labs. From just controlling the server end of things Google Chrome is a very smart foray into controlling the browser side too. It is all about controlling the experience. If you are the browser maker you decide how it behaves, what elements are shown, how it behaves and what components are optimized. You drive essential standards and the ecosystem of web applications.

Google Chrome is full of new features, both user-visible and purely internal.

A faster and leaner new JavaScript engine called V8 compiles JavaScript and has tighter memory management than the current JavaScript engines. This ensures that JavaScript-heavy (AJAX) applications such Gmail and Google Reader run faster.

Chrome implements a one-process-per-application model. This means application behaviour (unintended or malicious) is localized, crashes are easier to deal with, debugging is easier and memory management is more efficient. This also makes the browser design more flexible and extensible.

The UI is minimalistic and stylish, a signature Google UI. Tabs are the central element in the user interface and therefore are at the very top of the browser. Less important elements of the UI such as the status bar and bookmarks are hidden by default. The default home page shows the 9 most visited sites plus most searched sites, a pretty sensible default and something I know I will get used to in a few days. The best part about the UI is that everything is better but in a subtle, non-distracting manner. All the (Firefox) shortcuts work as expected and everything is where I expect it to be. Google Gears is in-built and provides the interface to the user’s file-system and allows applications to behave more like native applications.

Security is built-in by design. Applications and plug-ins are sandboxed from each other and from the rest of the user’s system. Processes cannot write to the filesystem (no persistent cookies!) and cannot read from sensitive filesystem folders or files. Conventional browser anti-phishing mechanisms are also in place checking sites visited against a list of known malicious sites.

The browser itself and the V8 JavaScript engine are open-source allowing others to use these in their projects. And good features developed by others can be introduced in the core codebase by the Google team effectively allowing a larger team to contribute to these projects albeit indirectly. Open sourcing is also a smart defense against monopoly allegations I guess.

This is a major shakeup of the browser market. Chrome was announced around the same time as the IE8 announcement, this is probably a deliberate move intended to invoke comparisons and garner more publicity. Users shifting to IE8 from IE7 or to IE7 from IE6 might decide to give Chrome a try and stick with it. Users of the various Google services are also a primary audience, the browser has the Google brand and that says something for the users of those services. But most disruptive of all Google Chrome will probably take away a significant chunk of the Mozilla Firefox userbase.

IE is the OS’s browser. It is the default browser, the “e” icon that most users associate with the Web and the browser that renders almost everything nicely. Firefox was the “alternate” browser. It is the browser with a rich ecosystem of extensions and thus more flexible. It is the preferred browser for tech-savvy surfers, slightly more secure and of course available on non-Windows systems.

Google Chrome is all set to displace Mozilla Firefox and become the preferred “alternate” browser. Today it does most things that Firefox can do, eventually it will do ALL things that firefox can do and I am not sure what Firefox’s differentiator will be to make me choose Firefox over Chrome. Today Chrome lacks the plug-ins/extensions that Firefox has but that is just a matter of time before Firefox extensions are ported to Chrome.I am going to hazard a guess and say that Chrome will have a third of the browser market a year frmo now.

All in all very interesting times in the browser world

Overall I am very happy with this laptop. It suits my needs very well and I am very satisfied with it. The price (50K INR) is also a bargain for a 17 inch laptop in India. I bought this laptop from the Croma store in Malad.

This laptop has many good features (that is after all why I settled for it in the first place). Almost all of the laptop’s “basic” features get a pass grade easily. The processing power (1.8 GHz, 2 x 512 KB L2 Cache) and RAM (1 GB) allow Windows Vista to run reasonably well (though an extra gig of RAM would help significantly) and anything other than Vista (say Windows XP, Ubuntu Linux) runs like a breeze. The 8-cell battery consistently lasts for more than 3 hours and takes around 90 minutes to recharge fully after being fully drained. The laptop’s looks are decent enough but nothing stunning. The laptop also has all the bells and whistles expected from a modern machine (CD/DVD reader/writer, Ethernet card, modem, 5-in-1 card reader, WiFi 802.11 a/b/g, Bluetooth, ExpressCard slot, all kinds of slots, VGA webcam, microphones etc.) and till now I have not felt anything amiss. The laptop weighs a respectable 4 Kg, though this is pretty heavy if you have to lug around your machine a lot.

However what sets this laptop apart from others are its “frills”. I love the bigger 17 inch monitor, it feels as if I am working on a normal desktop machine. The bigger size also allows the keyboard to have a separate numeric keypad. I find this much easier to use than the usually cramped and confusing laptop keyboard. The Synaptics touchpad works like a beauty though I prefer to use an external laptop mouse whenever possible. The touchpad has a “switch off” button that I use when using a mouse and this does not cause the mouse pointer to jump around when I hit the touchpad accidentally (which I do quite a bit). The external Altec Lansing stereo speakers are as powerful as small desktop speakers and good enough for “personal” music and movie purposes. The sound quality is beautiful (they are Altec Lansing after all) and do not seem to consume a lot of power (though I have not measured this scientifically). The in-built stereo microphones are good enough for making calls. The wireless cards (WiFi and Bluetooth) also have a dedicated physical on/off button that allows quick switching off if you want to conserve power.

This model does have a few minor annoyances (but no major ones). I hate the HP BrightView screen. BrightView is just HP’s marketing term for anti-reflective coating on the screen. Dell uses the term TrueLife and IBM/Lenovo use the term VibrantView for anti-reflective screens. These screens are good for watching movies or working in low-light conditions but for normal usage in well-lit surroundings they have a distinct mirror effect that is extremely annoying. I recommend that you check out the following 2 links to understand the cons (and pros) of these types of screens – Dell TrueLife Screen and Glossy versus matte: fight!. I work around this annoyance by making sure that there is no light source right behind me. This laptop also uses a lot of the new fangled blue LEDs. These are very bright and stressful on the eyes. Till now I have not found a software way of switching them off and they are distracting when watching a movie or when all lights are off and you are trying to sleep. The right shift key is also too small and I used to almost always miss it earlier. However I am a 2-finger typist and not the best judge of keyboard layouts. Nowadays I have just got used to where it is and do not make many mistakes any more. The locking mechanism for the lid also leaves a little to be desired since the laptop screen does not lock gracefully when lowered. If Windows Vista is going to be your regular OS (this model comes pre-installed with Windows Vista Home Premium) then I recommend another gig of RAM. The default 1 Gig is good enough but 2 GB will make it noticeably faster. A more sensible option is to install Windows XP or go the Linux way if you can. The 4 Kg weight (including the charger) can get quite heavy if you move around a lot and I recommend the more conventional 15 inch version of this model if you move around a lot.

All in all a very solid laptop for most people. I am sure this laptop is going to last me for at least 3-4 years and keep me quite happy.

Do you have any questions about this laptop? – Feel free to post them as comments, I will be glad to answer them and maybe work the better ones into the post afterwards.