Daily Tech Digest - August 08, 2021

The Role of Artificial Consciousness in AI Systems

What this means is that AI programs having common sense may not be enough to deal with un-encountered situations because it’s difficult to know the limits of common sense knowledge. It may be that artificial consciousness is the only way to ascribe meaning to the machine. Of course, artificial consciousness will be different to the human variant. Philosophers like Descartes, Daniel Dennett, and the physicist Roger Penrose and many others have given different theories of consciousness about how the brain produces thinking from neural activity. Neuroscience tools like fMRI scanners might lead to a better understanding of how this happens and enable a move to the next level of humanizing AI. But that would involve confronting what the Australian philosopher, David Chalmers, calls the hard problem of consciousness – how can subjectivity emerge from matter? Put another way, how can subjective experiences emerge from neuron activity in the brain? Furthermore, our understanding of human consciousness can only be understood through our own inner experience – the first-person perspective. 

Creating a Quality Strategy

Some teams might prefer to do ad-hoc exploratory testing with minimal documentation. Other teams might have elaborate test case management systems that document all the tests for the product. And there are many other options in between. Whatever you choose should be right for your team and right for your product. ... On some teams, the developers write the unit tests, and the testers write the API and UI tests. On other teams, the developers write the unit and API tests, and the testers create the UI tests. Even better is to have both the developers and the testers share the responsibility for creating and maintaining the API and UI tests. In this way, the developers can contribute their code management expertise, while the testers contribute their expertise in knowing what should be tested. ... Some larger companies may have dedicated security and performance engineers who take care of this testing. Small startups might have only one development team that needs to be in charge of everything.

It's time to improve Linux's security

Believe it or not, many vendors, especially in the Internet of Things (IoT), choose not to fix anything. Sure, they could do it. Several years ago, Linus Torvalds, Linux's creator, pointed out that "in theory, open-source [IoT devices] can be patched. In practice, vendors get in the way." Cook remarked, with malware here, botnets there, and state attackers everywhere, vendors certainly should protect their devices, but, all too often, they don't. "Unfortunately, this is the very common stance of vendors who see their devices as just a physical product instead of a hybrid product/service that must be regularly updated." Linux distributors, however, aren't as neglectful. They tend to "'cherry-pick only the 'important' fixes. But what constitutes 'important' or even relevant? Just determining whether to implement a fix takes developer time." It hasn't helped any that Linus Torvalds has sometimes made light of security issues. For example, in 2017, Torvalds dismissed some security developers' [as] "f-cking morons." He didn't mean to put all security developers in the same basket, but his colorful language set the tone for too many Linux developers.

Creating a Secure REST API in Node.js

As an open-source, Node.js is sponsored by Joyent, a cloud computing and Node.js best development provider. The firm financed several other technologies, like the Ruby on Rails framework, and implemented hosting duties to Twitter and LinkedIn. LinkedIn also became one of the first companies to use Node.js to create a new project for its mobile application backend. The technology was next selected by many technology administrators, like Uber, eBay, and Netflix. Though, it wasn’t until later that wide appropriation of server-side JavaScript with Node.js server began. The investment in this technology crested in 2017, and it is still trending on the top. Node.js IDEs, the most popular code editor, has assistance and plugins for JavaScript and Node.js, so it simply means how you customize IDE according to the coding requirements. But, many Node.js developers praise specific tools from VS Code, Brackets, and WebStorm. Exercising middleware over simple Node.js best development is a general method that makes developers’ lives more comfortable. 

In a world first, South Africa grants patent to an artificial intelligence system

At first glance, a recently granted South African patent relating to a “food container based on fractal geometry” seems fairly mundane. The innovation in question involves interlocking food containers that are easy for robots to grasp and stack. On closer inspection, the patent is anything but mundane. That’s because the inventor is not a human being – it is an artificial intelligence (AI) system called DABUS. ... The granting of the DABUS patent in South Africa has received widespread backlash from intellectual property experts. The critics argued that it was the incorrect decision in law, as AI lacks the necessary legal standing to qualify as an inventor. Many have argued that the grant was simply an oversight on the part of the commission, which has been known in the past to be less than reliable. Many also saw this as an indictment of South Africa’s patent procedures, which currently only consist of a formal examination step. This requires a check box sort of evaluation: ensuring that all the relevant forms have been submitted and are duly completed.

Ford's new BlueCruise hands-off driving feature is a solid first effort

It keeps the vehicle in the center of the lane, but with a little too much urgency. It's not a safety issue, but to a driver unfamiliar with what's going on, the steering movements are a little too frequent and a little too jerky. I can tell that the computer is working really hard to keep the car centered at all times — I compared it a 16-year old driver who was still learning the ropes and wasn't quite confident in their abilities, making frequent, jerky input adjustments as they drive along rather than smoother, more practiced inputs that an experienced driver would make. It isn't necessary to always be centered exactly in the lane, after all — an experienced driver knows that drifting a few inches to the left or right is normal. I said to the Ford engineers that most people probably wouldn't notice the tiny steering inputs, but they might lose confidence in the system because of it, even if they couldn't quite put their finger on why. Future releases will improve on it, I'm sure. BlueCruise also isn't (yet) aware of anything going on to the side or behind the vehicle.

Critical Cobalt Strike bug leaves botnet servers vulnerable to takedown

Cobalt Strike is a legitimate security tool used by penetration testers to emulate malicious activity in a network. Over the past few years, malicious hackers—working on behalf of a nation-state or in search of profit—have increasingly embraced the software. For both defender and attacker, Cobalt Strike provides a soup-to-nuts collection of software packages that allow infected computers and attacker servers to interact in highly customizable ways. The main components of the security tool are the Cobalt Strike client—also known as a Beacon—and the Cobalt Strike team server, which sends commands to infected computers and receives the data they exfiltrate. An attacker starts by spinning up a machine running Team Server that has been configured to use specific “malleability” customizations, such as how often the client is to report to the server or specific data to periodically send. Then the attacker installs the client on a targeted machine after exploiting a vulnerability, tricking the user or gaining access by other means.

Test Debt Fundamentals: What, Why & Warning Signs

Test Debt is hard to measure factually, but we can rely on our human capacity to detect, feel and react to warning signs. For test automation, we can sense organizational behaviors and specific test automation attributes. Let’s get back to the Why of our automated tests. One objective of our test automation effort is to accelerate the delivery of software changes with confidence. The test automation value disappears when the team starts to bypass the test automation campaign, search for alternative routes, ask for exceptions. Various reasons are possible as a long execution time, instability, lack of understanding, or other maintainability criteria. The execution time is directly tied to essential indicators of software delivery: lead-time for changes, cycle-time, and MTTA. These metrics are all part of the Accelerate report, correlating the organization’s performance with these measures. We need to constraint our test execution time to limit its impact on these acceleration metrics. For test automation, it means less but more valuable tests executed faster. 

Systems of systems: The next big step for edge AI

SoS will allow autonomous or semi-autonomous systems to control and respond to data flows. In the defense sector, for example, it will connect the data dots gathered from weather analysis, radars, and video surveillance to provide either the quickest path for a missile, or the best way to intercept it. Separately, a train technology provider that delivers transportation as a service need to unify the subsystems in a train and in a train station, expediting failure flagging and repairs to reduce costly service delays. In each case, a system of systems will inform or replace human decision-making, leading to faster, smarter, and more precise insights. ... It’s no stretch to say that edge AI-powered systems of systems will change society as we know it. Like bees working together to build and maintain a hive, algorithms in a SoS will form a swarm. Cars that can communicate with each other will be collectively smarter and safer than any individual car. Inside one vehicle, a SoS will coordinate navigation and telematics while independently gathering live weather and traffic data from roads.

Mainframes: The Missing Link To AI (Artificial Intelligence)?

The power of AI for mainframes does not have to be about creating projects. For example, there are emerging AIOps tools that help automate the systems. Some of the benefits include improved performance and availability, increased support speed for application releases and the DevOps process, and the proactive identification of issues. Such benefits can be essential since it is increasingly more difficult to attract qualified IT professionals. According to a recent survey from Forrester and BMC, about 81% of the respondents indicated that they rely partially on manual processes when dealing with slowdowns and 75% said they use manual labor for diagnosing multisystem incidents. In other words, there is much room for improvement—and AI can be a major driver for this. “Mainframe decision makers are becoming more aware than ever that the traditional way of handling mainframe operations will soon fall by the wayside,” said John McKenny, who is the Senior Vice President and General Manager of Intelligent Z Optimization and Transformation at BMC. 

---

Quote for the day:

"Ninety percent of leadership is the ability to communicate something people want." -- Dianne Feinstein

---

Daily Tech Digest - April 29, 2020

Overnight digital transformation: Welcome to the year 2025, 60 months early

Welcome to the year 2025, suddenly pushed 60 months forward. It's time to make bold moves forward with technology. Those digital dreams that have been simmering on the back burner need to be brought forward -- and IT professionals need to step up and lead the way. Blackburn and his co-authors even have data that shows boldness with technology moves keeps businesses ahead of the game. Almost half of incumbent companies adopting new digital ways, 47%, saw revenue growth exceeding 10% annually over the past three years, versus 30% of their slower-to-adopt counterparts. To accelerate digital adoption and meet the needs of a suddenly changed world, the McKinsey analysts make a series of recommendations -- which again, mean new roles and leadership opportunities for IT professionals ... This is the time to simplify and focus to avoid being overwhelmed, the McKinsey team adds. "This is perhaps the first global crisis in which companies are in the position to collect and evaluate real-time data about their customers and what they are doing, or trying to do, during this time of forced virtualization.

Sophisticated Android Spyware Attack Spreads via Google Play

Interestingly, researchers observed that the malware’s operators don’t seem interested in widescale infection. In fact, according to the firm’s telemetry, since 2016, only around 300 infection attempts were observed on Android devices — mainly in India, Vietnam, Bangladesh and Indonesia. Other infections, however, were found in Algeria, Iran and South Africa. And, several infections were found in Nepal, Myanmar and Malaysia. “Usually if malware creators manage to upload a malicious app in the legitimate app store, they invest considerable resources into promoting the application to increase the number of installations and thus increase the number of victims,” explained the researchers in the writeup. “This wasn’t the case with these newly discovered malicious apps. It looked like the operators behind them were not interested in mass spread. For the researchers, this was a hint of targeted APT activity.” The types of applications that the malware mimics include Flash plugins, cleaners and updaters.

The Simplicity Principle and why six is the perfect number for better management

Complexity is obvious when you look for it — for example, in Boeing’s 737 Max 8 design, the 500 percent increase in regulation in 25 years within the U.K. pensions industry, or the space shuttle Challenger disaster, which was preceded by warnings that were ignored because they were presented on a PowerPoint slide that has since become notorious for being so dense. Simplicity, however, is often there, hiding in plain sight. It’s not just companies such as Zentatix, dentsu X, and Tata Sons that exemplify it. Apple remains an almost perfect example of a company committed to simple and functional design, despite the back end of its actual product being fiendishly complex. As Philip Davies, a president of Siegle + Gale, told me: “Simplicity is the intersection between clarity and surprise.” This recognizes that simplicity sits neatly on a spectrum ranging from chaos and complication, all the way through to something too simplistic, and is the balancing corrective. Yes, you can have multiple product ranges, with many different iterations and requirements for design, software, manufacturing, sales, service, and so on

5 Ways Your Business Can Benefit From DataOps

DataOps is already enabling businesses to transform their data management and data analytics processes. For example, like DevOps, DataOps lets teams easily spin up isolated, safe and disposable testing environments that allow them to experiment and innovate (Principle 12 of the Manifesto). However, while developers typically focus on applications with small test databases, data analysts and scientists may need to spin up a sandbox environment that includes applications along with terabytes or even hundreds of terabytes of data. By easily implementing intelligent DataOps strategies such as automation, cloning, predictive analytics and more, spinning up massive disposable data environments becomes possible. DataOps principles are also enabling businesses to act on their massive production datasets in ways that were unimaginable just a few years ago. For example, DreamWorks can now easily share the datasets of its films in development with teams of creative artists around the world, enabling rapid collaboration and dramatically shortening production times.

Cybersecurity professionals are being repurposed during COVID-19 pandemic

"Security at this point is a best effort scenario," one respondent commented, according to (ISC)2. "Speed has become the primary decision-making factor. This has led to more than a few conversations about how doing it insecurely will result in a worse situation than not doing it at all." One respondent summed up the factors that have contributed to an opportune situation for cybercriminals–most notably, the fact that 100% of staff are working from home before most organizations were really ready, (ISC)2 said. "COVID-19 hit us with all the necessary ingredients to fuel cybercrime … chaos caused by technical issues plaguing workers not used to [working from home], panic, and desire to 'know more' and temptation to visit unverified websites in search of up-to-the-minute information," the respondent said, according to (ISC)2. Also, remote workforce technology supported by vendors is driven by "new feature time to market and not security," the respondent continued, (ISC)2 said. Other issues the respondent cited were employees taking over responsibilities for COVID-19 affected coworkers who are unfamiliar with the process

A nice taxonomy - Deep Transfer Learning

Deep learning has a very strong dependence on massive training data compared to traditional machine learning methods, because these neurons, layers and every thing in it should get a correct value as its weight after epochs of training. Although everything will be different when it comes to real-world scenarios; it’s far far away from what we learnt. There are cases where training data is expensive or difficult to collect. Therefore, there is a need to create high-performance learners trained with more easily obtained data from different domains. This methodology is referred to as transfer learning. In addition The biggest benefit of transfer learning shows when the target data set is relatively small. In many of these cases, the model may be prone to overfitting, and data augmentation may not always solve the overall problem.

The Value and Purpose of a Test Coach

The test coach role is a fundamental part of Domain Oriented Testing (DOT). It’s a way of instilling into the team a sense of product quality, pride in their code combined with a particular way of working that results in a system that’s more in tune with the business domain and requirements. ... Overall, the test coach is a demanding, highly skilled role. You must have a good grasp of all the disciplines you’re “nudging” the stakeholders towards. You must have great people skills, or at least a knack of presenting things so that people realise you’re on their side, working with them. ... In this agile climate, for many organisations QA has become a dirty word. However unfairly deserved, for many people QA is now synonymous with waterfall, big bang integration, process overload with long forms to fill out, and a department separated from the developers, promoting a “sling it over the fence to the testers” approach to software delivery. But let’s be honest, a test coach’s purpose is very similar to that of QA: to introduce and maintain a process that gets the team focused on software quality.

How the Pandemic Is Pushing Blockchain Forward

Because blockchain technologies are uniquely suited to verifying, securing and sharing data, they’re ideal for managing multi-party, inter-organizational, and cross-border transactions. Over the past five years, enterprises across the globe have vetted the technology with thousands of proofs of concept, but live deployments have been slow to come because partners using blockchain as a shared ledger have to agree on IP rights, governance, and business models. Government regulations have also impeded its widespread use. It has taken the Covid-19 pandemic to push through the obstacles to blockchain adoption. The virus has revealed the weaknesses in our supply chains, our inability to deploy resources where they are most needed to address the pandemic, and difficulties in capturing and sharing the data needed to make rapid decisions in managing it. Blockchain solutions that have been under development for years have been repurposed and unleashed to address these challenges.

Microsoft: This is how to protect your machine-learning applications

It's a long list of attack types, but understanding what's possible allows us to think about the threats our applications face. More importantly they provide an opportunity to think about defences and how we protect machine-learning systems: building better, more secure training sets, locking down ML platforms, and controlling access to inputs and outputs, working with trusted applications and services. Attacks are not the only risk: we must be aware of unintended failures -- problems that come from the algorithms we use or from how we've designed and tested our ML systems. We need to understand how reinforcement learning systems behave, how systems respond in different environments, if there are natural adversarial effects, or how changing inputs can change results. If we're to defend machine-learning applications, we need to ensure that they have been tested as fully as possible, in as many conditions as possible. The apocryphal stories of early machine-learning systems that identified trees instead of tanks, because all the training images were of tanks under trees, are a sign that these aren't new problems, and that we need to be careful about how we train, test, and deploy machine learning.

Developing Reactive REST APIs With Quarkus

This article describes how to implement reactive REST APIs in Java with Quarkus rather than using synchronous endpoints. In order to do this, the Java classes CompletableFuture and CompletionStage are needed. The article explains how to use these classes and how to chain asynchronous method invocations including exception handling and timeouts. The first question you probably ask is, why should you change old habits and not use imperative code? After all implementing asynchronous code is rather unusual for some Java developers and requires a new thinking. I think the short answer is efficiency. I’ve run two load tests where I compared reactive code with imperative code. In both cases the response times of the reactive code was only half of the duration of the imperative code. While these tests are not representative for all types of scenarios, I think they demonstrate nicely the benefits of reactive programming.

---

Quote for the day:

"If liberty means anything at all, it means the right to tell people what they do not want to hear." -- George Orwell

---

Daily Tech Digest - February 03, 2019

Serverless computing’s dark side: less portability for your apps

How that serverless development platforms calls into your serverless code can vary, and there is not uniformity between public clouds. Most developers who develop applications on serverless cloud-based systems couple their code tightly to a public cloud provider’s native APIs. That can make it hard, or unviable, to move the code to another platforms. The long and short of this that if you build an application on a cloud-native serverless system, it’s both difficult to move to another cloud provider, or back to on-premises. I don’t mean\ to pick on serverless systems; they are very handy. However, more and more I’m seeing enterprises that demand portability when picking cloud providers and application development and deployment platforms often opt for what’s fastest, cheapest, and easiest. Portability be dammed. Of course, containers are also growing by leaps and bounds, and one of the advantages of containers is portability. However, they take extra work, and they need to be built with a container architecture in mind to be effective.

Grady Booch on the Future of AI

To put things in perspective, there have been many springs and winters in the development of artificial intelligence. The first winter was in the 1950s during the height of the Cold War. There was a great deal of interest in machine translation in order to translate Russian into some other language. According to an often quoted story, they put in statements such as "The spirit is willing, but the flesh is weak". Translated into Russian and back, the result was "The vodka is strong, but the meat is rotten." Language learning was a lot harder than people first thought. The next spring arose with the ideas of Newell and logic theorist Terry Winograd that used the idea of manipulating small world blocks, which led to some progress. Of course that was the time when Marvin Minsky stated that there will be human level intelligence in three years. No one makes those kinds of claims any more. Computational power and expressiveness were the limits to this approach.

Blockchain and biometrics: The patient ID of the future?

This isn't the first time blockchain has paired with biometrics for identification purposes. Starting back in 2017, Microsoft and Accenture joined to create a blockchain solution that used biometric data to act as digital identification for refugees. Pharmaceuticals have also considered utilizing blockchain to improve track-and-trace serialization. IrisGuard's technology has previously been used by the United Nation Agencies to prevent human trafficking, providing refugees with iris-based registration and e-payment solutions through the High Commissioner for Refugees (UNHCR) and the World Food Programme (WFP), the release said. "Patient identification is a growing problem in today's healthcare system," Chrissa McFarlane, CEO and founder of Patientory, Inc., said in the release. "This technology can help providers identify an individual with unparalleled accuracy, through iris-recognition and data matching. And because it's verified on the blockchain, it's scalable without sacrificing data security—which is one of the main problems with our current healthcare-data infrastructure."

State Machine Design in C

A common design technique in the repertoire of most programmers is the venerable finite state machine (FSM). Designers use this programming construct to break complex problems into manageable states and state transitions. There are innumerable ways to implement a state machine. A switch statement provides one of the easiest to implement and most common version of a state machine. Any transition is allowed at any time, which is not particularly desirable. For most designs, only a few transition patterns are valid. Ideally, the software design should enforce these predefined state sequences and prevent the unwanted transitions. Another problem arises when trying to send data to a specific state. Since the entire state machine is located within a single function, sending additional data to any given state proves difficult. And lastly these designs are rarely suitable for use in a multithreaded system. The designer must ensure the state machine is called from a single thread of control.

Privacy: Several States Consider New Laws

"Each of the 50 states now has its own breach notification laws, with nearly one-half adopting data security and/or data disposal requirements to protect consumers' personally identifiable information from unauthorized disclosure," says privacy attorney David Holtzman, vice president of compliance at security consultancy CynergisTek. "While most states are not taking a sectorial approach to the type of PII that must be protected, New York, Ohio and South Carolina have adopted cybersecurity requirements that target industries that include health plans and insurers," he adds. "A theme seen in state legislation to update breach notification laws in recent years is to set shorter notification periods. Some argue that this would give consumers more time to take action to protect themselves against the threat of financial fraud or identity theft by notifying major credit reporting agencies." Privacy attorney Kirk Nahra of the law firm Wiley Rein notes: "The states continue to examine the possibilities for increasing privacy and data security protections, both in currently regulated areas and in situations where federal law is not directly applicable through a specific law or regulation."

The 3 Secret Types of Technical Debt

Unfortunately, the cost of repaying debt is much higher by that point, just because of the compound interest you have to pay back that was consolidated into the debt. In other words, 2 hours invested in repaying technical debt 6 months ago, could be equivalent to 1 day of work today to repay the same amount of debt. The problem with this type of approach is it feels you are going fast to start with because you are delivering features and the technical debt is not hurting you as much at the very beginning. The problem is you are putting yourself on the compound interest curve, instead of staying linear. Linear and compound curves look similar at the start, very different later on. In most cases, you want to avoid ending up in this category. An example of where this type of debt is acceptable is when you need to hit a regulatory deadline, where the cost of not hitting the deadline outweighs the cost of repaying the compound debt accumulated later on.

Decision Trees — An Intuitive Introduction

Regression works similar to classification in decision trees, we choose the values to partition our data set but instead of assigning class to a particular region or a partitioned area, we return the average of all the data points in that region. The average value minimizes the prediction error in a decision tree. An example would make it clearer. Predicting rainfall for a particular season is a regression problem since rainfall is a continuous quantity. Given rainfall stats like in the figure below how can a decision tree predict rainfall value for a specific season? ... But being a supervised learning algorithm how does it learn to do so; in other words how do we build a decision tree? Who tells the tree to pick a particular attribute first and then another attribute and then yet another? How does the decision tree know when to stop branching further? Just like how we train a neural network before using it for making predictions we have to train (build) a decision tree before prediction.

Before AI is a human right, shouldn't we make it work first?

Benioff warned that AI-powered countries and companies will be will be "smarter," "healthier," and "richer," while those less generously endowed with AI will be "weaker and poorer, less educated and sicker." I guess he hasn't seen the AI that currently powers the Western world—you know, like IBM's Watson, which one of its engineers characterized as "like having great shoes but not knowing how to walk." Not that IBM is alone—take a walk through the transcripts of public companies' reporting earnings, and you'll see artificial intelligence mentions on a precipitous rise. Look around the real world, however, and finding true artificial intelligence is an exercise in futility. Even the companies packed with PhDs like Google seem to only be able to muster advertising that feels like weak pattern matching. It's one thing to insist that companies like, say, Google, give free access to its algorithms, but quite another to figure out how to do that in practice.

Overcoming RESTlessness

Broad as it was, the idea of using the Web for network-based sharing of data and services beyond the browser was a popular one. Software developers quickly seized on Fielding's work and put it into practice.3 The rise of REST was itself fuelled by a false dichotomy, with SOAP playing the role of bogeyman. Whereas SOAP attempted to provide a method of tunneling through the protocols of the web, the REST approach embraced them. This notion of REST being "of the web, not just on the web" made it a more intuitive choice for software engineers already building web-based solutions. As the SOAP and WS-* ecosystem became more complicated, the relative simplicity and usability of REST won out. Over time, JSON replaced XML as the de facto data format for web APIs for similar reasons. As the usage of the web computing paradigm expanded to new scenarios -- enterprise application integration, cloud provisioning, data warehouse querying, IoT -- so did the adoption of REST APIs.

Scrum Guide Decomposition, Part 2

In the enterprise, it would be difficult (but not impossible) to have a team with all competencies to do all the work simply because teams are siloed into specific competencies. For example, DBA’s, Middleware, specific back-end systems like SAP, and so forth. The enterprise's unwillingness to break apart these silos may hinder them from fully getting the benefits of Scrum. By having team members that are cross-functional, but not necessarily proficient in all competencies, you can avoid delays when someone, for example, is sick or on leave. Someone can continue the work. The team can also share the workload. No single person is carrying the team because they are the only person who knows that competency. The term “Jack of all trades – master of none” comes to mind. Good luck finding people who know everything. It is the team as a whole who becomes the masters. Not individuals. The Scrum Team has proven itself to be increasingly effective for all the earlier stated users, and any complex work.

---

Quote for the day:

"Dont be afraid to stand for what you believe in, even if that means standing alone." -- Unknown

---

Daily Tech Digest - December - 27, 2018

Doxxing: What It Is How You Can Avoid It

Doxxing means publishing private information about someone online to harass or intimidate them. It has ruined reputations and caused untold distress to hundreds of people. On occasion, doxxing has resulted in injury or even death. Being doxxed can have serious consequences for your safety and privacy. How can you prevent it? Doxxing and cyberbullying often go hand in hand, although doxxing has also been used — controversially — by journalists in pursuit of public interest stories. It’s a relatively new phenomenon grown out of early internet subculture, but it’s gaining both popularity and efficacy, driven partly by social media. Information obtained in doxxing attacks is generally gathered from public or semi-public sources: website logs, WHOIS records, social media profiles,and simple Google searches or directories. In some cases, it’s harvested by more sinister means like hacking or social engineering. 

Without DevOps metrics, forget about DevOps glory

The temptation to measure everything is understandable, but that can be the road to ruin. "Pick something that you don't like," Wallgren said. "Pick something that drives you nuts. Pick something that takes too long. Pick something that fails too often. Just pick something and then figure out a way to measure that and drive a better outcome for that thing. And then move on to the next thing." If you continue to find ways to get better, be it with mean time to recovery, release frequency or any number of other DevOps metrics, you should be able to deliver better software and keep your customers happy. Adopting DevOps metrics does not mean you should count the lines of code produced. While that may be an objective measurement, it's not in any way relevant to outcomes. Concentrate on a few things that help you make better decisions, experts insist, even if those items don't seem like they make an enormous difference to IT overall.

Q&A on the Book Digital Transformation at Scale

For many organisations, agile teams represent a very new way of working. It isn’t really possible to learn that in a classroom, or even be coached towards it. To really establish agile within an organisation, you need to bring in the full team, not just ones and twos (‘the unit of delivery is the team’ was a GDS mantra). That team should be given the conditions that allow them to deliver quickly, work in the open, and become a visible and tangible demonstration of what an agile team is. Some of that is intensely practical - having a decent workspace for them to all sit together, for example. Some of it is more challenging for institutions - moving to governance that is based on show and tells rather than steering boards is a big culture shock for many. Without that team showing what it means for real, agile is just words on a page for people, and not very clear ones at that.

6 Ways to Anger Attackers on Your Network

"Make no mistake: It is happening. Companies are hacking back," he explains, and much of their activity is arguably in violation of the CFAA. That said, he isn't aware of any prosecutions under CFAA against organizations engaged in what is often called "active defense activities." Legal trouble aside, getting into a back-and-forth with attackers is dangerous, Straight cautions. "Even if you're really, really good and know what you're doing, the best in the business … will tell you it's very hard to avoid causing collateral damage," he explains. Chances are good your adversaries will see your "hack back" and launch a more dangerous attack in response. The worst thing you can do is go after the wrong party, the wrong network, or the wrong machines, he continues. Most hackers aren't using their own equipment when they attack. "There are times when I have really wanted to strike back, but you can't and you don't," says Gene Fredriksen, chief information security strategy for PCSU.

DevSecOps is having a positive impact on security, but ... long way to go

According to Veracode’s State of Software Security (SOSS) report, 87.5 percent of Java applications, 92 percent of C++ applications, and 85.7 percent of .NET application contain at least one vulnerability. In addition, over 13 percent of applications contain at least one critical vulnerability. “Our annual SOSS data puts hard evidence on the table to explain why so many security professionals experience anxiety when they think about application security (AppSec),” the report stated. “There is no way to sugar coat it: the sheer volume of flaws and percentage of vulnerable apps remain staggeringly high.” Among the vulnerabilities, SQL injection flaws and cross-site scripting (XSS) remained most common, which is consistent with previous years. SQL injection flaws were found in about one in three applications, while XSS vulnerabilities were present in about half of the applications.

Best tools and methods for designing RESTful APIs

API visualization is one of the fundamental steps in design, because it frames a graphical view of the API for users and enables users to interact with services that use a type of generalized API GUI. Most interactive development environments have visualization tools available, but these tools only offer basic capabilities. Swagger UI is a popular API visualization example that makes the in/out data structure of an API visible; it also exhibits simulated responses to given API caller requests. An API catalog is the central element of any API design strategy. Catalogs hold API definitions and make them available to developers. In some cases, catalogs may also drive API management processes, like access control or load balancing. Most API management suites will include a catalog, and separate API catalog tools are available from companies like Swagger, Oracle and IBM, as well as in open source form, like ReDoc.

Three key trends that will change cybersecurity strategies in 2019

Traditional VM tools identify thousands of vulnerabilities at any given time for a large enterprise, making it near impossible for security teams to know which vulnerabilities to prioritize and address first. As Gartner pointed out, advanced risk-based VM tools take into consideration the impact to the business of each vulnerability if exploited, and produce a clear, prioritized list of actions for the security team to take. As devastating breaches at organizations large and small, public and private, continue to make headlines, companies will gravitate toward risk-based tools to more effectively and efficiently avoid getting breached. Cybercriminals are constantly evolving their attack methods, and in response, security teams must advance their approaches to protecting their data. This means rethinking antiquated processes and tools. 2019 is sure to bring new challenges, but companies will also be taking steps in the right direction to properly secure data and proactively prevent breaches.

As Bitcoin sinks, industry startups are forced to cut back

The latest victim is Bitmain, a provider of bitcoin mining hardware that very recently submitted its IPO prospectus to the Stock Exchange of Hong Kong. The company confirmed to CoinDesk this week that cutbacks would begin imminently: “There has been some adjustment to our staff this year as we continue to build a long-term, sustainable and scalable business,” a spokesperson for Bitmain told CoinDesk . “A part of that is having to really focus on things that are core to that mission and not things that are auxiliary.” Beijing-based Bitmain hasn’t clarified just how many of its employees will be impacted, though rumors — which Bitmain has since denied — on Maimai, a Chinese LinkedIn-like platform, suggest as many as 50 percent of the company’s headcount could be laid off. This news comes after the crypto mining giant confirmed it had shuttered its Israeli development center, Bitmaintech Israel, laying off 23 employees in the process. Bitmain employs at least 2,000 people, up from 250 in 2016, according to PitchBook, as the company’s growth has skyrocketed.

Tracking Analytics with Artificial Intelligence

As we head into 2019, it’s hard to find an industry that has been untouched by the data revolution. Even segments known for the hands-on nature of its work, like construction, are being reimagined with 3D-printed buildings, augmented reality and robots. The three industries below stand somewhere between those most and least affected by digital transformation. ... The worst kind of usage for a car is when a vehicle is driven mostly in traffic while the best is when it’s mostly highway driving, with less stopping and starting. An automaker in that case can offer everyone the same warranty for the first year but then can offer a different warranty package in the next year based on usage. Though no automakers have done so yet, this type of warranty package (similar to how the car insurance industry uses in-car tracking devices) can save automakers a lot of money and reward drivers who are gentler on their cars. For example, one of our auto clients was able to reduce warranty costs by 35% using sensor data.

When quantum computing threats strike, we won't know it

If a country was able to develop and successfully implement quantum computing for the purpose of breaking RSA encryption, they're not going to tell anyone. At some point, academia or the private sector will make advances that might show that it's plausible. But I think we have to be realistic and understand that the largest investors in this area are doing so such that it is highly unlikely that we will actually be aware when they are successful. ... You can assume that none of the people with access to the data were insider threats, but can you be 99.99% sure? Could that actually be the way the data was leaked? Or could it be flaws in the implementation of existing algorithms? It's not just good enough to have strong algorithms, we need strong implementations of the algorithm. If data all of a sudden is leaked, was it because the algorithm was cracked or one of these other government agencies identified a vulnerability that they chose not to disclose?

---

Quote for the day:

"When you practice leadership,The evidence of quality of your leadership, is known from the type of leaders that emerge out of your leadership" -- Sujit Lalwani

---

Daily Tech Digest - November 07, 2018

Accountancy and technology: the changing role of the accountant

The change is probably less in classic, financial accounting but more on the side of financial analysis and managerial accounting. It will be shifting from getting the numbers out of the system in an error-free way into PowerPoint into really doing something meaningful with these numbers, becoming a business partner and advising the counterparts in the business. So that may be understanding drivers, reviewing trends, and coming to conclusions. Also there’s the interpersonal skills. It’s about not just working with the numbers but working with the people on the business side. ... Like many disruptive changes, it’s starting now and it will take its time to fully come to fruition. There is a learning curve that the industry will have to go through. It will take some time, we will find that some problems will lend themselves better to the algorithms we have today, and the algorithms are getting better all the time.

Event Sourcing to the Cloud at HomeAway

Event sourcing allows services to separate their read and write concern and truly allows services to encapsulate data. Having full encapsulation not only prevents a death star architecture, but reduces integration cost for each microservice. One of the biggest advantages of an event sourcing architecture is data democratization. Having data in the center of the architecture allows services to easily discover and subscribe, which is essential for developer velocity and implementing near real time experiences. Event sourcing also opens the door for pattern based programming. If the pattern and libraries are set in place, the goal should be to have an entry level engineer execute the development lifecycle with very little ramp up time, or training. Event sourcing provides a great audit trail as the entirety of history is persisted, which makes auditing and visualizing what happened very easy. I think this is a very critical aspect as services become more asynchronous, as customers need real time updates or feedback about the state of their transaction.

Cybersecurity, AI skills to dominate IT staff hires in 2019

While large, enterprise firms will focus on cybersecurity and AI, small to midsize firms are more likely to seek new employees with DevOps skills, end-user hardware experience, and proficiency in IT infrastructure. Enterprise staff reported that keeping infrastructure up-to-date and implementing new, innovative solutions -- such as AI, and Internet-of-Things (IoT) technologies are some of the biggest challenges in IT faced today by organizations. Smaller companies, however, are faced with the problem of convincing boards of the importance of implementing IT projects and how to adhere to acceptable security practices and standards. The report includes responses from 1,000 IT professionals. When asked about their own prospects, 26 percent of respondents said they planned to find a new role; eight percent plan to leave the field entirely, six percent hope to transition into IT consultancy, and five percent are on the way to retirement.

Despite Fraud Awareness, Password Reuse Persists for Half of U.S. Consumers

As National Fraud Day approaches (Nov. 11), it remains clear that more consumer education is required when it comes to thwarting scammers and identity thieves. Despite almost half of U.S. consumers (49 percent) believing their security habits make them vulnerable to information fraud or identity theft, 51 percent admit to reusing passwords/PINs across multiple accounts such as email, computer log in, phone passcode and bank accounts. ,,, The good news is, more than nine in 10 (91 percent) Baby Boomers closely monitor their financial account activity such as bank statements, credit reports and credit card statements each week, compared to Millennials (85 percent) and Gen Zs (86 percent). Even so, nearly three in 10 of polled consumers (27 percent) said that they don’t know how to find out if they’ve become a victim; and one in five consumers (20 percent) admit that if they became a victim of fraud, they wouldn’t necessarily know how to report it.

5 best practices for third-party data risk management

Recent events leading to overshared data, breached data, operational failures and other incidents have prompted many businesses to re-evaluate how they approach third-party risk management (TPRM) as many of these situations were attributed to a third party. As such, boards of directors and their C-suite teams understand the critical need to be more focused and informed about their third parties, related risk management activities and key decisions, especially for those third parties deemed critical to the organization. EY recently conducted its sixth annual global financial services third-party risk management survey. In a nutshell, it shows that many companies are continuing to make upgrades to the governance and oversight of this function. Yet, it’s clear that formidable challenges remain. To help businesses stay ahead of the curve, outlined below are five leading practices in third-party risk management from which organizations can benefit

In the Age of A.I., Is Seeing Still Believing?

“Prediction is really the hallmark of intelligence,” Efros said, “and we are constantly predicting and hallucinating things that are not actually visible.” In a sense, synthesizing is simply imagining. The apparent paradox of Farid’s license-plate research—that unreal images can help us read real ones—just reflects how thinking works. In this respect, deepfakes were sparks thrown off by the project of building A.I. ... A world saturated with synthesis, I’d begun to think, would evoke contradictory feelings. During my time at Berkeley, the images and videos I saw had come to seem distant and remote, like objects behind glass. Their clarity and perfection looked artificial (as did their gritty realism, when they had it). But I’d also begun to feel, more acutely than usual, the permeability of my own mind. I thought of a famous study in which people saw doctored photographs of themselves. As children, they appeared to be standing in the basket of a hot-air balloon.

Breach Settlement Has Unusual Penalty

This case is noteworthy for several reasons, including the state attorney choosing to take action against both the covered entity and business associate involved with the breach, but also for the enforcement action against the BA's owner. "The attorney general of New Jersey has an array of penalties and relief to enforce the state's Consumer Fraud Act, including fines and suspension or revocation of authority against a company or individual to do business in the state," says privacy attorney David Holtzman, vice president of security compliance at the consultancy CynergisTek. "While it is not uncommon for a negotiated settlement agreement to include a period of exclusion for a company or its officers, this the first time I am aware of the New Jersey attorney general applying this in relation to an investigation regarding unauthorized disclosure of health information. " There have been a handful of similar actions by state and federal regulators in other cases involving data security, he notes.

How to move beyond REST for microservices communication

From a design and architecture perspective, request synchronicity breaks a fundamental part of good microservice design: autonomy. It's presumed that, when synchronous calls block a microservice, it is no longer an open resource. However, when that presumption is untrue, it can lead to confusion and instability. It's possible to make REST semisynchronous through methods such as HTML polling. The server-push features of HTTP/2 also alleviate issues around binary payloads and can multiplex requests on a single port. Microservices developers who want to keep the HTTP model can settle on HTTP/2, but there are still other options. In asynchronous microservices communication, a message is sent to one microservice, and it moves along until it requires a response. That response may come in the form of an event or a callback. Asynchronous microservices make connections through some form of a service or message bus.

Sending WhatsApp Messages from a Win32 C++ Program

This article is the second part, following the first part. In this part, I will explain how to send images and documents to a group. As mentioned in part 1, there are several service providers and we have chosen one of them (WhatsAppMate) and started a free trial. However, their code samples for using their services are in almost any programming language except for C++. So we wrote our own C++ class for that purpose. Sending documents and files is a bit more complicated and will be explained in this article. WhatsApp is a multi-platform free service for chatting via video or voice and for sending messages to individuals or groups, including files, media, etc. WhatsApp is better than the old SMS because it is free and has more features. During our day to day work, we need to set up all sort of alerts to be sent to a group who share a job or work on a feature and when that's done automatically, it makes life easier to be notified.

Decoupling in Cloud Era: Building Cloud Native Microservices with Spring Cloud Azure

Cloud native technologies empower organizations to build and run scalable applications in modern, dynamic environments such as public, private, and hybrid clouds. Containers, service meshes, microservices, immutable infrastructure, and declarative APIs exemplify this approach. ... A cloud native application is specifically designed for a cloud computing environment as opposed to simply being migrated to the cloud. ... Microservice architectural style is an approach to developing a single application as a suite of small services, each running in its own process and communicating with lightweight mechanisms, often an HTTP resource API. These services are built around business capabilities and independently deployable by fully automated deployment machinery. There is a bare minimum of centralized management of these services, which may be written in different programming languages and use different data storage technologies.

---

Quote for the day:

"A leadership disposition guides you to take the path of most resistance and turn it into the path of least resistance." -- Dov Seidman

---

Daily Tech Digest - October 20, 2018

Making Change Is Not a Matter of Willpower

Habits, it seems, get in the way of change despite our best intentions. “Habits are triggered without awareness — they are repeated actions that worked in the past in a given context or in a similar experience,” she notes. Wood’s research shows that concentrating on changing unwanted behaviors, and then creating new ones — not focusing on motivation — is the key to making change. She cites various efforts aimed at changing smoking habits in the U.S. from 1952 to 1999. Smoking decreased not when smokers were made aware of the health risks, but when buying and smoking cigarettes was made more difficult and less rewarding. Thus, higher taxes, smoking bans in public places, and limits on point-of-purchase ads — which add friction to smoking — were a more effective deterrent than warning labels on cigarette packages and public service advertising about smoking’s negative effects. A similar strategy of changing the context is possible in the workplace: Make old actions more difficult; make new, desired actions easier and more rewarding.

7 Ways A Collaboration System Could Wreck Your IT Security

Before an IT group blithely answers the call for a collaboration system – by which we mean groupware applications such as Slack, Microsoft Team, and Webex Team – it's important to consider the security risks these systems may bring. That's because the same traits that make these, and similar, applications so useful for team communications also make them vulnerable to a number of different security issues. From their flexibility for working with third-party applications, to the ease with which team members can sign in and share data, low transactional friction can easily translate to low barriers for hackers to clear. When selecting and deploying collaboration tools, an IT staff should be on the lookout for a number of first-line issues and be prepared to deal with them in system architecture, add-ons, or deployment. The key is to make sure that the benefits of collaboration outweigh the risks that can enter the enterprise alongside the software.

Apache Kafka: Ten Best Practices to Optimize Your Deployment

A running Apache ZooKeeper cluster is a key dependency for running Kafka. But when using ZooKeeper alongside Kafka, there are some important best practices to keep in mind. The number of ZooKeeper nodes should be maxed at five. One node is suitable for a dev environment, and three nodes are enough for most production Kafka clusters. While a large Kafka deployment may call for five ZooKeeper nodes to reduce latency, the load placed on nodes must be taken into consideration. With seven or more nodes synced and handling requests, the load becomes immense and performance might take a noticeable hit. Also note that recent versions of Kafka place a much lower load on Zookeeper than earlier versions, which used Zookeeper to store consumer offsets. Finally, as is true with Kafka’s hardware needs, provide ZooKeeper with the strongest network bandwidth possible. Using the best disks, storing logs separately, isolating the ZooKeeper process, and disabling swaps will also reduce latency.

The Evolution of Mobile Malware

Mobile malware isn’t just an opportunistic tactic for cybercriminals. Kaspersky Lab is also seeing its use as part of targeted, prolonged campaigns that can affect many victims. One of the most notable discoveries this year was Skygofree. It is one of the most advanced mobile implants that Kaspersky Lab has ever seen. It has been active since 2014, and was designed for targeted cyber-surveillance. It is spread through web pages, mimicking leading mobile network operators. This was high-end mobile malware that is very difficult to identify and block, and the developers behind Skygofree have clearly used this to their advantage: creating and evolving an implant that can spy extensively on targets without arousing suspicion. ... In recent times, rooting malware has been the biggest threat to Android users. These Trojans are difficult to detect, boast an array of capabilities, and have been very popular among cybercriminals. Once an attacker has root access, the door is open to do almost anything.

What is the CMO's Technology Strategy for 2019 and Beyond?

Even the CMOs that don’t have the technological background are becoming more tech savvy. Integrate CMO Vaughan said he considers himself and his colleague marketers technology investors, trying to manage a portfolio of tech to provide efficiency, effectiveness and unique capabilities for the company. “We view technology as an enabler of our strategy and an important part of advancing our marketing capabilities,” Vaughan said. “We have tried to be very disciplined about not buying tech for tech sake, which is not always easy to do today with so many options. We start with the strategy, what we are trying to accomplish and build a roadmap, including ROI and an adoption plan and model for each technology we evaluate.” Vaughan said CMOs should know what is available and at their disposal to differentiate and accelerate their strategy. “This does not mean you have to be a technology expert,” he said.

Privacy, Data, and the Consumer: What US Thinks About Sharing Data

To prevent data being lost or stolen is the most obvious “table stake” for consumers. Just as important is the question of whether marketers should have it in the first place. This links clearly to the likes of GDPR in Europe where the bar has been raised for all organizations around justification of the data they hold. But if we have the right data, for the right reasons, if we keep it safe and if we can make it more transparent how we’re using that data to provide a more respectful, personalized, fairer and rewarding service to the consumer, the trust will grow. Equally, we need to trust the consumer, again by providing transparent access to the data we hold, clarity around how we use it and the ability for them to control their data. Overall, the research shows that while consumers are rightly concerned about data privacy, they are also aware that data is an essential part of today’s economy, with 57% on average, globally, agreeing or strongly agreeing. Factor in the neutrals and around two-thirds of consumers are accepting or neutral around data use in today’s data-driven, data-enabled world.

NHS standards framework aims to set the bar for quality and efficiency

Although most of the standards in the framework aren’t necessarily new, they are “intended to be a clear articulation of what matters the most in our standards agenda, and is accompanied by a renewed commitment to their implementation,” said NHS Digital CEO Sarah Wilkinson in the framework’s foreword. Speaking at the UK Health Show on 25 September, Wilkinson said the potential for use of data in the NHS is huge, but the health service needs to get to grips with standards to reap the benefits.  Most of the standards in the framework, which is currently in beta form and out for consultation, are based in international ones, however some are specialised for the NHS. This includes using the NHS number as a primary identifier – a standard which has been in place for a long time, but has had mixed results in uptake. The framework said the standard “is live now and should be adhered to in full immediately”. 

Open Banking has arrived, whether you like it or not

Australia has introduced Open Banking rules that will force the banks to share data with trusted Third-Party Providers (TPPs) by June 2019; Mexico has introduced a Fintech Law; South Korea and Singapore have enforced rules around financial data sharing between banks and third parties; and the USA has seen several banks innovating around open financial structures, although there is no law enforcing them to do this, yet. What intrigues me about the market movements is that some large financial players are taking a lead in this space, such as Citibank and Deutsche Bank’s open API markets, whilst some are resisting the change. I have heard several reports in the UK that the large banks have made data sharing incredibly difficult for the customer, by making the permissioning process very onerous and time-consuming. Equally, the implementation of European rules under PSD2 has seen several Fintech firms cry foul, as each bank creates its own interpretation, and therefore API interface, of the law.

How Data Changed the World

Running a city is always a challenging task. With Big Data, however, comes new opportunities alongside new challenges. Instead of having to rely on surveys and manually tracking how people move throughout an area, cities can instead rely on sensor-derived data, providing far greater resolution and a pool of data to draw from orders of magnitude larger than ever before available. Many of these advances may seem a bit mundane at first; developing improved traffic routes, for example, is unlikely to garner many headlines. However, these changes lead to concrete improvements, saving travelers time and improving overall quality of life. Furthermore, Big Data-derived improvements can inform city planners when deciding which direction their cities will take in the future. Before launching large and expensive projects, city managers will be able to look at information gleaned from Big Data to determine what the long-term effects will be, potential changing cities in fundamental ways.

Give REST a Rest with RSocket

An often-cited reason to use REST is that it’s easy to debug because its “human readable”. Not being easy to read is a tooling issue. JSON text is only human readable because there are tools that allow you to read it – otherwise it’s just bytes on a wire. Furthermore, half the time the data being sent around is either compressed or encrypted — both of which aren’t human readable. Besides, how much of this can a person “debug” by reading? If you have a service that averages a tiny 10 requests per second with a 1 kilobyte JSON that is the equivalent to 860 megabytes of data a day, or 250 copies of War and Peace every day. There is no one who can read that, so you’re just wasting money. Then, there is the case where you need to send binary data around, or you want to use a binary format instead of JSON. To do that, you must Base64 encode the data. This means that you essentially serialize the data twice — again, not an efficient way to use modern hardware.

---

Quote for the day:

"Managers maintain an efficient status quo while leaders attack the status quo to create something new." -- Orrin Woodward

---