Daily Tech Digest - September 11, 2020

How this open source test framework evolves with .NET

Fixie v3 is a work in progress that we intend to release shortly after .NET 5 arrives. .NET 5 is the resolution to the .NET Framework vs. .NET Core development lines, arriving at One .NET. Instead of fighting it, we're following Microsoft's evolution: Fixie v3 will no longer run on the .NET Framework. Removing .NET Framework support allowed us to remove a lot of old, slow implementation details and dramatically simplified the regression testing scenarios we had to consider for reach release. It also allowed us to reconsider our design. The Big Three requirements changed only slightly: .NET Core does away with the notion of an App.config file closely tied to your executable, instead relying on a more convention-based configuration. All of Fixie's assembly-loading requirements remained. More importantly, the circumstances around the design changed in a fundamental way: we were no longer limited to using types available in both .NET Framework and .NET Core. By promising less with the removal of .NET Framework support, we gained new degrees of freedom to modernize the system.

A 5-step Guide to Building Empathy that can Boost your Development Career

When you reflect on yourself, also analyze your interactions. When you speak, do you ramble on? Do you raise your voice easily, or get easily upset? Do you talk more than listen? How do you come across physically? Do you roll your eyes, or dart them around the room? Do you slouch or bury your hands in your pockets? Think about the language you use during conversations. Do you use habitual phrases that help or hinder your message? Is your language helping others to pay attention or tune you out? Does it encourage conversations and build bridges? Are you making others feel heard and respected, or ignored and underappreciated? To start your self-awareness journey, you can take advantage of a number of tools: DISC, Real Colors, and Myers-Briggs are all great starting points to understanding your own personality. These tools are not there to dictate who you are, but to guide you in understanding who you are. When you take the quiz, you are essentially having a conversation with that quiz. The results are simply telling you how you showed up to that conversation - the outcome is affected by your mood, attitude, energy, recent events, etc.

New CDRThief malware targets VoIP softswitches to steal call detail records

"At the time of writing we do not know how the malware is deployed onto compromised devices," Anton Cherepanov, one of ESET's top malware hunters, wrote in an analysis today. "We speculate that attackers might obtain access to the device using a brute-force attack or by exploiting a vulnerability. Such vulnerabilities in VOS2009/VOS3000 have been reported publicly in the past," Cherepanov added. However, once the malware has a foothold on a Linux server running Linknat VOS2009 or VOS3000, the malware searches for the Linknat configuration files and extracts credentials for the built-in MySQL database, where the softswitch stores call detail records (CDR, aka VoIP calls metadata). "Interestingly, the password from the configuration file is stored encrypted," Cherepanov pointed out. "However, Linux/CDRThief malware is still able to read and decrypt it. Thus, the attackers demonstrate deep knowledge of the targeted platform, since the algorithm and encryption keys used are not documented as far as we can tell. It means that the attackers had to reverse engineer platform binaries or otherwise obtain information about the AES encryption algorithm and key used in the Linknat code."

Open-sourcing TensorFlow with DirectML

TensorFlow is a widely used machine learning framework for developing, training, and distributing machine learning models. Machine learning workloads often involve tremendous amounts of computation, especially when training models. Dedicated hardware such as the GPU is often used to accelerate these workloads. TensorFlow can leverage both Central Processing Units (CPUs) and GPUs, but its GPU acceleration is limited to vendor-specific platforms that vary in support for Windows and across its users’ diverse range of hardware. Bringing the full machine learning training capability to Windows, on any GPU, has been a popular request from the Windows developer community. The DirectX platform in Windows has been accelerating games and compute applications on Windows for decades. DirectML extends this platform by providing high-performance implementations of mathematical operations—the building blocks of machine learning—that run on any DirectX 12-capable GPU. We’re bringing high-performance training and inferencing on the breadth of Windows hardware by leveraging DirectML in the TensorFlow framework. 

Developing a plan for remote work security? Here are 6 key considerations

Training needs to address all aspects of your structure, specifically: information security, data security, cybersecurity, computer security, physical security, IoT security, cloud security, and individual security. Each area of an architecture needs to be tested and hardened regularly for your organization to truly be shielded from security breaches. Be specific about your program: train your staff on how to defend your information around your HR records (SSNs, PII, etc.) and data that could be exposed (shopping cart, customer card numbers), as well as in cyber defense to provide tools against nefarious actors, breaches and threats. Staff must be trained to know how to lock down computers, so individual machines and network servers are safe. This training should also encompass how to ensure physical security, to protect your storage or physical assets. This comes into play more as the IoT plays a larger role in connecting our devices and BYOD policies allow for more connections to be made between personal and corporate assets. Individual security: each employee is entitled to be secure in their work for a company, and that includes privacy concerns and compliance issues.

Phishing attack baits victims by promising access to quarantined emails

As analyzed by the Cofense Phishing Defense Center, this phishing attack is directed toward employees within an organization. Impersonating the technical support team of the user's employer, the campaign pretends to have quarantined three email messages, blocking them from reaching the recipient's inbox. Clicking on a link promises access to these messages but instead directs the person to a phishing page. The user is then prompted to sign in with their email account credentials, which are then captured by the attacker. The campaign seems convincing in a variety of ways, according to Cofense. By spoofing the account of the internal support staff, the phishing email appears to come from a trusted source. The quarantine notice sounds real, even claiming that the quarantined messages failed to process and must be reviewed to confirm their validity. Further, the notice has an air of immediacy by saying that two of the messages are considered valid and will be deleted in three days unless action is taken. Such a notice could convince the recipient that these are messages of importance to their organization, requiring a quick response to review them before they're gone.

Laying The Groundwork For ‘Fintech 2.0’ With Digital Assets

Increasingly, government entities are interested in stablecoin technology as well. While it's a promising development in the world of digital assets, Woodford said he doesn't expect state-back initiatives to go live and take off anytime soon. Rather, the biggest value in these efforts is in validating digital assets as a whole. "If you look at what has caused the shift in mentality in the last 12-18 months, it went from, 'No, we don't want this,' to, 'No, but this is interesting' to the point now where it's interesting and people are actively engaging in this space," he explained. "One of the reasons for that is because of the sentiment, caused by those government announcements. It's one driver, but it's more important and meaningful now in terms of how it's adjusted the attitude." The fact is, any dramatic change in the world's payments landscape isn't going to happen overnight — certainly not a shift from fiat currency toward digital assets like bitcoin. It's part of the reason why stablecoin technology is so popular; it's a blend between fiat and digital currency, and that mix is critical to driving traction. As such, Zero Hash, which recently announced the closure of its Series C funding round, is planning to not only augment its lending offering, but to integrate ACH processing capabilities within its infrastructure.

Smart contact lens prototype raises eyebrows

The human iris controls pupil size in response to light, a critical function that allows the retina to take in appropriate sensory information. Too much light and the world is washed out, too little and it's veiled in darkness. A host of eye diseases and deficiencies inhibit the iris from responding appropriately, including aniridia and keratoconus. Light sensitivity, similarly, is a painful debilitation and is often associated with chronic migraine. Researchers at Imec, an innovation hub based in Belgium, along with partners like CMST, a Ghent University-affiliated research group, the Instituto de Investigación Sanitaria Fundación Jiménez Díaz in Madrid, Spain, and Holst Centre have been developing an low-powered wearable solution. The contact lens's iris aperture is tunable thanks to an integrated liquid crystal display (LCD) that manipulates concentric rings.  "By combining our expertise on miniaturized flexible electronics, low-power ASIC design and hybrid integration, we have demonstrated the capacity to develop a solution for people who suffer from iris deficiencies, higher order aberrations and photophobia, a common yet debilitating symptom seen in many neuro-ophthalmic disorders," says researcher prof. Andrés Vásquez

3 tips for supercharging your remote workforce with AI and automation

Organisations today are facing numerous pressures to enable a remote workforce, particularly in the IT function, since we have entered the post-Covid era. At a time when the traditional modus operandi is constantly being tested, there are some ‘new’ approaches that have actually been in use in other parts of the market for a while now. We can take several lessons from the consumer tech world and how it leverages automation and AI to reduce maintenance and ease automation. Let’s take at the Nest thermostat as an example. A single thermostat changes temperature about 1500 times per year, so a large house with 3 thermostats changes temperature about 5000 times per year. ... Make sure you have a single API-endpoint in the cloud to enumerate & automate all of your storage assets on-prem. Having a cloud-managed platform provides the visibility and orchestration of your assets across sites, servers and applications and you can take advantage of a single API in the cloud to then automate all or a portion of those as needed. You get an aggregated view, or you can filter by data centre or application, server group, etc. Then ask interesting questions like, where is there available capacity for a new project?

Plan for change but don’t leave security behind

The best advice is to plan for change – technical, process and culture – but do not, whatever you do, leave security till last. It has to be front and centre of any plans you make. One concrete change that you can make immediately is taking your security people off just “fire-fighting duty”, where they have to react to crises as they come in: businesses can consider how to use them in a more proactive way. People don’t scale, and there’s a global shortage of security experts. So, you need to use the ones that you have as effectively as you can, and, crucially, give them interesting work to do, if you plan to retain them. It’s almost guaranteed that there are ways to extend their security expertise into processes and automation which will benefit your broader teams. At the same time, you can allow those experts to start preparing for new issues that will arise, and investigating new technologies and methodologies which they can then reapply to business processes as they mature. ... One of the main mistakes we see businesses make is attempting to deploy Kubernetes without the appropriate level of in house expertise. Kubernetes is an ecosystem, rather than a one-off executable, that relies on other services provided by open source projects. 

---

Quote for the day:

"Leadership flows from the minds of followers more than from the titles of leaders, more from the perception of willing followers than from anointment." -- Lane Secretan

---

Daily Tech Digest - Apr 09, 2020

Let’s make testing Agile, they said. Uh, what did they mean by that?

Automated software testing is a fundamental part of Agile software development, even though it is not included in the manifesto. Automated testing helps in many ways, say Okken. But in general, a robust test suite helps ensure working software, increases a team’s ability to refactor and extend a software system, and respects individuals by automating the generally boring task of manual regression testing. “Automated tests also speed up development, further respecting the time of software developers, and allowing faster and more frequent deliveries to end users,” Okken says. “The development of automated tests during production code development helps developers understand the problem domain, the API, the problem at hand better, and help them in turn develop better software. Why would anyone want that learning to go to a separate team and not to the development team?” In adopting DevOps, you are discarding the traditional method of development, commonly called “waterfall,” for the more iterative process of building a small amount and testing rigorously we know as Agile.

Project Orleans and the distributed database future with Dr. Philip Bernstein

The set of mechanisms that we use to solve database problems, they don’t change very fast. Back in the early days, we were learning about certain base technologies for the first time, but now, there’s this repertoire of ingredients that you put into solving a database problem. I’m very sympathetic to graduate students who are trying to learn this stuff because, you know, I learned it slowly over a period of many years as it was unfolding, but people getting into the field, they learn it in a very compressed amount of time and they don’t necessarily have a deep understanding of why things are the way they are and so when they encounter a problem, they’re trying to solve it just based on an understanding of the problem and then trip over some approach that they think, oh, I’ll bet that would be helpful, but then they don’t realize this is actually a variation on something that has been applied in several other contexts before.

New botnet attack "puts other IoT botnets to shame"

A destructive new botnet that compromises vulnerable Internet of Things (IoT) devices and hijacks their resources to carry out devastating Distributed Denial of Service (DDoS) attacks is being reported by security research firm Bitdefender. The IoT botnet, which the company named "dark_nexus," has recently been found in the wild and is taking innovative and dangerous new approaches to successfully attacking IT infrastructure. "Our analysis has determined that, although dark_nexus reuses some Qbot and Mirai code, its core modules are mostly original," Bitdefender said in a 22-page white paper released April 8 about the attacks, "New dark_nexus IoT Botnet Puts Others to Shame." While some of its features may be shared with previously known IoT botnets, the way some of its modules have been developed makes dark_nexus significantly more potent and robust, the report said. ... "The victims won't even be aware that their devices are used as weapons against innocuous targets on the internet, even if the results might be catastrophic for victims or for the proper functioning of the internet," Botezatu said.

How Will The Cloud Impact Data Warehousing Technologies?

As data volumes continued to grow at rapid speeds, traditional relational databases and data warehouses were unable to handle the onslaught of this data. In order to circumvent this issue and ensure more efficient big data analytics systems, engineers from companies like Yahoo created Hadoop in 2006, as an Apache open source project, with a distributed processing framework which made the running of big data applications possible even on clustered platforms. Given the volume of data generated in the modern times and the advanced infrastructure required to handle it, decision support databases are facing considerable pressure to evolve, both technologically as well as architecturally. Alongside several new data warehousing architecture approaches, numerous technologies have also emerged as key contributors to modern business intelligence solutions, ranging from cloud services to data virtualization to automation and machine learning, among others. Cloud based solutions are the future of the data warehousing market. With numerous enterprises turning to the cloud to power and store their data warehousing solutions, internet companies like Amazon and Google and working tirelessly to develop and host innovative cloud-based data warehouses.

‘Unbreakable’ Smart Lock Draws FTC Ire for Deceptive Security Claims

“This vulnerability allowed the researchers to sniff data packets for the information necessary to authenticate their access to the lock,” the FTC explained. “With that information, researchers were able to continue accessing the lock even after their access had been revoked.” Adding insult to injury, the complaint also noted that it’s possible unlock the smart locks by simply unscrewing the back panel. In June 2018, Youtuber JerryRigEverything posted a video demonstrating how the lock could come apart using a screwdriver to loosen and pop off the back of the lock, and then open the shackle. The upshot of all of this, according to the FTC, is that Tapplock “did not take reasonable measures to secure its locks, or take reasonable precautions or follow industry best practices for protecting consumers’ personal information,” despite advertising that it did. “[Tapplock] advertised its smart locks to consumers as ‘Bold. Sturdy. Secure.,'” according to the complaint. “[Its] advertisements touted that its ‘secure’ smart locks were also…designed to be ‘unbreakable.'” The complaint added, “in fact, [Tapplock] did not have a security program prior to the discovery of the vulnerabilities.”

Keeping Vigilant for BEC Amid COVID-19 Chaos

In fact, FBI IC3 recently noted in its 2019 Internet Crime Report that BEC scams accounted for 40% of the losses for cybercrime last year. That number is likely to spike even further as criminals see BEC in the pandemic as low-lying fruit. The rapid distribution of employees to makeshift work-from-home situations, the use of unfamiliar devices, the distractions and anxiety created by illness and business disruption, have all combined to create an ideal BEC hunting ground for the bad guys. "Employees working from home are likely to be even more distracted than usual, with children, household chores, and coronavirus anxieties all competing for their attention," explains Seth Blank, vice president of standards and new technologies at Valimail. "That will make them even less attentive to the subtle clues that an email is a phishing attack. And, when working from home, they're also more likely to be using a small screen or even their cellphones to manage email, which can make some of these phish attempts — which used bogus sender identities — nearly impossible to detect." 

APT attacks targeting Linux, Windows and Android remained undetected for nearly a decade

The APT groups examined in this report are likely comprised of civilian contractors working in the interest of the Chinese government who readily share tools, techniques, infrastructure, and targeting information with one another and their government counterparts. The APT groups have traditionally pursued different objectives and focused on a wide array of targets; however, it was observed that there is a significant degree of coordination between these groups, particularly where targeting of Linux platforms is concerned. The research identifies two new examples of Android malware, continuing a trend seen in a previous report which examined how APT groups have been leveraging mobile malware in combination with traditional desktop malware in ongoing cross-platform surveillance and espionage campaigns. One of the Android malware samples very closely resembles the code in a commercially available penetration testing tool, yet the malware is shown to have been created nearly two years before the commercial tool was first made available for purchase.

Wanted urgently: People who know a half century-old computer language so states can process unemployment claims

On top of ventilators, face masks and health care workers, you can now add COBOL programmers to the list of what several states urgently need as they battle the coronavirus pandemic. In New Jersey, Gov. Phil Murphy has put out a call for volunteers who know how to code the decades-old computer programming language called COBOL because many of the state's systems still run on older mainframes. In Kansas, Gov. Laura Kelly said the state's Departments of Labor was in the process of modernizing from COBOL but then the virus interfered. "So they're operating on really old stuff," she said. Connecticut has also admitted that it's struggling to process the large volume of unemployment claims with its "40-year-old system comprised of a COBOL mainframe and four other separate systems." The state is working to develop a new benefits system with Maine, Rhode Island, Mississippi and Oklahoma. But the system won't be finished before next year. "Literally, we have systems that are 40-plus-years-old," New Jersey Gov. Murphy said over the weekend.

VMware overhauls NSX software to manage, secure larger virtual networks

“VMware’s goal is to make NSX invaluable to the VMware installed base as those customers modernize their on-premises data-center network infrastructure and similarly seek to provide consistent network and security polices for modern applications running in public clouds," Casemore said. "As the data center becomes distributed in a multicloud world, the data-center network must become a multicloud data-center network. On the VeloCloud [VMware’s SD-WAN offering] side, the focus is on modernizing the WAN to accommodate delivery of these applications to the branch.” One new feature of NSX is the ability to control and synchronize multiple virtual networks as a single entity. Called NSX Federation, the feature lets customers set network configuration, management and policy setting across large environments. NSX Federation would let customers generate “fault tolerant zones” where they could contain network problems in a single zone, minimizing problems and preventing them from spreading, VMware stated.

Challenges And Solutions For The Hard Of Hearing In The World Of Remote Work

The hard of hearing community has been contributing to the success of business globally in all kinds of industries. They’ve navigated the challenges of building connections even when dealing with the issues of fast paced conversations and multiple speakers in meeting settings. They’ve adapted by learning to read lips, pick up on speech patterns and build support networks with peers to help them keep pace with their fully hearing capable counterparts. Some of us may feel like this really has nothing to do with our own work experience. But based on the following items of note from the Disabled World Organization and the World Health Organization, you are bound to know, work with or even become someone who is hard of hearing. Approximately 432 million adults worldwide have a disabling hearing loss. It is estimated that by 2050, more than 900 million people will have a disabling hearing loss. There is a progressive loss of ability to hear high frequencies with increasing age known as presbycusis. 

---

Quote for the day:

"Great leaders go forward without stopping, remain firm without tiring and remain enthusiastic while growing" -- Reed Markham

---

Daily Tech Digest - March 04, 2020

A Cyber View Of Smart Cities

No single cybersecurity solution on the market today provides automated remediation, and while options such as SOAR attempt to orchestrate responses, the reality is that most are simple isolation and reactive patching routines. While cyber vendors tout machine learning and AI systems, those efforts are focused on cleaning out noise from incoming information and attempting to find anomalies. None provides any level of remediation that does not require a human to directly run that effort. Not only are these cybersecurity tools not providing automated remediation, but they are also architected in such a way that they disrupt when they make changes and are unable to move into a full remediation capability down the road. For modern cybersecurity, smart cities are a zero-sum game that will never reach the levels of protection that will be required. The final insult is the future wherein AI, already much faster than humans, will be used to attack these already improperly protected smart cities. 

AI platform helps developers spend less time on unit tests, bug fixes, documentation

The platform has been tested with private developers and startups in the US and in France, Joubert said. So far, the feedback has been good with two suggested areas of improvement, he said. Testers said they want to see enhanced coverage so the platform can generic more specific unit tests, and they want to see an increase in the number of languages Ponicode is supporting, according to Joubert. "We're trying to make it very smooth and integrated for developers," he said. "It's really, really important that the developer keeps control." Generating unit tests is complex because developers need to first understand the function and what the intention is inside the code. Then they have to generate a test case and then give some values to tell the function what to do, he said. The third task is generating specific values to test properly. "We created an algorithm that trains the AI to generate unit tests," Joubert said. With Ponicode, developers can run their app in VS Code because the platform will understand how it can be tested; choose easily among the suggestions generated by the platform, and increase coverage in a click, without writing a single line of code, he said.

The Missing Piece In Quantum Computing And IoT

Using the key principles of quantum computing mentioned earlier, we can create quantum key distribution, the most secure way to encrypt and decrypt information – and thereby send messages securely – that has been developed to date. This is true for several reasons. For one, quantum cryptology such as this utilises a property of quantum physics called entanglement. Maria Korolov explains this process as when ‘two particles become entangled so that they have the same state, and then one of these particles is sent to someone else. When the recipient looks at the particle, it’s guaranteed to be the same state as its twin…the state of the two entangled particles, while identical, is also random.’ As such, entanglement allows you to send an encryption key in the form of two ‘identical, random particles’, which can be used to send messages using symmetric encryption. This method doesn’t require a means of transmission and, as such, it becomes more difficult for information to leak. Encryption is therefore made considerably stronger.

Cryptocurrency Bourses Win India Case Against Central Bank Curbs

A three-judge bench headed by Justice Rohinton F. Nariman agreed with petitions by cryptocurrency exchanges, start ups and industry bodies that had challenged the Reserve Bank of India’s April 2018 decision to ban banks from offering any services to support digital currencies. The court struck down the RBI’s curbs on Wednesday. The ruling is an opportunity for virtual currency investors and businesses in India to push against stricter rules being planned by a skeptical government, and potentially raises hope for projects such as Facebook Inc.’s Libra cryptocurrency. The Supreme Court is separately hearing another case, in which it will decide on regulations for digital currencies, and Wednesday’s judgment weakens the case for strict norms. “Cryptocurrencies are an exciting technology that needs to be carefully studied,” said Vaibhav Kakkar, a partner at law firm L&L Partners. “With this order, there is a likelihood of more mature and balanced regulation of cryptocurrencies and the fintech sector as a whole.”

What is the difference between LoRa and LoRaWAN?

LoRa, or Long Range, is a proprietary, low-power and long-range wireless technology that uses license-free wireless spectrum -- much like Wi-Fi uses the unlicensed 2.4 GHz and 5 GHz frequencies. The exact frequency LoRa uses depends on the physical location of a deployment. For example, LoRa uses the 915 MHz band in North America and the 868 MHz band in Europe. Thus, it's important to know which frequencies can be legally used in each LoRa deployment location. From a range perspective, LoRa can communicate up to 10 km away under optimal, line-of-sight conditions. ... LoRaWAN is an open, cloud-based protocol -- designed and maintained by the LoRa Alliance -- that enables devices to communicate wirelessly with LoRa. Essentially, LoRaWAN takes LoRa wireless technology and adds a networking component to it, while also incorporating node authentication and data encryption for security. From an enterprise IT deployment perspective, LoRaWAN networks are ideal for IoT devices that continuously monitor the status of something and then trigger alerts back to gateways when the monitored data surpasses a specified threshold.

'Malware-free' attacks now most popular tactic amongst cybercriminals

The increasing popularity of malware-free attacks underscored the need for organisations not to rely solely on antivirus tools, said CrowdStrike. The security vendor defined malware-free attacks as those in which files or file fragments are not written to disk. These could be attacks where codes executed from memory or where stolen credentials are tapped to enable remote logins. It added that malware-free attacks typically require various detection techniques to identify and intercept, such as behavioural detection and human threat hunting. The 2020 threat report also saw more incidents of ransomware and ransom demands from cybercriminals who, increasingly, conducted data exfiltration, which enabled them to exploit sensitive data that was proprietary information or potentially embarrassing for victims. In addition, nation-state adversaries last year targeted a range of industries, but were especially interested in the telecommunications sector, which saw increased attack frequency from nations such as China and North Korea, noted CrowdStrike. State actors from China, in particular, were keen to target the industry in a bid to steal intellectual property and competitive intelligence, said the US security vendor.

How IT Leaders Can Attract and Retain the Right Talent

Beyond looking to recent graduates, consider untapped pools of talent to diversify your workforce. While often overlooked because of “lack of relevant technical experience,” veterans offer skills that could greatly impact your existing teams, including strong leadership, productivity and decision-making capabilities. We can look to companies like Salesforce for inspiration: Its veteran program Vetforce connects the military community with open IT positions. Another pool of talent often left behind are those who have taken time off and want to restart their careers, including parents with new children or those who had to care for a loved one in a time of need. For example, we partnered with Path Forward to offer returnship programs. These programs help professionals with five or more years of work experience, and who have been out of the paid workforce for a minimum of two years, to bridge their transition back into the workforce. We have found excellent, talented employees through this channel. Once you have a candidate in mind, ask the right interview questions to determine their potential fit on your team.

Could Crypto Exchanges, Wallets Be Targetted With Banking Trokans?

Using Remote Access Trojans (RATs), hackers can reportedly bypass security infrastructure on smartphones, enabling cybercriminals to carry out transactions directly from the infected mobile devices. According to the report, hackers are already using banking trojans like Hydra and Gustuff to attack crypto exchanges and wallets. Using Hydra’s screencast capabilities, cybercriminals can remotely monitor real-time activities on the infected mobile devices. Hydra also allows hackers to clone the infected device, providing access to stored financial information. As part of its report, ThreatFabric revealed that rogue actors are using Hydra to hack crypto wallets on platforms like Binance, Bitfinex, and Coinbase among others. With Gustuff, hackers have access to keylogging and browser overlay attack vectors allowing rogue actors to trick victims into entering their financial details on fake websites that closely resemble their real banking or crypto exchange platforms. According to ThreatFabric, Gustuff’s potential target is also currently expanding to include crypto wallets like Electrum, Blockchain.com, and Xapo.

AI for Payment Optimization: Current Practices and Use Cases

Fraud detection is a major problem in the financial world as it slows down payment processing. Furthermore, it can be difficult to detect, using standard methods, in accounts with a large number of payments on a daily basis. A good example of how AI is used in fraud detection comes from VISA, one of the largest digital payment processors in the world. They’ve been using AI systems for the last 25 years, which allowed the system to improve and learn as the technology got better. Their artificial intelligence system for payment authorization and fraud detection learns user behavior and understands patterns. So, whenever an activity is not according to a user’s profile, it is being flagged as suspicious. Once a transaction is considered suspicious, VISA’s AI connects with the bank that issued the card letting them know about the situation. From here, the bank will either block the transaction (based on the risk assessment made by VISA) or send a text message asking the account owner to confirm that he/she initiated the transaction. 

Parliament: New cyber security label for smart devices

Announced by Singapore's Senior Minister of State for Communications and Information (MCI) Janil Puthucheary in Parliament on Tuesday (March 2), the initiative aims to address this "growing area of concern". "The scheme will raise consumer awareness of more secure products and aims to encourage manufacturers to adopt additional cyber security safeguards," said Dr Janil during the debate on MCI's budget. To be launched later this year, the scheme will initially be voluntary, administered by the Cyber Security Agency of Singapore. Singapore's labelling scheme will follow the European Union's standard for IoT devices, which spells out the minimum standards for manufacturers, including having no default passwords and ensuring that there are regular software updates over the air without user supervision. Singapore is among the first group of countries to adopt the standard. CSA said that the labels will indicate the security provisions present in the smart devices. More details will be announced later.

---

Quote for the day:

"Leaders dig into their business to learn painful realities rather than peaceful illusion." -- Orrin Woodward

---

Daily Tech Digest - January 01, 2020

These 5 high-paying growing jobs didn’t exist a decade ago

“As there have been more and more high-profile data breaches in recent years, this has translated to companies seeing the need for having people who can help them protect their data,” Stansell says. The field is projected to grow by 32% through 2028, according to the Bureau of Labor Statistics. (The average growth rate for all occupations is 5%.) However, the need for information security engineers has far eclipsed the number of people with the skills to do the job. The U.S. Department of Commerce recently estimated there are 350,000 unfilled cybersecurity jobs in the country. Cybersecurity Ventures, an analytics and research company, estimates 3.5 million jobs in cybersecurity around the world are likely to go unfilled by 2021. This talent shortage means workers in the field are paid handsomely. While Glassdoor data says information security engineers earn a median base salary of just over $100,000 per year, top-level jobs in the field, like chief information security officer, can yield pay above $300,000 in top metro areas, according to cybersecurity recruiting firm SilverBull.

Singapore tax on overseas digital services kicks in tomorrow

According to the Inland Revenue Authority of Singapore (IRAS), more than 100 providers of such services had enrolled under the city-state's Overseas Vendor Registration (OVR) regime, which meant they would begin charging GST on the sale of their digital services from tomorrow. The government agency defined digital services as services supplied online or an electronic network that required minimal or no human intervention and were "impossible without the use of information technology". Under the new regime, overseas digital service providers with a yearly global turnover of more than S$1 million and sold more than S$100,000 worth of digital services to customers in Singapore in a 12-month period were required to register for GST and charge GST. The new tax would not apply to online purchases of goods, IRAS said, noting that GST already was payable on goods--valued above S$400--imported into Singapore, via air or post. The government, however, had said it would continue to review the tax regime on such e-commerce transactions before determining how it should proceed.

When does protecting privacy morph into invading privacy?

A few things. One, merely having that extensive a range of PII in one place about one individual is dangerous. If a breach against Lookout does somehow happen — no security is perfect — it would be a bonanza for the cyberthief. From a security perspective, this company's marketing about this service could itself make identity and cyber thieves attracted to the site. They might spend extra resources and effort to break in, which is truly not what a customer wants. Two, it sends the wrong message. Privacy advocates rightly argue to never give anyone or any site more information than they absolutely need ("need to know" is appropriate here). And when the company is directly asking for such a gold mine of PII data (it was probably the passport data request that really sent me soaring), it makes people worried. What, people may wonder, if that page is a phishing page that was designed to merely look like a Lookout page? How is a user supposed to tell the difference? Three, in 2020 (OK, when we're this close to 2020), no company is an island. What if one of its employees turned to the dark side? What if the company you use for backup gets breached?

How a rules engine can drive -- or derail -- an IT automation strategy

In a perfect world, an IT team can set most types of rules quickly and, once in place, they mostly run on autopilot. But what happens with a distributed denial of service (DDoS) attack? Without limitations or additional conditions in place, a rules engine might spin up unlimited resources in the cloud to deal with a DDoS attack in the middle of the night when nobody is around to hit a kill switch -- which could lead to a massive bill from a cloud provider. Create additional conditions or rules to prevent an existing rule, or set of rules, from spinning out of control in an unplanned or unforeseen event. These additional rules can limit how many total resources are allocated in a given time frame, or where resources are available. Apply these additional rules to the original rules that are designed to create resources. This creates a collection of interacting rules that can limit or enable each other -- which, without careful management, can create a confusing spider web of rule sets that you can't untangle, much like a pile of cables hidden in a data center closet.

Wearable industrial tech is coming to a production line near you

The report isn't only filled with good news for wearable manufacturers and their customers: There are a couple of roadblocks that could prevent the industry's growth. Data security and privacy issues are both mentioned as potential issues. There's reason to believe that these concerns are valid, too: Industrial IoT adoption, which arguably contains wearables, has made the manufacturing industry a ripe target for attack. As reported previously by TechRepublic, analysis of industrial networks found higher levels of malicious activity than was expected in 2018, indicating that attackers had already penetrated many networks and were conducting reconnaissance. The nature of IoT networks means that a lot of sensitive data is being passed between sensors and other connected devices, all of which could be harvested by an attacker. Adding wearables to the mix only gives attackers one more type of data to exploit. Along with data theft, privacy for those wearing the devices is at risk as well. If an attacker is able to harvest business data there's nothing stopping them from potentially stealing personal data about employees wearing connected devices either.

Parse Anything with Parsley: A Different Approach

Originally, I wrote the Slang parser using a hand built recursive descent parsing technique similar to that used by Microsoft's production C# compiler. However, maintenance is a bear, and even though the source is partitioned across several files it quickly becomes overwhelming. Unlike Microsoft, I don't have a team available to delegate building the different parts of the parser to. To that end, I needed a tool that would help build me a parser. I considered using ANTLR but I don't like its API or grammar format, and the grammar I found for C# generated an 800K+ source file for parsing C#6 - which wouldn't parse! No thanks. Moving on, I found a grammar for Coco/R as well, but it uses so much embedded state to resolve its parse that it's hard to follow, leading me to the same maintenance and comprehension issues as my hand written parser! For various reasons I'm sticking to LL parsing versus LR parsing so tools like Gppg are off the table, even if they could parse C#. If you don't know the difference between LL and LR parsing it doesn't matter here, but LL parses top down, using the grammar to direct the parse, while LR parses from bottom up, using the next input to direct the parse.

From crypto currency to chocolate – where to spend your Bitcoin

Italia Click is a international food distributor that embraces technologies such as Bitcoin and uses them to accept payments. In November it added crypto to its payment options and will accept payment in several different crypto currencies such as Bitcoin SV, Etherium, and Ripple. I can vouch for the deliciousness of the chocolate! Crete-based 35North sells extra virgin olive oil from where the 35th parallel north crosses the mountains of Crete. Although its Twitter account states that FIAT and crypto payments are accepted, the online shop only offers the choice to pay by card or PayPal. You will need to make a special request for your crypto to be accepted via the online store. Hot Hogs BBQ is a food truck in Keen, NH which gets enthusiastic reviews from customers and won WMUR Best Barbecue in NH 2019. It accepts Bitcoin, dash, BitcoinSV, and Bitcoin cash for your BBQ, but hold fire before hot footing it over to NH – Hot Hogs is now closed until the spring. The Lucky Hot Dog is a food truck in Chicago, IL serving dogs, burgers, beef and chicken. Payment by Bitcoin, card or cash.

Book Review: Enterprise API Management

Any API initiative should start by identifying the business drivers for such endeavor, such as what are the benefits targeted and why, how will these targets be measured once delivered, and what return can be expected on the investment (ROI) (naturally leading to the question, what is the investment required in the first place!). At this stage, it is less about the technicalities of APIs and more about the business itself. Therefore, it is empirical to elaborate an understanding of the business domain, its language, its key stakeholders, and how it operates. Doing so can help in identifying ways on how APIs can help, or in other words, the business drivers? Once such business drivers are identified, then it’s a matter of presenting them in a comprehensive way to the right stakeholders. At this point, communication and presentation skills matter a lot, and so does the language used. A lot can go wrong at this point. If the presentation is too technical, business professionals will struggle to understand the value of what’s been offered.

Diabetes monitoring is having a smartwatch and smartphone revolution

CGM technology could ultimately be rolled out to people with type 2 diabetes, and those in the pre-diabetic range – people whose blood sugar is higher than normal but not yet diabetic. The idea of getting people who aren't on insulin to use CGM is to show the impact of certain foods and behaviours on their glucose levels, and so help them to keep levels in the right range. "Until you really have direct feedback, it can be hard to really understand why that's important," Leach says. "I think there can be a whole lot more around that coaching or the advice or the analytics that you put around the data to help you get more people with either pre-diabetes, or even with just general health and wellness. I think there's a lot of opportunity and there's quite a few pilots we're entering into any different areas to learn more about what works for those users." For the traditional CGM user base – people who control their diabetes with insulin injections – the next few years are likely to bring another sea-change in technology with the advent of closed-loop or 'artificial pancreas' systems, single units that both monitor glucose and deliver insulin accordingly.

5G will change the world - but who will keep it safe?

Robust security will need to be designed into both devices and network equipment from the outset, with a continuous product security lifecycle in place to manage it, as well as a secure software development lifecycle. The networks of the future will be largely virtualized, software-based networks. This means they will be difficult to test as verifiably secure at any point in time. Governments and others such as large businesses who interact with a range of other suppliers and networks will need to consider how appropriate incentives are put in place throughout the supply chain to encourage effective consideration of security in the development and operation of new networks. To ensure interoperability around the globe and to truly realize the benefits of the Fourth Industrial Revolution, governments will also need to consider how they can promote more international approaches to securing and building trust in next-generation networks.

---

Quote for the day:

"Coaching is a profession of love. You can't coach people unless you love them." -- Eddie Robinson

---

Daily Tech Digest - October 09, 2019

Blockchain: Why the revolution is still a decade away

According to Adrian Lee, who researched the report, this was caused by a "lack of industry consensus" on key features of the technology, such as product concept, application requirements or target market. In other words, blockchain has been a victim of its own hype. Its potential benefits raised huge expectations, but in reality it is not mature enough yet to be efficiently implemented at scale. Litan compares this to the adoption of the internet: users don't have to worry about understanding protocols such as DNS or TCP/IP. This is why browsing the web is scalable, and it is why it became so mainstream. But if an enterprise wants to implement blockchain, it's a whole different story. Individual companies have to worry about picking a platform, coming up with a smart contract language, or using a specific system interface and consensus algorithms. ... Avivah Litan, research vice-president at Gartner, doesn't see this happening before 2028, which is when she expects the technology to be fully scalable.

7 Considerations Before Adopting Security Standards

ISO 27001. PCI DSS. GDPR. When it comes to business and security standards, it's easy to get lost in the alphabet soup of acronyms. How can you discern which ones are right for your organization? Start by asking some high-level questions as to what you hope to accomplish by adopting them – and how adhering to standards can help your growth, says Khushbu Pratap, a senior principal analyst at Gartner who covers risk and compliance. "The most important questions to ask [are]: Are your customers asking for it, and do your stakeholders think a particular standard is important?" says Pratap. Assuming the answers are yes, there are additional factors to think through before moving ahead with a strategy for compliance. The seven practical tips outlined in this feature will help. Heavily regulated organizations typically have special teams that work on these standards, but even for them, use this list as a chance to take a step back and better target your standards compliance and certification teams.

Developers' Code Reuse Security Conundrum: Cut, Paste, Fail

For writing more secure code, culture remains another challenge. Stu Hirst, principal cloud security engineer at British online food order and delivery service Just Eat, speaking at last week's ScotSoft conference in Edinburgh, Scotland, advocated literally showing developers the risks that poor or poor-quality reused code can create, for example, by showing them how it can be hacked. He says such discussions are essential for fostering a culture in which coders are coding securely, without trying to impose punitive measures. ... Earlier this year, the CISO of a European financial services firm told me that his organization's approach has been to maintain its own repository of code snippets that have been vetted and trusted, from which in-house developers can draw, thus saving time and contributing to more secure and stable software builds. The organization also regularly evaluates open source offerings, and it isn't afraid to tear up code built in-house when a better open source alternative becomes available. 

The Magic Of Smart Mirrors: AI, AR & The IoT

Coty’s version of the smart mirror is the CES 2019 Innovation Awards Honoree—Wella Professionals Smart Mirror. This mirror allows stylists to provide more personalized consultations. Like the apps discussed above, the Wella Professionals Smart Mirror is able to do a live AR hair color try on and can provide a 360-degree of the style so the client can see what it will look like from all angles. In addition, using facial recognition technology, it can retrieve past styles for each customer, allowing the stylist and client to really assess what worked and what didn't. ... It also connects to a mobile app so the stylist and customer can stay in contact in between appointments. Memory Mirror, a digital mirror created by MemoMi, combines a full-length mirror with high-tech including a 70-inch LCD, computer and HD camera that can record videos so you can save, share and review your try-on sessions. Neiman Marcus installed MemoMi’s mirrors in 34 locations. Another mirror altering the retail experience is the Oak Mirror by Oak Labs. It serves as a digital assistant in a dressing room, allowing customers to request other colors, styles, or accessories from a sales assistant.

Canada’s Blockchain Sector Wants Legal Clarity

The report – one of the first to take a comprehensive snapshot of Canada’s blockchain ecosystem – sheds new light on the country’s nascent crypto firms, who appear largely bullish on their own future and are increasingly eager to know if their government feels the same. ... Though separate from U.S. regulators and from other global regulatory bodies, Canada’s government has been reticent to establish crypto regulations that might conflict with other countries’ laws, said Michael Gord, CEO of Toronto-based MLG Blockchain consulting group. Instead, Gord described a regulatory gray zone that confounds his consulting group and the legal teams he turns to for advice: “Often digital asset regulations in Canada are so ambiguous that lawyers cannot give us a yes or no answer. The regulations have not been defined enough for them to be able to.” Neither the U.S. nor Canada have developed comprehensive definitions for digital assets, and Gord doubts the Canadians will jump ahead: “Even if [Canadian regulators] were to want to create clear regulation, there’s a lot of pressure from the SEC” to follow its lead, he said.

How to prepare tomorrow’s workforce? Focus less on devices and more on digital thinking

In most liberal arts institutions, students are situated in a brick-and-mortar, face-forward teaching environment that says, “read this book, do this essay, or submit this paper. In their own personal lives, they are digital natives, using an iPhone and technology to do just about everything – from communicating to ordering food. They must push that world aside, however, to conform to teaching methods and teachers that are not digitally literate. The solution is not just to introduce more digital devices and technical training into a classroom to get faculty and students to think more digitally about what they are doing, but to improve their overall digital literacy or ability to live, work, think and communicate in a society that is driven by the Internet, social media, mobile devices and other digital technologies. In short, change the education and learning formula to be more closely aligned with the demands of today’s digital world.

74% of global workers say the tech industry needs more regulation

Overall, nearly three-quarters (74%) of global workers said the tech industry needs more regulations. Snow surveyed 3,000 professionals across the US, Europe, and the Asia-Pacific region to determine how employees felt about about data privacy regulation standards. As technology enables more organizations to harbor personal consumer data, standards must be put in place to make sure this information isn't exploited. ... Millennials were more likely to feel like their data is protected by regulations (44%) than baby boomers (21%), the report found. Some 55% of tech company vice presidents and 52% of directors also said they feel more protected from data breaches, while only 27% of entry-level employees said the same. The rise in data regulation has resulted in more pop-up and opt-in messages for employees, but opinions are split down the middle whether these messages are disruptive to their workday or not.  "But at the same time, the increase in regulation makes administratively navigating the internet much more difficult, and some might find this to be an annoying and tedious user experience," Larson said.

How the Software-Defined Perimeter Is Redefining Access Control

An SDP or zero-trust model can be used within the modern perimeter-less enterprise to help secure remote, mobile, and cloud users as well as workloads. SDP isn't just about having a secure tunnel — it's about validation and authorization. Instead of just trusting that a tunnel is secure, there are checks to validate posture, robust policies that grant access, segmentation policies to restrict access and multiple control points. The increasing adoption of zero-trust security technologies by organizations of all sizes is an evolving trend. As organizations look to reduce risk and minimize their potential attack surface, having more points of control is often a key goal. Security professionals also typically recommend that organizations minimize the number of privileged users and grant access based on the principle of least privilege. Rather than just simply giving a VPN user full local access, system admins should restrict access based on policy and device authorization, which is a core attribute of the zero-trust model. 

How to build a better cybersecurity defense with deception technologies

Deception technology addresses these key challenges with early and accurate detection coupled with automation to accelerate incident response. The solution tricks threat actors into revealing their presence with authentic, high-interaction decoys that blend seamlessly into the production environment. As soon as an attacker attempts to scan the network, steal credentials, or move laterally, the deception platform raises a high-fidelity alert, reducing dwell times. From there, defenders can remediate or safely let the attack play out and collect company-specific threat intelligence to strengthen their defenses. ... One way to be more proactive is to assume the attacker will get in, and plan a defensive strategy that leverages the entire network to detect them early, while gathering adversary intelligence to better defend against future attacks. In the perimeter-less society that we find ourselves in, with the rapid adoption of cloud infrastructure and ubiquitous global access, traditional security can't scale to keep up with where organizations now operate.

Hype vs reality: Is the tech industry on the cusp of another ‘AI winter’?

The amplification benefits that AI can bring to the IT work that humans are responsible for within organisations was one area called out by Chandrasekaran during the panel as sign of the good that the technology can do. Although a lot of the reporting on AI focuses on how its proliferation within enterprises could lead to job cuts, the converse is often true, he said. “When we [Cisco] look at any IT organisation, they are growing,” he said. “They are hiring hundreds of people to run the network, or the digitisation that’s happening. What we see is that the [AI] tooling is basically to free them up from dealing with the complexity that comes along, so that they can actually get their job done. “We look at all this automation, and… the idea is to free people so that they don’t become completely buried with the burden that’s coming along with the number of devices coming on board.”

---

Quote for the day:

"Leaders are people who believe so passionately that they can seduce other people into sharing their dream." -- Warren G. Bennis

---

Daily Tech Digest - September 14, 2018

Four industries Apple is set to disrupt

Apple has very clearly focused on healthcare, steadily building an in-house team of experts, most notably around medical devices who know how to work with regulators, researchers and IT. With the introduction of HealthKit, ResearchKit and CareKit, Apple has been at the forefront of unlocking personal health data and allowing users to share it with care teams, researchers and even first responders. Some of the broadest health studies ever conducted have relied on ResearchKit. iPhones and Apple Watches make it possible to contact emergency services and care-givers in seconds, and they provide key information about us using the emergency medical information card that can be accessed on an iPhone – even when the phone is locked. And increasingly, they alert us to signs of danger and disease that might otherwise go unnoticed. Apple is not slowing its efforts; in fact, it’s just getting started. The announcement this week of fall detection, complete with an understanding of different types of falls, is a major improvement aimed directly at older users.

Is Pattern Recognition Killing Innovation?

Underrepresented founders face greater challenges in convincing a fairly homogeneous industry that issues they are solving are significant enough, that the services they provide are widely needed and that they are the ones to take this vision into a multibillion dollar company. Katrina Lake, founder of Stitch Fix, and Shan Lynn Ma, founder of Zola (both multibillion dollar companies) have spoken out about their struggle to raise funding and felt it was due to the lack of diversity in the VC industry. "You can't blame the kind of individual for having that preference, but then you step back and realize 94% of venture investors are male and have similar preferences. And so, I think that it unquestionably made it harder," says Lake. In a sector that is driven by business ‘intuition’ and ‘gut feeling’ based on past patterns, female founders and other underrepresented founders, lose out. This is, to some extent, due to what experts call “homophily” in which similarity breeds connection, which means VCs prefer to hire, invest in, or co-invest with those that are similar to themselves.

Outcomes-based security is the way forward

“We are still finding the same problems every year that we have found in previous years, with things like credential theft and abuse still common, and multifactor authentication – especially for privileged accounts – still rare, even though this would reduce the attack surface massively,” he says. The only real change, he adds, is that there is now a lot more on the corporate IT network, with “almost everything” connected and online as business processes become increasingly digital and the dependency on IT is greater than ever before. “But businesses still assume that if they have spent millions on security products everything is fine, but bad guys usually work out what has been done to make something more secure and will find a way around it, so it is a continual arms race,” he says. As a result, Raeburn believes most cyber security technology innovations tend to provide a false sense of security for organisations because they will be effective only for a limited period of time.

Fighting the fear of new tech with the chief technology evangelist

Training is also paramount, and should be conducted in virtual or test environments as much as possible, long before the new technology goes live. It’s also important to remember that every employee will need to transition to a new technology at a pace that works for them which won’t interfere with their primary objectives. This can be especially important in organizations like healthcare, where doctors and other clinicians can’t be pulled away from their patients, or afford to slow down the treatment process due to the implementation of a new technology. Getting buy-in and acceptance from the workforce that will be using any new system is critical, since they will ultimately make or break the project. And for that to happen, the new technology needs an advocate, someone who can rally the troops and make people actively excited about the pending change long before the wheels start to turn on a new project.

Mobile fraud is increasing, attack rates rising 24% year-over-year

Financial institutions were besieged with 81 million cybercrime attacks in the first half of 2018 on the ThreatMetrix global network. Of these, 27 million were targeting the mobile channel as fraudsters turn their attention to the success story that is mobile banking adoption. Financial services mobile transactions are growing globally, with China, South East Asia and India showing the strongest regional growth. This indicates that the mobile channel is a key enabler for financial inclusion in emerging economies. Overall, the biggest threat in financial services comes from device spoofing, as fraudsters attempt to trick banks into thinking multiple fraudulent log in attempts are coming from new customer devices, perhaps by repeatedly wiping cookies or using virtual machines. Mule networks also continue to negatively impact the global banking ecosystem, particularly as financial crime becomes an ever-more sophisticated and hyper-connected beast. The challenge for financial institutions is detecting mule activity even when individual account behavior may not trigger red flags.

Smartwatches finally evolve into a viable platform

The Qualcomm Snapdragon Wear 3100 platform allows for a pervasive display, and the watches have battery life measured in days, not hours. This means that a watch maker can create a watch with a pervasive, attractive face designed to work with the watch case and look good to others, not just the watch user. Therefore, companies like TAG Heuer and Louis Vuitton (who owns TAG Heuer and Hublot) are now planning on releasing smartwatches by year’s end.  Finally, we have smartwatches that embrace the idea of a watch being a showcase of wealth and status. The part the watchmakers need to address is collectability…and that suggests a modular approach, where the movements and the cases are separate. That way you can buy and collect cases and then insert your up-to-date smartwatch component (which will then morph its display to match the case it’s placed in). I’m aware that TAG Heuer was working on a project like this about a decade ago, so my money is on them getting this right first.

Supermicro unveils an insanely fast, insanely thin storage server

The new Supermicro product, the SSG-1029P-NMR36L, has 36 18TB NF1 drives in its 1U chassis, doubling the capacity of a model introduced in January with 288TB. The server also comes with two 28-core Xeon SP processors and holds up to 3TB of memory in 24 DIMM slots and dual 16-lane PCIe network cards. The NF1 drives are all front-loaded and hot-swappable using the NVMe protocol for high-capacity network storage and very low latency performance. The optimized power profile of the fully hot-swap-capable NF1 devices means more processing power can be reserved to drive IO with the fastest CPU and memory available. "At Supermicro, we consistently offer our customers early access to the very latest and best technologies," said Charles Liang, president and CEO of Supermicro, in a statement. "Our 1U NF1 storage server features the most power-efficient, next-generation flash technology with the highest storage density and best IOPS performance. This provides a real time-to-value competitive advantage for users with data-intensive workloads like big data, autonomous driving, AI, and HPC applications."

When to use a CRDT-based database

Everything looks good with the eventual consistency model until there are data conflicts. A few eventual consistency models promise best effort to fix the conflicts, but fall short of guaranteeing strong consistency. The good news is, the models built around conflict-free replicated data types (CRDTs) deliver strong eventual consistency. CRDTs achieve strong eventual consistency through a predetermined set of conflict resolution rules and semantics. Applications built on top of CRDT-based databases must be designed to accommodate the conflict resolution semantics. In this article we will explore how to design, develop, and test geo-distributed applications using a CRDT-based database. We will also examine four sample use cases: counters, distributed caching, shared sessions, and multi-region data ingest. My employer, Redis Labs, recently announced CRDT support in Redis Enterprise, with conflict-free replicated data types joining the rich portfolio of data structures—Strings, Hashes, Lists, Sets, Sorted Sets, Bitfields, Geo, Hyperloglog, and Streams—in our database product.

14 Things I Wish I’d Known When Starting with MongoDB

MongoDB’s security checklist gives good advice on reducing the risk of penetration of the network and of a data breach. It is easy to shrug and assume that a development server doesn’t need a high level of security. Not so: It is relevant to all MongoDB servers. In particular, unless there is a very good reason to use mapReduce, group, or $where, you should disable the use of arbitrary JavaScript by setting javascriptEnabled:false in the config file. Because the data files of standard MongoDB is not encrypted, It is also wise to Run MongoDB with a Dedicated User with full access to the data files restricted to that user so as to use the operating systems own file-access controls. MongoDB doesn’t enforce a schema. This is not the same thing as saying that it doesn’t need one. If you really want to save documents with no consistent schema, you can store them very quickly and easily but retrieval can be the very devil. 

Four key considerations for evaluating graph warehouses

Organizations should also evaluate graph databases in terms of how much reading and writing they’ll require. GOLAP systems mostly read data for query purposes. Since data warehouses are usually batch jobs, their writing capabilities aren’t as important as their ability to swiftly query data for answers. However, the performance of batch loading is crucial. OLTP systems are constantly updating small portions of their transactional data via their writing capacity. For example, tollbooths are continually reading the license plates of vehicles and updating transactional data for passing motorists. Other examples include point-of-sale (POS) checkout systems, either for e-commerce or physical shopping locations. The same data from the tollbooths or consumer checkout is subsequently used by OLAP systems for establishing highway systems improvements, or pricing and marketing options for POS. Another defining attribute of OLTP and OLAP systems is the type of query required. In general, OLTP systems are primed for answering narrow, well-defined questions. 

---

Quote for the day:

"It's very important in a leadership role not to place your ego at the foreground and not to judge everything in relationship to how your ego is fed." -- Ruth J. Simmons

---