QUESTION & ANSWER How Google developed the Chrome Web browser

By Colleen Frye, News Writer
01 Oct 2008 | SearchSoftwareQuality.com

Google's Darin Fisher, a software engineer on the Chrome project, talks about how the Web browser was developed and tested. As you might suspect, agility, speed, and testing were all critical.

Tell me about the development process you followed for Chrome?
Darin Fisher: Some might say certain elements seem like agile programming, but we didn't specifically say let's use this methodology; we just said we'd do what seems right.

My background is working on browsers; I had worked on Firefox. Aspects [of the process] derived from what other Google teams do, like the policy of reviewing all patches before they're committed. Also the approach of doing design documents for complex feature work; it's a great communications tool and something Google does commonly. But by and large, we developed a lot of our own approach to things. Google typically builds server applications or websites, so a Web browser is a different beast.

Was the development team distributed?
Fisher: The new JavaScript engine [V8] was developed in Demark. There are some folks in other offices, but [development] was largely centered here [in Mountain View, Calif.] for the browser.

Did you subdivide the development work?
Fisher: We tried to not overly subdivide. For the core browser we wanted the approach that the engineers should own the whole feature from top to bottom and be able to move around the project where they were most interested in working. We had a flat structure, with subteam meetings. If what you were working on aligned with that meeting, you could go. People could self-select for things they were interested in. We don't have layers of management at Google or on the Chrome project. It works because people are keen to take on personal responsibility for the things they do.

How did the team determine which features to include?
Fisher: When it came to requirements, a lot of the process involved brainstorming meetings with the team and we talked about features. We also had an open mail list internally at Google where people said what would be cool. Then a smaller team went through and generated a living document, a beta roadmap, that said here's a set of features we know we've got to do. It included not only requirements for the browser, but a few things that would make it a compelling beta product. We tried to keep the features very focused and minimal. We're adverse to feature creep. Then we shared the list with the whole team, and people would self-select for what they wanted to work on.

Did you set time frames or milestones?
Fisher: We oriented things around quarters, so the living document was revised each quarter; say this quarter we're focusing on this subset, etc. It was helpful to drive the product forward, and to make sure the product very early on was usable by anybody at Google so we'd have continuous feedback. They were getting a new build every week automatically. In the early days we may have been missing features, but we had a browser users could use, which was essential to success. We had a growing base of internal users, and as it became more feature rich we tried to maintain quality and make sure it was always a stable, usable, dog-foodable product, which was a key element to our methodology.

How did the team go about testing Chrome?
Fisher: We were very focused on automated testing. The engineers write automated tests for all work. We have a variety of frameworks for unit testing; others are testing the whole systems and various things in between. The cool thing was wide-scale testing. We'd take the build and run it against a large number of websites. Automated test was essential to go fast.

What does the new browser mean for Web application developers?
Fisher: What's very important is we tried our best to not introduce a new rendering engine. We used WebKit which is the same rendering engine inside Safari, so if you built Web applications with Safari they will work in Chrome. We also wanted to make improvements, and we focused on performance. If you could go faster, you can do more stuff. So for Web developers looking to find a faster JavaScript engine, V8 is very impressive. The point of V8 is to show the great the potential in the space -- that JavaScript can be faster. So for Web app developers, if you have a faster JavaScript you could depend on doing more in JavaScript, which is exciting to us because Google is building a lot of applications.

How did you address Web application security?
Fisher: We have a security team at Google that's done a lot of work on Chrome. They use a host of scanning tools, bug testers, etc. And Chrome has a sandbox technology to provide an extra layer of protection. It was important that the sandbox was robust, so a lot of [Google] people focused on trying to break out of the sandbox. There is way more to security than protecting against malware, so we tried to do due diligence to exercise the product.

My brain Test result

I have just taken a test "The Brain Test" and got the following result:

Left-brained

Most left-brained people like you feel at ease in situations requiring verbal ability, attention to detail, and linear, analytical ability. Whether you know it or not, you are a much stronger written communicator than many, able to get your ideas across better than others.

It's also likely that you are methodical and efficient at many things that you do. You could also be good at math, particularly algebra, which is based on very strict rules that make sense to your logical mind.

The classic IQ Test

Today i gave a test called "The Classic IQ Test" on www.tickle.com. I enjoyed this test. I scored 126 which according to them falls under the category "Visual Mathematician". This test is available on www.tickle.com and it is free of cost. My complete result of this test is given below:

.

Visual Mathematician

.

Your IQ Score is: 126

.

You have a strong ability to process visual-spatial and mathematical information. These skills combined with your strengths in logic are what make you a Visual Mathematician.

You're able to understand patterns visually and in numbers. That means your mind can create a mental picture for any problem. In addition to that skill, you possess an intelligence that allows you to apply math to that picture, too. That helps you manipulate multiple parts of the picture (or problem) to come up with a solution. You have many skills that are critical to success and problem-solving. Your talents help you understand the "big picture," which is partly why people may turn to you for direction — especially in the workplace. You flourish in environments where tasks are clearly defined, and you are a whiz at improving processes and making things more efficient. Your ability to detect patterns and your skills in math and logic, make it natural for you to come up with ideas and theories that simplify processes for everyone.

Outside of work, Visual Mathematicians tend to do well at strategic activities like chess. It must be that ability to recognize patterns — both as they are and how they develop. Regardless of how you put your mind to use, you've got a great set of talents. You will be able to envision a clear path and calculate the risks, and more importantly, the rewards, of anything you take on

How to use pointers and Unmanaged code in C#

It is a very small and basic article showing that how can we use pointers in C#. I am posting this article because most of the people think that C# does not allow the use of pointers. In this example I will create a small function which will changes the value of a variable using the Pointers. So lets start:

First of all make a simple console application. Copy the following function:

unsafe private static void UseUnsafeCode()

{

int count = 10;

int* p;

p = &count;

System.Console.WriteLine("Value of count before changing=" + count.ToString());

*p = 25;

System.Console.WriteLine("Value of count after changing=" + count.ToString());

System.Console.ReadLine();

}

Now call the above function in the main program.

Please make sure to allow the compilation of safe code in the property of the project.

The sample code will look something like this:

using System;

using System.Collections.Generic;

using System.Linq;

using System.Text;

namespace ConsoleApplication1

{

class Program

{

public static void Main(string[] args)

{

UseUnsafeCode();

}

unsafe private static void UseUnsafeCode()

{

int count = 10;int* p;

p = &count;

System.Console.WriteLine("Value of count before changing=" + count.ToString());

*p = 25;

System.Console.WriteLine("Value of count after changing=" + count.ToString());System.

Console.ReadLine();

}

}

}

In the above example I have made a function in which I have declared two variables. The first one is count and its data type is int and the second is an int pointer. Also in the code I have changed the value of count variable using the pointer p variable. The output is given below:

Value of count before changing = 10

Value of count after chaning = 25

How to avoid SQL Injection

What is SQL Injection:

SQL injection is a technique in which an attacker try to alter the backend sql statement through your application's input. Like he/she can enter such statments in your application's input (i.e. Text box) which can alter the sql statement at your backend.

Example:

SQL injection can be explained with the help of the following example:

Suppose you have following:

A Login Page

A User table in your database.

Your application can be accessed only after entering the user name and password in the input of your login page.

Suppose there is only one user called "test" and its password is "test".

User will enter the above mentioned user name and password in login page.

The sql statement which you generate in ur login page will look some thing like that

select * from User where username = 'test' and password = 'test';

If the above statement returned a count of 1 then you will redirect user to default page of your application.

What if in the user name the attacker enter the following name

'sample' or 1=1 --

The sql statement which will be constructed will look like this:

select * from User where username = 'sample' or 1=1-- and password = 'test';

The above statement in sql will always return some result and the attacker will be redirected to default page of your application. why ? To know the reason lets digest the above statement:

The statement is self explanatory :). See that in user name the attacker has entered such info which will always be true. i.e. The attacker has basically altered your sql statement in such a way that he/she is asking for a user name where user name is 'sample' or 1=1 and commenting all statement after that. If no user with the user name of 'sample' is found then the statement 1=1 will always be true and -- will ignore the remaining statement because of --.

Note:

The attacker can also use some other statements after login. which may includes Insert,update,delete,drop etc.

How to avoid from SQL Injection:

Avoiding from SQL injection is not a rocket Science. You can do any thing from the following:

Use SP to execute your SQL statement, and do not construct the complete SQL in ur application.

Proper Validation (i.e. dont allow user to enter invalid character like -- etc)

Note:

The attacker can make different combination to attack the application, so always keep sql injecton in your mind while developing the application.

C Sharp Interview Questions (Part One)

Following are some C Sharp interview questions which I have found on Internet and decided to share it will all of you.

What is C#?
C# is a programming language designed by Microsoft. It is loosely based on C/C++, and bears a striking similarity to Java. Microsoft describe C# as follows:
"C# is a simple, modern, object oriented, and type-safe programming language derived from C and C++. C# (pronounced 'C sharp') is firmly planted in the C and C++ family tree of languages, and will immediately be familiar to C and C++ programmers. C# aims to combine the high productivity of Visual Basic and the raw power of C++."

Does C# have its own class library?
Not exactly. The .NET Framework has a comprehensive class library, which C# can make use of. C# does not have its own class library.

What standard types does C# use?
C# supports a very similar range of basic types to C++, including int, long, float, double, char, string, arrays, structs and classes. However, don't assume too much. The names may be familiar, but many of the details are different. For example, a long is 64 bits in C#, whereas in C++ the size of a long depends on the platform (typically 32 bits on a 32-bit platform, 64 bits on a 64-bit platform). Also classes and structs are almost the same in C++ - this is not true for C#. Finally, chars and strings in .NET are 16-bit (Unicode/UTF-16), not 8-bit like C++.
Is it true that all C# types derive from a common base class?
Yes and no. All types can be treated as if they derive from object (System.Object), but in order to treat an instance of a value type (e.g. int, float) as object-derived, the instance must be converted to a reference type using a process called 'boxing'. In theory a developer can forget about this and let the run-time worry about when the conversion is necessary, but in reality this implicit conversion can have side-effects that may trip up the unwary.
So I can pass an instance of a value type to a method that takes an object as a parameter?
Yes.

What are the fundamental differences between value types and reference types?
C# divides types into two categories - value types and reference types. Most of the intrinsic types (e.g. int, char) are value types. Structs are also value types. Reference types include classes, arrays and strings. The basic idea is straightforward - an instance of a value type represents the actual data, whereas an instance of a reference type represents a pointer or reference to the data.
Does C# support multiple inheritance (MI)?
No, though it does support implementation of multiple interfaces on a single class or struct.
How do I declare a pure virtual function in C#?
Use the abstract modifier on the method. The class must also be marked as abstract (naturally). Note that abstract methods cannot have an implementation (unlike pure virtual C++ methods).
Can I call a virtual method from a constructor/destructor?
Yes, but it's generally not a good idea. The mechanics of object construction in .NET are quite different from C++, and this affects virtual method calls in constructors.
C++ constructs objects from base to derived, so when the base constructor is executing the object is effectively a base object, and virtual method calls are routed to the base class implementation. By contrast, in .NET the derived constructor is executed first, which means the object is always a derived object and virtual method calls are always routed to the derived implementation. (Note that the C# compiler inserts a call to the base class constructor at the start of the derived constructor, thus preserving standard OO semantics by creating the illusion that the base constructor is executed first.)
The same issue arises when calling virtual methods from C# destructors. A virtual method call in a base destructor will be routed to the derived implementation.
Should I make my destructor virtual?
A C# destructor is really just an override of the System.Object Finalize method, and so is virtual by definition.

Can I use exceptions in C#?
Yes, in fact exceptions are the recommended error-handling mechanism in C# (and in .NET in general). Most of the .NET framework classes use exceptions to signal errors.
What types of object can I throw as exceptions?
Only instances of the System.Exception classes, or classes derived from System.Exception. This is in sharp contrast with C++ where instances of almost any type can be thrown.
Can I define my own exceptions?
Yes, just derive your exception class from System.Exception.
Does the System.Exception class have any cool features?
Yes - the feature which stands out is the StackTrace property. This provides a call stack which records where the exception was thrown from.
When should I throw an exception?
This is the subject of some debate, and is partly a matter of taste. However, it is accepted by many that exceptions should be thrown only when an 'unexpected' error occurs. How do you decide if an error is expected or unexpected? This is a judgement call, but a straightforward example of an expected error is failing to read from a file because the seek pointer is at the end of the file, whereas an example of an unexpected error is failing to allocate memory from the heap.
Does C# have a 'throws' clause?
No, unlike Java, C# does not require (or even allow) the developer to specify the exceptions that a method can throw.

How can I check the type of an object at runtime?
You can use the is keyword.

Can I get the name of a type at runtime?
Yes, use the GetType method of the object class (which all types inherit from).

How do I do a case-insensitive string comparison?
Use the String.Compare function. Its third parameter is a boolean which specifies whether case should be ignored or not.
Does C# support a variable number of arguments?
Yes, using the params keyword. The arguments are specified as a list of arguments of a specific type, e.g. int. For ultimate flexibility, the type can be object. The standard example of a method which uses this approach is System.Console.WriteLine().
Does C# do array bounds checking?
Yes. An IndexOutOfRange exception is used to signal an error.
How can I make sure my C# classes will interoperate with other .NET languages?
Make sure your C# code conforms to the Common Language Subset (CLS). To help with this, add the [assembly:CLSCompliant(true)] global attribute to your C# source files. The compiler will emit an error if you use a C# feature which is not CLS-compliant.

What is the difference between == and object.Equals?
For value types, == and Equals() usually compare two objects by value. For example:

int x = 10;
int y = 10;
Console.WriteLine( x == y );
Console.WriteLine( x.Equals(y) );
will display:
True
True
However things are more complex for reference types. Generally speaking, for reference types == is expected to perform an identity comparison, i.e. it will only return true if both references point to the same object. By contrast, Equals() is expected to perform a value comparison, i.e. it will return true if the references point to objects that are equivalent.

What are the new features in C# 2.0?
Support for all of the new framework features such as generics, anonymous methods, partial classes, iterators and static classes.
Delegate inference is a new feature of the C# compiler which makes delegate usage a little simpler. It allows you to write this:
Thread t = new Thread(ThreadFunc);
instead of this:
Thread t = new Thread( new ThreadStart(ThreadFunc) );
Another minor but welcome addition is the explicit global namespace, which fixes a hole in namespace usage in C# 1.x. You can prefix a type name with global:: to indicate that the type belongs to the global namespace, thus avoiding problems where the compiler infers the namespace and gets it wrong.
Finally C# 2.0 includes some syntactic sugar for the new System.Nullable type. You can use T? as a synonym for System.Nullable, where T is a value type. As suggested by the name, this allows values of the type to be 'null', or 'undefined'.
Are C# generics the same as C++ templates?
No, not really. There are some similarities, but there are also fundamental differences.


Shahid Riaz Bhatti
MCP, MCAD