Until it came back.  I went back to the ENT every six months for a checkup, to make sure the tumor didn’t come back.  Well, this Spring, he was concerned that it had come back, and so he sent me to see a colleague.  The new ENT confirmed that the tumor had, in fact, come back, and would need to be removed again.  So, on July 18th, I had a second surgery to remove this tumor.

It is apparently very rare for this kind of tumor to come back; something like 1 in 20 do.  The theory is that since the first doctor didn’t remove the tumor the way you’d normally remove a tumor (since he thought it was a cyst), some of the cells spilled and replanted.  The second doctor, even though he was happy with how the tumor came out, was concerned about the same thing, since apparently you never really know what happened at a microscopic level, and maybe a couple of cells spilled out that he couldn’t see.  In addition, the tumor grew in such a way that it wrapped around an important facial nerve.  The second doctor was quite worried that this nerve might have been compromised during the surgery, and actually prepared me for that possibility.  Thankfully, he’s talented enough — or I’m young and healthy enough — that there were no such side effects.

Still, the possibility existed that this tumor might regrow, and the doctor was very concerned about having to go in a third time.  He essentially guaranteed that the facial nerve would be damaged if he had to operate again.  So, he strongly recommended radiation, and sent me to see his colleague.

To make a long story short, after talking with both ENTs, the radiation oncologist, and my dentist, there was no way to choose not to have the radiation.  The oncologist told me that the chances of the tumor coming back without radiation were 90%, but it’s more like 50% if I have the radiation.

So, on October 17th, I had my first radiation treatment.  I felt virtually nothing for the first two weeks, except that around the end of the second week, Jack brought a cold home from day care.  But I wasn’t better by Sunday night, so Carrie talked me into staying home that Monday to get better.  The thing about radiation treatments, though, is that the body has a lot of work to do to recover from them, and what seemed like “just a cold” wound up keeping me out of school for a week because I was too sick and too weak to work.  The cold actually got worse toward the end of the week, which is something I had never experienced before.

Monday of the fourth week, I went back to work, but by now the effects of the radiation had really started to take their toll.  I was unable to make it through an entire hour and fifteen minutes of class.  Thankfully that Tuesday was a day off, so I only had to make it through two more days, but that was enough, and I had to tell my chair that I needed some time off to recuperate.

It sounds like a dream to sit around at home for a few weeks while classes are going on, but I didn’t really get any time to enjoy it.  Mostly, I slept or got nauseous.  It became more difficult for me to eat or even to drink water, because I was sick so often.  What I didn’t realize is that I had become dehydrated, and that Friday (of week 4) I wound up in the emergency room to get rehydrated.

I’ve been doing a little better lately, especially since I now appreciate the need to eat and drink.  But today was my best day.  Radiation lasts for 30 sessions, which works out to six weeks.  The last session would have been this past Friday, except that the department was closed for Thanksgiving.  So, #30 should have been yesterday, except that the machine was down.  But, finally, this morning, I became a former radiation patient after treatment #30.

Among the paperwork the hospital sent me before starting treatment was this document, entitled “The Striking of the Gong”:

The completion of your radiation therapy treatments marks a milestone in your survivorship journey.  The staff of the Department of Radiation Medicine believes that this accomplishment should be acknowledged: One way is through the ceremonial playing of a gong.  On your last day of radiation treatment, you are welcome to strike the gong…  Traditionally, the touching of a gong is thought to bring strength and good fortune.

I would hear the gong being struck a couple times a week during my treatment visits, and it became something to look forward to.  Well, finally, today was gong day:

I still feel like crap, and it’ll be a while before I’m fully recovered.  One of the worst side effects, besides all the sleeping and nausea, is the change to my taste buds.  Many of my favorite foods taste wrong or bad because of the radiation.  I haven’t been able to eat any bread products or tomato products.  Ice cream tastes weird, as does anything with chocolate in it.  I recently tried pineapple, and it was almost completely devoid of taste.  They say that it will take about three weeks for taste to finally come back.  Until then, I have become a huge fan of the Food Network, planning what sort of wonderful things I’m going to eat when I’m able to.

Soon enough, I’ll be back to work, back to drinking coffee and beer, back to being awake 18 hours a day instead of sleeping 15 hours a day, back to playing on the floor with Jack — back to normal.  It’ll take some time, but I know that the recovery process started today.  I invite you to ask me anything you need to ask me about radiation, especially if you or a loved one needs to go through it.  It ends, and it gets better, and that’s the most important thing to understand.

Edited to add:  The treatments would not have gone nearly as well as they did if not for all the dedicated staff at LIJ who worked so hard to make me comfortable.  Special thanks go out to all the radiation techs (and of course I identified the musicians and the volunteer firefighter right away), to Nurse Diana, and to PA Jonathan.  No one in his right mind would classify radiation therapy as “easy”, but these professionals made it as easy a process as anyone could wish for.  Thanks.

One more edit:  While writing this post, I was so careful to get all the technical stuff right, like timelines and whatnot, that I forgot what was really important.  My wife Carrie and my mom both made huge sacrifices during these six weeks, to make sure I was eating and drinking, to make sure Jack got to day care and back, and to make sure I was comfortable.  They worked harder, and took better care of me, than I ever expected to need.  They were so awesome during this that their awesomeness became commonplace and expected, and I started to take it for granted.  Well, let me say here, publicly, that I truly would not have gotten through all this without their love and hard work.  I hope never to have to repay this debt.

We brought Jack to the Long Island Game Farm this week, to celebrate finally being done with school. Jack was nice enough to pose for the best photo I’ve ever taken of him… and I’ve taken some nice ones.

The weirdest Mets game I’ve ever attended took place on August 23rd, 2009.  What was so weird about it?  Well,

• DJ AM (who I admit I’d never heard of) threw out the first pitch, in what would be his last public appearance before his untimely death five days later.
• Pedro Martinez, who was a beloved Met for four years, was the visiting Phillies’ starting pitcher after the Mets essentially ignored him during the off-season.
• Pedro would have his first at-bat before he threw his first pitch.
• Oliver Perez gave up six runs in the first inning.  (If you know anything about Perez, that part isn’t so weird.)  Not only did he not get out of the first inning, he was pulled during Pedro Martinez’ at-bat with a 3-0 count.  Nelson Figueroa would come in and finish the at-bat, striking Pedro out to end the inning.
• Mets center fielder Angel Pagan hit an inside-the-park home run and a traditional home run.
• Mets right fielder Jeff Francoeur caught a ball hit by Phillies second baseman Eric Bruntlett in shallow right in the top of the 9th that the first base umpire initially ruled a trap.  The umps got together to discuss it, and wound up overturning the first base umpire’s initial ruling, making the third out in the inning.
• Bruntlett would get his revenge on Francoeur in the bottom of the ninth when, down by two runs, with two runners on and no outs, Francoeur lined out to Bruntlett, who then stepped on second and tagged out Daniel Murphy, who was on the back end of an attempted double steal.  Bruntlett therefore ended the game with an unassisted triple play — only the 15th in the history of Major League Baseball, the second ever to end a game, and the first ever to end a National League game.  Had Bruntlett been standing literally anywhere else in the stadium, that ball would have gone through for a hit, and the Mets would have scored one run and likely two to tie the game.  See for yourself:  Eric Bruntlett\’s Unassisted Triple Play (YouTube)

Pedro Martinez, in his first game against the Mets since May 28, 1997, won for the first time as a Mets opponent since April 26, 1997.  Perez took the loss in, if I remember correctly, what would turn out to be his last appearance for the Mets that season.  That was a long drive home.

Jack’s day care center held an ice cream social yesterday, and Elmo showed up. Pretty cool. (Also, I just discovered that Flickr and WordPress have automatic API talk-to-each-other-ness which I’m trying out for the first time presently. Which was a good excuse to post this photo.)

Jack + birthday cake = photo op

:)

This post, then, is an attempt to rephrase Blake’s most important points, in a way that hopefully any programmer will be able to understand, and in a way that should be useful to all application developers. I will be leaving out the really super-technical, database-specific stuff, and help programmers set a couple of important, attainable goals.

What is Penetration Testing?

Why was Blake’s talk so important and informative? What was he trying to get us to do? In short, any application programmer needs to be sure that the application only exposes the right data to the right user. I shouldn’t be able to update your Facebook status from my computer any more than I should be able to see your account balance by using the ATM. The way we determine whether an unauthorized user can see data he or she shouldn’t see is through penetration testing — the act of trying to break into your own application, or trying to get at sensitive data through means other than what the application developers intended.

Think Like The Attacker

As I thought about Blake’s talk on the drive home, I realized that none of us will write a secure application by accident. Application security happens by design. Programmers who create secure applications, then, must always be mindful that careless coding — especially in the absence of good testing — can and usually does result in unprivileged access. I realized that even I needed to adopt a new philosophy while designing, coding, testing, and maintaining. I realized that I need to think like the bad guy, and anticipate what attacks might occur, so that I can defend against them. If you can think like your application’s attackers, then you’re probably already one step ahead of the game.

Don’t Give Away Free Data

Blake brought a large arsenal of technological weaponry to the LIPHP meeting. He had all manner of JavaScript pausers, and POST data manglers, and all kinds of other stuff, meant to confuse web servers into doing what Blake wants, instead of what the web application programmers wanted. But the most important tool Blake brought was his common sense. Attackers will try to glean any information they can from your application, so don’t give them any.

Blake provided a few examples of how a careless application developer can give away data without even realizing he or she did so. Imagine attempting to log into your Twitter account. You type your username and password into the fields provided, and you see a message that says something like “Wrong password. Please try again.” You might appreciate how helpful this message is, since now you know what to fix, and you can successfully log in.

However, if this were the case with Twitter (it’s not, thankfully), then the application developer seriously needs to learn how to think like the attacker instead of like the client’s friend. Sure, it’s nice to give the user that hint. But what if the user typing your username and password into the site wasn’t you? That attacker has now verified that your username exists in the system. (“OK, but everyone knows my Twitter username already.” Fine. Let’s say this is your bank’s web site.) From there, the attacker only needs an educated guess (“He was married on September 9th…”) or a little social engineering (“Hi, this is Chris from Citibank calling. I noticed some unusual activity on your Mastercard over the past couple of weeks, that I’d like to verify. Could you give me your username and password, so we can fix this up?”) — or maybe a keylogger, or a shoulder surfer — to gain unauthorized access to your data.

The Solution

Here’s why I entitiled this post “Low-Tech Application Security.” The fix to this problem is very easy, and it doesn’t require any more purely technical programming knowledge than what got you in this mess in the first place. Just change the error message. Instead of saying “Wrong password”, use the same error message for right username/wrong password as you do for wrong username; something like “Invalid Username/Password Combination” will do. This message has the intended effect on a real user; he’s going to type his username more carefully the second time, and if the password is really wrong, he’s going to take a minute and figure out what’s happening. (“Oh, I used the other password on this account.”) Plus, this message has the intended effect on the attacker, who has now learned absolutely nothing about your system.

What Next?

I’m hoping this discussion will help a couple of you shore up your applications, and make them more secure.  I also hope to write more in this space about how to design applications — especially web applications — the right way.  But there are certainly a ton of other resources out there you can take advantage of to keep learning about security and application design (and please add more in the comments).  Also, find a local user’s group, and join the e-mail list or show up at a meeting, where you are sure to learn a thing or two about programming.  For instance, I will be presenting my application PHProf at LIPHP‘s March meeting.

• I’ve been raising a baby
• I taught a bunch of extra classes in the fall semester
• I’ve been diligently updating Twitter (and therefore Facebook), so it’s not like I haven’t been on the Internet
• I’m still the captain of my firehouse
• The band still isn’t done recording
• I didn’t have a car from October through New Years’
• I was in despair over the Mets’ awful 2009 season, and the Giants’ season didn’t perk me up any

So, as you can plainly see, there were lots of reasons I’ll describe as “good” for not blogging all this time. But, whatever the reason, I’ve missed it, and my writing skills have suffered as a result. I have a lot less schoolwork to do this semester, we’ll finish our album soon, and I’m going out as captain in April (right after Jack turns 1), so hopefully things will pick up around here.

There are some topics I hope to cover soon:

• Are there really “good numbers” to have in your football pool?
• What are some of the more awesome technological tools that I’m using, that you should be using?
• What’s it like to record an album by yourselves with just a MacBook Pro?

Ok, yeah, that last list is meant as a reminder to myself, but hopefully it’ll keep me in some of your RSS readers. :)

Small Cars Only

Now, nearly four years later, removing the statuses “unmarried” and “childless” have eclipsed that day, but I still love my car more than any non-carbon-based things in my life.  (My Fender basses are made of wood…)  But this lease will be ending soon.  About 2,000 miles too late, as it turns out:

50,000 Miles

The guy came today to perform the end-of-lease inspection.  (So soon?)  Come February, when Carrie goes back to work, it’s going to be my job to drive Jack to day care, and I just can’t see myself getting that baby seat in and out of the MINI every day.  So, at least temporarily, my MINI-driving days are going to come to an end; and, finally, I can sense that day drawing near.  And, still, that new-MINI-owner feeling hasn’t gone away.  It’s an awesome car, and I am still thinking about getting another one when Jack gets bigger.

For now, though, it’s time to choose a new ride.  My criteria are fairly specific:  I need a car that comes in a manual transmission, with a factory-installed iPod dock connector, that I can get Jack in and out of fairly easily, and that doesn’t suck.  I am down to about three choices — the VW GTI, the VW Jetta, and the Subaru Impreza wagon.  I test drove a GTI the other day, and I don’t think I’m going to like the other two even remotely as much.  For a non-MINI, I really like the handling, acceleration, and style.  It’s got a lot more horsepower, though not quite the same suspension.  The radio, etc. is nicely laid out — the newer MINI interior is quite a step back from the styling in my ’06, in my opinion — and looks nice and modern.  Yes, I’m still going to drive the other two, but I feel like I’ve decided already.  The only potential factor to keep me out of it will be the price.  Cross your fingers for me.  :)

OK, really, what am I doing starting a new blog site?  Well, I’ve been using my band’s page as my own personal blog for a long time.  Mostly, this hasn’t been a big deal, as the band hasn’t been doing a lot lately, other than hanging out and drinking beer.  But now that we’ve been gigging somewhat regularly, and getting ready to record our first album, I felt that my personal posts should have their own place.  There have been quite a few things that I have held back from posting, because I knew they didn’t fit with the spirit of the band’s page, and I just don’t want those sort of restrictions on myself.

Plus, now I have my own name in a domain name.  Come on, admit it, that’s pretty cool.  Now you want one too, don’t you?

I figure, given the awesome new URL, and the lack of mention of the band, or my firehouse, or my job, or really anything except for me, I can stretch out, post what I want, and not have to answer to anyone.  That’s the plan.  So, look forward to lots more posts about those lousy Mets who I love so much, and the Giants, and whatever else happens to cross my mind.  You must be so excited.

Don’t forget to find the “Register” link, type away freely in the comments boxen, love up the RSS feed, and share with your friends and enemies.  Thanks!

-c