5 comments about Software Configuration Management Patterns: Effective Teamwork, Practical Integration (Software Patterns Series).

1. There really aren't too many books that cover the subject of SCM and this one does a very good job of overviewing all the issues. Although he does give examples and opinions on different tools and platforms, the book is not written for any particular one. I especially like the fact that he is coming from a developer's perspective in the sense that the need for SCM has been brought upon him, like most of us, and it's not something he initially persued. Things like source control directory structure, versioning, builds, build policies, etc. are issues that are eventually dealt with by tech leads and/or tech managers but few usually have any formal experience with it. Anyone who has been in a small or large development shop knows how critical these issues are to the entire development process.
   
   I also bought Build Master by Vincent Maraia which is also an excellent book but I felt that his position has always been specifically a build master and the book dealt with very large build projects that had dedicated teams. In constrast, Berczuk and Appleton's book is more broad so that a lone developer/manager assigned to the daunting tasks of setting up SCM environments can achieve this and have a general guide for holding down the fort.



2. Objective, clear and simple. War stories told by a intellectually savvy trooper are not complex. They tell us about complex scenarios in a simple way. Field experience. It's what this book is all about. Not about procedures, but practices based on well known, or not so, patterns, for you to use with your teams to win your battles. It's up to you. Think about them. Use them wisely.
   Sorry for the military metaphor but seemed to me appropriate.



3. I am surprised to apparently be the only person to find this book disappointing. Let me go into the details.
   
   Physical book.
   I rarely comment on the physical book but I need to mention the bad printing. Many pictures and graphs in the book are not printed correctly. Instead they appear as gray rectangles.
   
   Content.
   The book is divided into three parts: an introduction, the Software Configuration Management (SCM) patterns, and appendices with information on SCM systems.
   
   The introduction does not provide useful information. The author spends time defining generic concepts (such as 'organization') without bringing any insights to configuration management. I assume that part was written to fill in the book. You can safely skip it.
   
   The patterns are the meat of the book. Some of the patterns are useful and nicely presented. For example, the need for a mainline and how to branch before a release are the two that stand out. They are good advice. Unfortunately most patterns are not explained appropriately. For example, the author presents several patterns related to tests (unit tests, smoke tests, regression tests). However the patterns do not properly make the connection to configuration management. For example: what are the best practices to integrate tests with SCM? The answer is not in the book. Overall I felt let down by the patterns. If you have some experience working in a group using a SCM, you won't learn anything new.
   
   The final part about the various SCM systems is again a filler with little usefulness. You will learn a lot more by reading the manual of the SCM you are using.
   
   There are several topics I wish had been included:
   - Topology: how best to distribute the SCM system.
   - Buddy builds: what are the best practices related to buddy builds, i.e., building before making a check-in.
   
   I was looking forward to reading this book. Now that I have, I feel very much let down. The useful information could be contained in less than 10 pages.



4. This is an outstanding book for software development teams that see software configuration management as a means to an end, not the end itself. The author immediately establishes credibility with me when he says in the preface "Software configuration management is not what I do. I am not a software configuration management person...I build software systems" Exactly! It's obvious throughout the book that the authors develop software systems and use SCM to effectively support their development effort, not the other way around.
   
   The format of the book is very consistent and thus very easy to read. Each pattern has its own chapter and clearly identifies the problem and the solution in a particular context. It doesn't waste any paper and is a quick read and has been a reference I continue to use on a regular basis. The authors have taken something that can quickly become complex and make it easy to understand.
   
   The authors have a very natural writing style and effectively use sidebars to bring their real-world experiences to the pattern. This book is a must read for software developers. I wish I could give it six stars.
   
   Given my background in CI, I was most drawn to the Mainline, Private Workspace, Repository, Private System Build, Integration Build, Regression Test, and Third Party Codeline patterns. But, there is something for all developers and teams here.



5. If you have source control and a continuous build then you don't need this book. This book has two chapters telling you why and when to branch in CVS. Ten years ago, I would have found this book useful.

3 comments about Hacking Exposed Web Applications, 2nd Ed. (Hacking Exposed).

1. I recently received copies of Hacking Exposed: Web Applications, 2nd Ed (HE:WA2E) by Joel Scambray, Mike Shema, and Caleb Sima, and Professional Pen Testing for Web Applications (PPTFWA) by Andres Andreu. I read HE:WA2E first, then PPTFWA. Both are excellent books, but I expect potential readers want to know which is best for them. I could honestly recommend readers buy either (or both) books. Most people should start by reading HE:WA2E, and then fill in gaps by reading PPTFWA.
   
   Before proceeding I should note I used to work with the two ex-Foundstone authors of HE:WA2E, although I haven't been afraid in the past to review books honestly.
   
   I read and reviewed the first edition of HE:WA about four years ago, and I rated that book five stars. Authors like Scambray and Shema exemplify the best aspects of the HE series: explaining technology, then showing how to exploit it. Frequently the first time security people hear about new applications is when they are being attacked. By digesting books in the core HE series, readers become familiar with the latest services, their flaws, and attacks against those technologies. HE:WA2E continues this tradition.
   
   I was pleased to see HE:WA2E is largely a thorough reworking of the first edition. (This has not always been the case with HE books, considering there are five editions.) In one case, however, this worked against the authors. Ch 8 (Attacking XML Web Services) references non-existent material in Ch 1. Ch 1 in HE:WA2E is completely different from Ch 1 in the first edition, which contains the referenced diagram. A positive aspect of the rewrite is the frequent reference to outside material, instead of repeating techniques and tools already published. Combined with the extensive chapter-ending references list, this makes for a book packed with value. Note that the second edition still offers 520 pp, vastly exceeding the 386 pp of the first.
   
   HE:WA2E is very consulting-oriented, which delivers some excellent real-world experience. For example, Ch 2 (Profiling) explains how to identify and deal with load balancers and web application firewalls. This seems to contrast with PPTFWA which says, for "IDS/IPS Systems," "[m]ake sure your client disables these." I thought HE:WA2E took a more realistic approach to this problem.
   
   HE:WA2E's major weakness is its coverage of Web Services. PPTFWA does a better job addressing this important area. In fact, HE:WA2E's Web Services coverage seems fairly similar to the first edition's material. PPTFWA also includes a larger variety of attacks and tools, albeit in a manner not as organized as HE:WA2E. Ch 12 of HE:WA2E would be conceptually stronger if so-called "threat trees" were called "attack trees," as originally developed by Bruce Schneier in 1999. Furthermore, the list of "threats" on pp 404-5 are mostly vulnerabilities. The figures of Ollydbg in Ch 12 are also too small.
   
   Despite these issues, I think HE:WA2E is the best general-purpose Web application security book available. I would definitely add it to your HE library. In other words, if you have HE:5E, you still need HE:WA2E. If you have the first edition of HE:WA, it's time for an update. After reading HE:WA2E, read PPTFWA. Perhaps both sets of authors could collaborate on a comprehensive Web app attack, defend, and test virtual machine, building on the one Andres Andreu built?



2. this book is quite complete, very utile to learn all about security on web applications.



3. I bought this book about 4 years ago, and still find myself going back to it again and again for reference. To this day its the only technical book that I have read cover to cover. While I have not yet checked out the 2.0 book for web apps, I still feel you can't go wrong adding this book to your arsenal.

No comments about Wicket in Action.

No comments about Pro SQL Server 2008 Reporting Services (Pro).

5 comments about Foundations of Python Network Programming (Foundations).

1. Apress has two books on Python that I really like. This one and "Dive Into Python". The thing I like about this book is it delves into some deep concepts, like client/server code, but does so in such a way that even people new to Python should have no problem understanding it.
   
   I have been a programmer for about 15 years, and made heavy use of Python for the last 5 or 6 years. My brother is new to programming. Both of us found this book to be very useful and easy to understand. I recommend it to programmers of all levels.



2. This is a well presented, well paced introduction to network programming in Python. He presents programs both as interactive sessions (follow along in the comfort of home) and as scripts (programs) available to download from his web site at Apress.
   
   It serves as a good, general purpose, introduction to network programming as wall as a Python-specific network programming tutorial.
   
   I do, however, have some complaints. Although the author attempts to present information in a platform-neutral manner, it is obvious that he is much more familiar with *nixes than with Windows. There are several minor factual errors in the Windows information he presents. [I have submitted these as error reports on the Apress web site.]
   
   Fortunately none of these disrupt the actual presentation. Experienced Windows programmers will be able to correct the mistakes on-the fly. As a minor example, Windows programmers know they can type "script.py" to run a python program even though Windows doesn't honor the #! line at the beginning of the script.
   
   My other complaint has to do with the use of PyDNS to discuss DNS issues. As far as I can tell PyDNS is dead, or at least it is dying. dnspython would have been a much better choice. However given that the book is three years old, I can't really fault the author for picking the wrong package -- it's happened to all of us at some point in our careers.
   
   And a truly minor quibble: he starts with an example of downloading a file using the gopher protocol. Do you have any idea how hard it is to find a gopher server now days



3. It has everything you need to know about Networking Programming in Python. Easy to understand also. It can be made more detail and more advance for profesional use.



4. I'm giving this book 5 stars because I found it more useful than many books. There are some flaws, but overall I am happy that I own this book.
   
   This book uses a teach by example technique as discussed in other chapters. It is oriented towards application developers that find themselves in need of python networking rather than networking people that need python.
   
   The book is overall clearly written and the examples are generally interesting. The author shows an advanced understanding of most of the subject matter. Chapter strength is fairly variant. On the other hand, it's pretty likely that you do not have knowledge of all the topics in this book and will learn something interesting by reading it.
   
   Cons: The chapter on HTML tag matching felt really weak. They tried to treat HTML as a regular language by using state machines to match it, when it's clearly context-free, then he started to add a stack but he had already lost my interest as the examples got fairly unwieldy.



5. I have no background with Python and limited understanding of networking. So my comments are from a rookie. So here they are:
   
   1) Readable: technical enough but gets right to implementable examples. You can jump around in the book and find what you need with out having to read the whole thing.
   2) Applicable: I used examples from the book to gain an understanding of my Linux system and my home network.
   3) Python is free so use it.
   
   That is all.

5 comments about Microsoft Visual Studio 2005 Unleashed.

1. I was very impressed with the content found in this book, there was wide coverage of not only the in's and out's of using the IDE, which is an excellent introduction to any beginner, but also great coverage of Visual Studio Team System and the automation model found within Visual Studio allowing anyone to extend the IDE, which is more in line with an intermediate developer. This book is well suited for the beginning to intermediate developer looking to get up to speed with Visual Studio 2005. Great job Lars and Mike.



2. The book has been a disappointment; it assumes that the reader knows almost everything there is to know about the Visual Studio 2005 program, and the explanations are vague, and far and few in between.
   I just wasted valuable money buying this book. I should have checked its contents at the local bookstore first before purchaing it.
   This book is poorly written.



3. This book did a great job of revealing the breadth of features available in the product. I think this book is quite useful to not only those that are just getting started but those that are seriously considering implementing VS/TFS in the organization. Even if you are an experienced user of Visual Studio you will certainly learn several new tricks. In fact, I reference this book with my clients who are interested in rolling out VS and TFS.



4. An excellent book. Lots of examples. Unfortunately, you will have to type in all the code examples yourself as the Sams Publishing web page does not have any downloads even though the back covers says that they are available.



5. I started a new job a while back and found myself using VS2005 for the first time after years of using VS6. I was looking for a book to get me up to speed, and there are few titles out there.
   
   While this book had some useful info I found that it wasn't terribly useful for a programmer writing C++ in a non-.NET environment. Most of the coding examples are in other languages and mainly targeted towards .NET.
   
   If you're working in that environment you may find this more useful than I did.

3 comments about Measuring the Software Process: Statistical Process Control for Software Process Improvement (SEI Series in Software Engineering).

1. This book gives a practical guidance on software process measurement: what should be measured, how to measure, the measurement process/procedure, the data analysis of measurement, and the application of analysed results. It's easy to read and understand. It would be better to include more "case study" information.



2. This book is a self-contained statistical process control (SPC) foundation in the context of software process improvement. Authors Florac and Carleton apply early industrial wisdom and some previous work at the SEI to a modern software development environment. The emphasis of the book is primarily on the use of analytical studies (predicting future outcomes) using the control chart as the primary instrument. There is only brief treatment of the use of enumerative studies (evaluating current situations) in this problem domain. Time-honored tools such as the Pareto chart, cause and effect diagram, and histogram, however, are given much less attention. The first half of the book directs attention to critical topics such as planning, managing and measuring. The authors adequately cover the material as it applies to software development, but the reader is cautioned that many statistical fundamentals are omitted from this work. In order to put these ideas into practice one should seek further instruction or consult a statistician for best results. A few annoying typographical and redundancy errors are present as well. Most bothersome about the book is that the authors do not seem to be 100% convinced that SPC for software process improvement actually works! This is somewhat alarming, given the long successful history of SPC in other industries. All in all, however, this book desperately needs to be read by anyone wishing to improve a software development process.



3. This book contains the keys to meeting core CMM level 5 requirements, which defines key processes for optimizing and continuous improvement, and for achieving 6-sigma processes. However, you need not be striving for either (or both) of these goals to use the techniques and approach in this book to full advantage.

   Implementing and employing statistical process controls are the basis of this book. The authors lead you through the steps and techniques necessary to implement and use SPC, starting with background information on processes and a process measurement framework, and moving through topics such as planning your measurement strategy, data collection and analysis, and developing and interpreting process behavior charts using common SPC chart types. The most common controls are x-bar (mean) and r (range) charts. Be aware that any SPC approach requires two conditions to be met: (a) defined processes, and (b) the processes are in statistical control (meaning that the data points being measured have settled into a normal distribution that are randomly clustered around a mean and have defined upper and lower control limits). New processes, or processes that are not managed well enough to have these characteristics are not candidates for SPC.

   This book requires knowledge and skills in basic statistical analysis. If you require a refresher I recommend reading "Visual Statistics" by Jack R. Fraenkel before tackling this book. I also recommend "Applied Statistics for Software Managers" by Katrina Maxwell, which not only teaches the basics, but also approaches measurement from the perspective of multi-variable analysis, regression analysis and other basic measurement techniques, which nicely complements the SPC material in this book and gives a broader picture of metrics.

1 comments about Introduction to Software Testing.

1. Unit tests are all the rage. Maybe they are being touted out of proportion to their place in the hierarchy of testing methods, maybe not. I don't know enough to say either way, and was hoping this book would clarify that question. Instead I found that "unit test" was not even in the index. So, if I understand the current gestalt correctly, a neophyte depending on this book alone will come away unable to converse with the developers in many real-world shops. This is a tragic example of academic insularity blunting the authors' effectiveness in preparing their charges for the world beyond the classroom.

5 comments about Agile Adoption Patterns: A Roadmap to Organizational Success.

1. Elssamadisy's book is in tough, tough company. How can you compete in the same space as amazing works like Subramaniam and Hunt's Practices of an Agile Developer or Shore and Warden's The Art of Agile Development? Those are tough, tough classics to go against when trying to explain how teams/companies should adopt agile practices.
   
   Amr pulls it off by organizing his material in a fresh form which I found very useful. He hits many of the same points as other works on Agile (smells, process, team empowerment, practices, etc.), but emphasizes the business value of each point. For example, his chapter on User Story lays out the case that user stories are simple documents in their initial draft. The value comes from developers having conversations to flesh out the details and implementation of the story. Product utility is improved, and development costs are reduced.
   
   This same approach is carried on throughout the book, making it very clear what specific benefits you can find from each practice. Additionally, each practice or chapter follows a nice recipe-like format. Start off with business value, move on to a sketch describing the practice, follow up with context of the practice and forces impacting it, then look to why you'd want the particular practice, adoption details, and a bit on the practice's cons and variations.
   
   The book starts out with a high-level overview of agile, then moves on to specific patterns/practices. Each pattern is a short, separate chapter with about 40 patterns in total. The style of the book is clear, concise, and it's nicely produced.
   
   Another great point about the book is Elssamadisy's ongoing assertion that you don't need to adopt all of the practices. Rather, find the pain points you have in your environment and look to implement only the patterns which will ease that pain. This pragmatic approach to agile adoption is a refreshing view in a world where some Agile fanatics insist you must adopt every single practice or you're not doing Agile. (A fanaticism I emphatically disagree with.)
   
   Overall I think it's a solid addition to the Agile section of your bookshelf. It's not a replacement for things like Subramaniam's or Shore's works; it's a solid addition to them.



2. There are many things I like about this book, not the least of which is that it is true to the "spirit" of patterns and agile -- it does not promise easy answers or quick fixes but offers down-to-earth advice based on experience. The patterns do a good job of capturing that experience but the way the patterns are written, with "threads" of stories throughout is not only convincing but enjoyable reading. I like being able to follow the real-life adventures of the same developers who struggle to solve real problems across several patterns. I also like the case study in Chapter 46 where a real company with real problems does a pretty good job of moving forward, but it's not a "and they all lived happily ever after" scenario. We're overwhelmed with books and advice these days, so it's nice to see someone who offers help and hope but not hype!



3. There are plenty of excellent books available that explain agile practices. What has been missing until now is the guidance to apply them. Amr's approach to achieving agile practices is filling a need that has been felt by many for several years now. Amr takes an excellent approach to identifying the best means of applying agile techniques based on a combination of business needs and project pains. This approach stays focused on delivering business value to the enterprise as they move towards agile practices.
   
   Amr has an excellent writing style that is both concise and entertaining delivering information in a manner that can be absorbed in bite-sized chunks and applied as needed based on the initial needs assessment. After identifying the business needs or pains the best agile practices to deliver the value or reduce the pain are described in a manner that determines which practices will deliver the best value to meet your identified needs.
   
   I highly recommend that you pick up this book if you are either planning to adopt agile practices, struggling to adopt agile practices or are looking to enhance the agile practices that you currently employ. Well done Amr.



4. There are many books about the theories and practices that are encompassed in the word "agile". Quite a number of them are quite good in terms of addressing the specific practices and how to implement them. It you want to learn Scrum or XP, there is no shortage of books and how-to materials, along with plenty of advice.
   
   This book, however, addresses the goal of agile adoption from a new perspective - patterns of behavior and thought, and how to specifically leverage and/or address them. It addresses this from the organizational/team perspective, rather than the individual perspective, which makes it particularly valuable for those of us who are working in an organizational transformation/agile adoption environment.
   
   While it might seem that "patterns" would appeal to the techies in its audience, my experience is that Amr has managed to frame his work in terms and concepts that are readily understood by all. This book is readily digestible by non-technical managers and staff, as well as by those of us who have spent/currently spend our time in a technology environment. It is not necessary to understand what design patterns are, for instance, to understand the patterns in this book.
   
   For those who are either anticipating agile adoption or actively engaged in it, or even those who are struggling with what seems to be a failed adoption, this book is required reading. The way in which the patterns are presented, the clear and pragmatic exercises described to help work through them, and the suggestions for ways to approach it all are just what's needed.
   
   Real world, pragmatic, easy to read, and easy to digest - that's what this book is all about.
   
   It will be on my desk and heavily thumbed in short order.



5. Proven patterns for succeeding with Agile in an organization are presented in a series of case studies and hands-on exercises in Agile Adoption Patterns: a Roadmap to Organizational Success. Here are the most common stumbling points teams face in implementing strategy, along with tips on how to teach, train, and bring customers on board to an agile environment. Any Agile project manager will find this an excellent series of tips, making this perfect for software engineering collections.

2 comments about SAP® NetWeaver Portal Technology: The Complete Reference.

1. The Level of detail and information in this book is simply phenomenal. The author give an end to end picture of SAP Netweaver Portal Technology. Much better than some of the other books on this topic I have bought here. The images and illustrations in the book are very practical. This book is a must for every aspiring SAP Portal Architect/Developer!!!! Awesome work Rabi Jay!!!!!



2. This is a "ONE STOP BOOK" for everything portal for beginners, Intermediate and advanced users of SAP Portal and also for managers with a lot of inputs from a implementation perspective.
   Each of the chapters are sequenced with a well thought out flow keeping in mind the actual project life cycle. Each of these chapters are laid out very well with certain unique features that are not to be seen with any comparable book on SAP portal and they include OSS Notes, tips and tricks.
   I strongly recommend this book for all levels of users and as the title suggests I strongly feel "THIS IS A COMPLETE REFERENCE".