I've been reading The Art of Software Security Assessment for quite some time now. I had originally picked a particular track through the book, but when I finished that I went back through to read the remaining chapters. A week or two back I was in what I thought was an interesting chapter -- 14. Network Protocols. All of the sudden the content started to not fit together and I felt like I had already read tthis stuff before.
Well, sure enough, I had. My book has been owned. Pages 843 - 890 were replaced with pages 795 - 842. OMG, arbitrary memory overwrite of 47 pages!:
Post to: 
reddit, 
Posted by Jon Hart on March 4, 2007 1:05 PM
| Permalink
Comments (2)
Ugh, that sucks. Here's a rough breakdown of what you missed:
843-852 - Something about "internet hacking"
853-860 - Pictures of Mark's ill-fated first career as an interpretive dancer
861-877 - Justin's inspirational essay on the life of Carrot Top
878-890 - Some code we stole from the NetBSD kernel where we bolded random lines
Seriously though, that does suck. If you look in the front of the book in the fine print on page iv, there should be a Safari coupon code you can use to read the book online. I suspect you can get a replacement copy from the retailer or the publisher. I'll find out about that and get back to you.
Hope you've enjoyed the book so far. :>
Posted by John McDonald | March 4, 2007 5:46 PM
Posted on March 4, 2007 17:46
John,
Thanks for the comment.
It looks like the Safari approach may get me what I need, but I need to create an account for that. I'm going to see if I have existing, semi-legitimate access to Safari, otherwise I'll pester the publisher about getting a book that has passed basic integrity checking :) The last thing I need is yet another account out there.
Aside from this, yes, the book has been quite enjoyable. The initial reviews I read about the book commented that, despite its great length, it covered all of the necessary bases both adequately and without unnecessary depth. There are too many books out there in the 500-1500+ page range that are essentially dumps of man pages for common utilities, RFCs, or the same-old rehashing of previously written documents. TAoSSA is a great middle ground. While I don't think I could give the book to just anyone and say "here, learn security", I'm fairly confident that I could give it to anyone who is somewhat technical and has an interest in security, and have them come away being able to speak semi-intelligently about the proper way to attack an audit.
Cheers!
Posted by Jon Hart | March 5, 2007 10:25 PM
Posted on March 5, 2007 22:25