1) How do you find time to read all those books?
2) Do you have an archive of the reviews?
3) Where can I find the reviews?
5) Why don't you rate the books you review?
6) Where can I find your reviews of all the CISSP guides?
7) What's all that stuff at the beginning?
8) How much money can you make reviewing books?
9) How can I get started reviewing books?
10) Where can I find books on (topic)?
11) What's the motivation behind the book reviews?
12) How do you choose which books to review?
1) How do you find time to read all those books?
Darned if I know. I've always read a lot, and quickly. No, I don't do speed reading: I find that I can't use those techniques. I read while waiting, I read while traveling: sometimes I just read. I read and review as much as I can spare time for. Those who have followed the series of reviews will notice that sometimes I produce more than others: a lot depends on what else I have to do at the time. Yes, I do read all of the books: every page (although, I admit, sometimes not every word).
2) Do you have an archive of the reviews?
Yes, two, in fact. The "base" URLs are http://victoria.tc.ca/techrev, courtesy of the Victoria, BC, Canada TelecommunityNet (aka VTN), and http://sun.soci.niu.edu/~rslade, courtesy of Northern Illinois University (former home of the Computer Underground Digest and aka NIU). All the various pages and files are in those directories, so you can construct a full URL by simply appending the filename. Also, all files are mirrored at both sites. For example, a reference in one review, like "(cf.BKVR.RVW)," would mean that the filename (converted to lower case) could be appended to the base addresses, and you would find that both http://victoria.tc.ca/techrev/bkvr.rvw and http://sun.soci.niu.edu/~rslade/bkvr.rvw point to actual reviews. (If you use only the base URLs, you will find an index file that points you at some of the major pages.)
For those looking for the reviews, probably the most useful addresses will be http://victoria.tc.ca/techrev/mnbk.htm or http://sun.soci.niu.edu/~rslade/mnbk.htm; the top level of the topical menus of book reviews (security is not the only topic); and http://victoria.tc.ca/techrev/review.htm or http://sun.soci.niu.edu/~rslade/review.htm; the main index to all reviews. Due to increasing numbers of questions, I guess I will be maintaining this FAQ at http://victoria.tc.ca/techrev/revfaq.htm and http://sun.soci.niu.edu/~rslade/revfaq.htm.
3) Where can I find the reviews?
All kinds of places, apparently. There are, of course, the archives above, and the various topically related lists and groups to which I post messages. Others archive various subsets of the reviews to different sites, reprint the reviews in college or user group newsletters, and repost the reviews to other mailing lists. If you want to get on a mailing list for all the reviews, I have created a mailing list at Yahoo Groups. You can subscribe by sending an email message to techbooks-subscribe@yahoogroups.com, or visiting the Web site at http://groups.yahoo.com/list/techbooks/, where you can also find an archive of the more recent reviews.
OK, I'm a cruel reviewer. But fair!
But, yes, I do like some. In the absence of a "Rob's Picks" page (which I may get around to some time) the closest alternative is probably the page of references by the CISSP domains, at http://victoria.tc.ca/techrev/mnbksccd.htm or http://sun.soci.niu.edu/~rslade/mnbksccd.htm.
5) Why don't you rate the books you review?
Generally, the people who ask this question want me to assign a single numeric value, preferably on a scale of 1-5, to every book.
Books are a little bit more complex than that. They are good or bad for different reasons for different groups. A book for a novice is useless to an expert. A book for an expert is useless to a novice. So I try to state who I would recommend the book to, and why. I think it's a bit more reasonable than just giving each book a number.
If I'd wanted to do that, I could have skipped writing the reviews entirely. It'd sure save time. (See question 1 :-)
However, a partial answer, for those who want a quick fix, is to look at the main review index. (See question 2 :-) I try to give a summary of my reaction to the book, in not more than one sentence.
I also note that, whenever I send out a review of a book, regardless of whether I like it or not, it always gets a spike of sales on Amazon. Also, some books, good or bad, are just really badly needed.
This is exactly the reason I try to include detail about what the book contains. I'm doing a bit of a balancing act: some people want more detail on the books, others just want a "buy/don't buy" recommendation.
At one point I tried something along the lines of:
tl - technical level - n/i/a/s - novice, intermediate, advanced,
specialist
rl - range of technical level - 1-4 - even if aimed at specialists,
can novices get something out of it, etc? (C. S. Lewis said that the
only good children's books are those that can be enjoyed by adults--
and vice versa :-)
tc - technical content - 1-4 - sort of measure of signal (actual
content) to noise (verbiage)
ta - technical accuracy - 1-4 - how accurate is the stuff that is
there
tv - tutorial value - 1-4 - if you don't know it, how easy would it be
to learn it using only this
wq - quality of writing - 1-4 - pretty subjective, but ...
The general concensus was that this was *way* too cryptic when it indicated that a book was tl n rl 1 tc 0 ta 2 tv 1 wq 0. Explaining it all and administering it also would have been a pain.
An alternative was to combine tl and rl into audience, with the n(ovice), i(ntermediate), a(dvanced), and s(pecialist) levels and a "-" for limited and "+" for broad range. Then assess both technical content and accuracy (and a little of currency) into one number, and the writing style and tutorial value into a third.
6) Where can I find your reviews of all the CISSP guides?
See http://victoria.tc.ca/techrev/mnbkscci.htm or http://sun.soci.niu.edu/~rslade/mnbkscci.htm.
7) What's all that stuff at the beginning?
I was asked by the moderators of one newsgroup to use the standard UNIX addlib format for publication information. It seemed to be a good set of data, so I continued. The basic information is:
%A Author's name (use a separate %A line for each)
%C City (place of publication)
%D Date of publication
%E Editor (of book or series)
%G Government order number (use this for ISBN)
%I Issuer (publisher's name and imprint)
%O Comments/etc. (use for format/price, ordering info)
(also the links for purchase at online bookstores. Yes, I do
get a commission: see question 8.)
%P Page number(s) (use for page count)
%T Title of article or book
8) How much money can you make reviewing books?
I find it quite bizarre that almost everyone seems to assume that a) I buy all these books, or b) I get paid for doing these reviews. I get the books free from publishers. (See question 9.) I don't get paid for doing the reviews. Occasionally I use these reviews as the basis for review columns or "best of" articles for magazines, and get a few bucks. If people "click-through" the links on the reviews and buy books, I get a commission. (Eventually my account may build up to enough money that they'll actually send me a cheque.) I used to get a bit of a tax break by getting a "gift in kind" tax receipt when all these dead trees go to the library, although libraries don't seem interested any more. But this isn't exactly a business.
Of course, if any large corporation was interested in sponsoring the reviews ... :-)
9) How can I get started reviewing books?
In the immortal words of the advertising campaign, just do it. Grab some books, and review them. Post the reviews. Once you have built a body of work, you can start asking publishers for copies of books, especially if you have proven you are serious by sending them copies of the drafts of your reviews. (Before you post them on the net.)
You don't even have to buy a ton of books to get started. Review the ones you've already got. If you use them, presumably you know why. If you want to review new ones, try the library. (If you live in Vancouver, the Vancouver Public Library has lots of recent technical books :-)
Of course, why would you want to? (See question 8.)
10) Where can I find books on (topic)?
Go to the main review index at VTN or NIU. Use the search function on your browser (Ctrl-F for most Windows stuff, "/" for Lynx, etc). Search for terms you think would be in the title or the topic of the book. (For privacy you might want to search on "privacy," "private," or "confidential.") When you find a likely title, there will be a link to the review itself.
11) What's the motivation behind the book reviews?
Way back in '89, there were lots of questions about which was the best antiviral proggie, and nobody was answering seriously. So I started doing reviews of AV software. However, that may not be a direct ancestor of the book reviews.
A couple years later, DECUS Canada wanted to start a security SIG, and I said I'd do the newsletter. When I asked what people wanted in it, everybody I asked said a bibliography of security lit. So I tried to get one, but found that the ones the vendors were throwing around were just lists of titles. I figured that if I could review software I could review books, so I did some research, and sent off letters to publishers begging for copies, and started to review them.
Eventually I got more books and reviews than I could use in the newsletter, and started sending them out on the net. DECUS went belly up, and I'm still doing book reviews. Among other things :-)
There are some benefits. As well as building the world's best technical library, I do find it a great way to keep up with the field: ongoing professional education. If you're going to review the books you have to read them. If you're going to publish the reviews you have to give the books serious thought. And if you're going to publish the reviews on the net, you've got to know what you are talking about, or you are going to hear about it right away :-)
12) How do you choose which books to review?
To begin with, I can only review what I can get. As noted in question 8, there is no way I could afford to buy all these books, so I'm dependent upon publishers who will actually send me copies. Lots of them will, but it's pretty amazing how many publishers a) do not want to hear from anybody out there, b) figure they are so good they don't need to be reviewed, or c) will send out review copies, but only if you request such on official letterhead, using standard legal wording, with the letter countersigned by your boss, your boss's boss, and the head of the technical books branch of the American Library Association.
Oddly enough, there are also some publishers who take offense if you fail to rave about how their books are the greatest thing since sliced bread, and sure to lead to a cure for cancer. Retroactively. A number of these have told me not to contact them anymore, since the next review copy they send me will be shipped through Hell via dogsled.
However, that does still leave a few more possibilities than I can cope with.
In terms of my own choices, the first priority is infosec, and frequently which ones get reviewed gets decided on the basis of which books are small enough to be stuffed into the briefcase for reading on planes :-) The second priority is other "interesting" technologies (and that's pretty subjective). And then there are those that I read and decide, on a purely subjective basis, that they require a review. (These are mostly fiction.)
HyperText version Book Review Index (may take a while to load)