On a recent project, the vendor’s software was going to be embedded in our website through an iframe. After a quick tutorial from my husband (a software architect who had done a lot of research on the security of iframes not too long before that), I thought it would be interesting to poke around and see what I could find in their system and see if I could break into it, though I’m not a security tester. I found some of what I expected to find – they were using security headers that are a little dated but the best that work on Safari (there’s more secure stuff for the other browsers – I don’t know why Apple is behind the times on that). But there was also a header that was misspelled when it should have been automatically generated by the system. This gave me pause. There was a possibility that something got a little funky with the server, but it was also possible that they were hard-coding things on a homegrown server rather than using a commercial server that is regularly patched.
I filed a bug. And pushed it. A lot. I got the Information Security team involved. The response finally came back (after more than a month of asking) that they were not using Apache, but they couldn’t tell us more about it, that they were keeping up with security issues and regularly testing their server. This was another issue. The software we were given was so poorly written and tested, that I wasn’t sure if we could trust their word that they were adequately testing their own servers, much less keeping up with OWASP vulnerabilities or doing anything security-related.
InfoSec was aware of this. But when I asked about the results from their penetration testing, the project manager told me that they weren’t doing any testing. It was in our contract with this vendor that we wouldn’t do any testing of their server.
Seriously? My response to that in a meeting was, “Someone is touching their servers, and I’m concerned that it’s not us.”
I lost the battle. I looked through the contract to see if there was any way we could say they breached the contract (hooray, law background!), but the vendor had written it so wishy-washy that it was basically a “best effort” contract without anything binding. So frustrating.
In addition to the gaping potential security issues, it was a big problem to me that testers weren’t involved in the decision-making process. I’m not sure if anyone technical was involved, though I really hope so. But a tester could have raised the issue about not testing their servers instead of lawyers and business people just agreeing to it without considering the implications. It should have been a major red flag that they didn’t want us to try to break into their server.
Testers are not just a checkmark. We have experience and specific knowledge that can assist with product decisions and can end up protecting the business’s interests.
It’s been a long time since I’ve posted something on a Friday, and there have been a number of games I’ve played recently. I’ve been to two board game conventions and have played a lot of games with friends. This is a long post, but here goes (in alphabetical order):
- Adventure Time Munchkin: Munchkin has expanded to many different universes, and as my husband really likes Adventure Time, I thought he would be most amenable to this version. Munchkin is a nod to role-playing games in a more accessible format. Once you get into it, it’s a fun game, but the start can be a little rough. Carl liked it, but I’m not sure how much he’ll play it with me.
- Attila: I brought this home from a convention (yay game giveaways!). It’s a simple 2-player game with just knight movements from chess. The board can be set up in various configurations, and on your turn, you move a figure and then block a spot. The game ends when someone can’t move any of their three pieces. It’s a simple game with a different kind of strategy from chess.
- Bring Your Own Book: I also got to bring home this game from a convention. It involves pulling quotes from books you choose with an Apples to Apples mechanism after that. It can be quite fun. We’ve played with novels, feminist essays, a guidebook, a textbook, and a book about horse breeding, among others. It’s fun, the variety of literature makes it interesting.
- Carcassone: This is a staple of a good board game collection. In it, players place tiles and claim different features. You try to build cities, monasteries, roads, and farms and claim more than your opponents. It’s a great starter game to gently introduce new players to the concept of board gaming.
- Citadels: This plays 2-7 people, and it’s a card game where you take a character each round and build a district out of your hand. The game ends when someone builds their eighth district, and points are based on the cost of your districts. With two players, each person gets two characters each round. I think it’s most fun with 5-6 players, because with two, if one person really gets their economy going, it can turn into a blowout.
- Dingo’s Dreams: This is a game from the same guy who made Above and Below, a wonderful game on its own. Dingo’s Dreams has you create patterns to duplicate the pattern in the middle. It requires planning out a few steps, but there is luck involved. I’m not terribly awesome at puzzle games, but I enjoyed it more than I thought I would. And the Australian animals are cute. 🙂
- Dominion: A classic, Dominion is a deck-building game where you perform actions and buy a card. The cards can be more money, action cards, or victory points. The trick is to not let your deck get to heavy with victory points, while still staying ahead of your opponent. Each game is different, because you don’t play with all the cards each time. Such a good game, though we don’t have any of the expansions (which are numerous).
- The Duke: This is a two-player chess variant where the pieces flip every time they move, and they move differently based on which side the tile is on. It’s got more luck than chess, because you draw out tiles from a bag, but there’s still strategy involved. We ended up going through most of the tiles, and my duke was eventually trapped. I really enjoy this game, though the feel of the bags that come with it is super gross, and I made my own bags.
- Fiasco: This is a light role-playing game where everyone gets a chance to create a number of scenes and have things go well or poorly. We played with three, and I’m not sure we got it entirely right, but we created a fun story, shooting various people. I got to wing Carl. 🙂 The idea is that it’s like a Coen brothers movie, where things go wrong a lot.
- Innovation: The box is really boring, but the game is great! It’s a mostly balanced game where players build their way through different ages of history. Some cards are very powerful if you have the right economy built up, but there is some luck in getting the right cards. Sometimes you struggle to get any cards in your score pile, and sometimes someone can take all your good cards away. Once we learned it, it became one of our favorite games. The first time was rough, but persistence paid off.
- Killing Dr. Lucky: This game is kind of the opposite of Clue. Instead of trying to discover the murderer, you’re trying to be the murderer. You have to think a few steps ahead to try to be in the same place as Dr. Lucky while keeping him alive until you can kill him. It’s a fun game, with more strategy than I expected. We played with four players, and it was pretty well-balanced.
- Marrying Mr. Darcy: Okay, so this one first gave me pause, because if it took things seriously, it could be super awful. However, it’s sarcastic, and I think Jane Austen would be proud. Each player takes a different heroine and tries to improve her beauty, wit, friendliness, or reputation to attract a suitor. The suitors have different requirements, and the heroines all have different goals. Event cards include skills at the piano and other “accomplishments”, as well as party cards. It’s a great game for a Pride and Prejudice fan, and there’s an Emma expansion that I may have to acquire as well.
- Orleans: This is a worker placement game, in all the best ways. We played with the deluxe Kickstarter version, with metal coins and stuff. Very nice. We played with people who had played a lot before, so we didn’t stand a chance of winning. But it was fairly easy to pick up and play, if you understand the basic mechanics of worker placement games.
- Paperback: I love word games. Carl won’t play them with me very much. Paperback is like Scrabble and Dominion mashed together. It’s a deck-building game with letters, and you create words to gain points and buy additional letters and victory points. I want this game. Really badly. But I’m not sure I’d have anyone to play with.
- Patchwork: This is a 2-player game where each person builds a quilt. It involves spatial reasoning and some strategy in balancing buttons (money) against time. It’s a great 2-player game, easy to learn and fun to play, though I have yet to beat Carl. He just rocks at the game.
- 7 Wonders Duel: A variation of 7 Wonders that is designed for two players (and thus much better for two players than the original), it’s similar to the original with a little different strategy, in that cards are laid out on the table, some upside-down, and they are revealed gradually. It is fairly balanced, and I enjoyed it both times I played it (with different people).
- Too Many Cinderellas: Cute game, not terribly sexist, though a little bit. Players submit rumors that can be denied by other players, and everyone tries to have at least one eligible Cinderella for the prince to marry at the end of each round. A little like Love Letter, in that the rounds are quick, and a player wins by winning multiple rounds, but it’s not as fun, and it’s more frustrating than Love Letter.
- Tsuro of the Seas: A variation from Tsuro, this involves sea monsters. Unlike Tsuro, if you run into other players, you pass through each other. You die if you go off the board or get eaten by a sea monster, which move frequently, swallowing tiles. You can play regular Tsuro on it too, so this seemed like a good choice, though the plastic ships are not as cool as the colored stones in the original.
- World’s Fair 1893: This was one of the winning games at my board game convention, and it was one of my favorites as well. Players try to make exhibitions in various categories and collect tickets. It’s not terribly complex, but it is a fairly strategic game. Lots of fun.