Measuring a football manager's performance?

Bulgaria lost last night to Montenegro. We lost with the same manager that led Levski Sofia to the 1/4 finals in the UEFA Cup and the groups in the Champions League in 2006. So I decided to run some quick stats on his performance as a manager with the team he managed. So far the stats are quite simple and nothing fancy like the Capello Index. Here they are

name: Stanimir Stoilov

2004/05: Levski Sofia
games: 38
wins: 30 (78.9473684211%)
losses: 3 (7.89473684211%)
ties: 5 (13.1578947368%)
goals for: 97 (2.55263157895 per game)
goals against: 23 (0.605263157895 per game)
goal diff: 74

2005/06: Levski Sofia
games: 43
wins: 28 (65.1162790698%)
losses: 8 (18.6046511628%)
ties: 7 (16.2790697674%)
goals for: 86 (2.0 per game)
goals against: 38 (0.883720930233 per game)
goal diff: 48

2006/07: Levski Sofia, Bulgaria
games: 47
wins: 33 (70.2127659574%)
losses: 8 (17.0212765957%)
ties: 6 (12.7659574468%)
goals for: 118 (2.51063829787 per game)
goals against: 40 (0.851063829787 per game)
goal diff: 78

2007/08: Levski Sofia
games: 34
wins: 21 (61.7647058824%)
losses: 9 (26.4705882353%)
ties: 4 (11.7647058824%)
goals for: 62 (1.82352941176 per game)
goals against: 25 (0.735294117647 per game)
goal diff: 37

2008/09: Litex, Bulgaria
games: 44
wins: 24 (54.5454545455%)
losses: 8 (18.1818181818%)
ties: 12 (27.2727272727%)
goals for: 78 (1.77272727273 per game)
goals against: 37 (0.840909090909 per game)
goal diff: 41

2009/10: Litex, Bulgaria
games: 14
wins: 7 (50.0%)
losses: 6 (42.8571428571%)
ties: 1 (7.14285714286%)
goals for: 25 (1.78571428571 per game)
goals against: 20 (1.42857142857 per game)
goal diff: 5

2010/11: Bulgaria
games: 3
wins: 0 (0.0%)
losses: 3 (100.0%)
ties: 0 (0.0%)
goals for: 0 (0.0 per game)
goals against: 6 (2.0 per game)
goal diff: -6


Aside from the trophies that Stoilov has lifted as a manager, there are few interesting observations to make:
- Since 2006/07 Stoilov's teams have been struggling to score 2 goals per game on average
- Starting in 2007/08 Stoilov's teams have an increasing trend in the goals they concede per game on average
- Starting in 2006/07 Stoilov's teams have a downward trend in the percentage games they've won in a season


So then comes the question: what would be the best metrics to evaluate and measure a manager's performance?

Last days in Amsterdam

These are my last days as a resident of Amsterdam. This morning I submitted my petition to deregister to Gemente Amsterdam. Starting in June, I will reside near the beautiful Swiss Alps.

Tot ziens Amsterdam und grüezi Zurich!

Bugs, security, input validation...

Gabe has 2 very interesting posts on the topic of validating input:

Input Validation & Injection Vulnerabilities

OWASP and Input Validation

A definitely recommended read.

Domain names in Cyrilic

Veni Markovski wrote:

http://президент.рф is up and running! congratulations, Russia!!!

Well done, ICANN! We now have domain names in Cyrilic!

I suspect this will have a lot of security implications, but from an internationalization perspective, it's awesome! :)

Business Models

Roussi sent me the following example of the different business models... have to appreciate the analogies here. :)

To validate or not to validate... that is the question!

Secure development guidance preaches that all input should be validated for length, format, type, and value as appropriate. Typically, guidance stretches along the lines of validate all input that your code takes and validate accordingly. A few years ago there was a similar belief that input validation can stop cross-site scripting. Although this is partially true, full remediation of cross-site scripting is achieved by properly encoding the input data according to the context in which it is later outputted.

So here comes my question, in order to validate input properly, isn't it better to have the validation to be performed by the code that will act on it as opposed to having the validation at the trust boundary of the overall app? Example: Component1 uses Component2 for backend logic. If Component1 only passes the data straight through to Component2, my belief is that Component1 should leave the input validation to Component2. Thoughts?

SDL courses in the public

A while ago I was pointing out some interesting stats about the secure development lifecycle (SDL). Last week, Microsoft made its four core SDL training classes available to the public. The titles are:
- Basics of Secure Design Development Test
- Introduction to the Microsoft Security Development Lifecycle (SDL)
- Introduction to Threat Modeling
- Privacy in Software Development


I would encourage everyone with a bit of spare time to take a look at these courses.