Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - June 03, 2024

What’s eating B2B SaaS

Recently however, there has been increasing speculation that large language models (LLMs) are a threat to the entire Software ecosystem. In an aptly named short essay titled “The End of Software”, venture capitalist Chris Paik of Pace Capital contends that can significantly lower the cost of software development and maintenance, leading to a proliferation of new, agile software solutions that could replace traditional SaaS models. Paik argues this shift may result in a fundamental rethinking of how software is built, sold, and consumed, potentially rendering existing B2B SaaS business models obsolete as the market transitions to AI agents. He goes so far as to say “Majoring in computer science today will be like majoring in journalism in the late 90’s”. ... Most SaaS is priced by the seat. Given there is a direct correlation between the workforce reduction and revenues, this easily equates to billions of dollars in lost recurring revenues across the industry. Indeed, one of the main benefits touted by SaaS companies was this ability to scale up and down as needed without commitment.

Deploying scalable modular data centers at the Edge

Requirements around the build-out of data centers have also led to a rethink of how these buildings need to be constructed. Building data centers at the Edge is the way to combat some of the challenges that the industry faces, Lindsey argues. “We see Edge as a way to activate infrastructure very quickly, where today, as you know, we have a wildly low vacancy rate,” he says. “That should continue through the next several years, and people still need data, so we see this as a way to scale out where we have now. We’re now on track over the next five years to be able to scale out at gigawatt scale.” ... “We wanted to create an integrated platform that allows for our customers to build and deploy data centers, with an experience that's much more akin to building and buying a car,” he explains, noting that Flexnode focuses on connecting three key parts. “The first part was an industrialized building system that is designed for disassembly, configurability, adaptability, and designed to go anywhere.” The second part, he says, is focused on its fully digitized process which helps its customers design and configure their data centers. The final part, he adds, is the ecosystem of partners Flexnode partners with, spanning engineering and construction.

Saudi entrepreneurs launch fintech startup to spur open banking growth in GCC

The projected growth of open banking in the Gulf Cooperation Council countries has motivated Rayan Azab and Salah Khashoggi to partner with Dubai-based fintech entrepreneur Ash Kalra to spearhead this venture after four years of market research. This comes as open banking is projected to account for over $124 billion worth of transactions in the GCC region alone by 2031, up from $14 billion in 2020, with an annual growth rate of 22 percent, according to a report by Allied Market Research. ... “Saudi Arabia has recently advanced its open banking initiatives and is poised to become a regional leader in open banking," he explained. Highlighting the potential impact of open banking growth in the GCC on their trajectory, Azab mentioned that the segment is already established in the region, and they are not introducing something entirely new. “We are just revamping it. Thimsa is going to come and help small businesses that cannot afford to just go and do the huge accounting or whatever,” he said, adding that they will be adding value to these businesses.

A Journey From the Foundations of Observability to Surviving Its Challenges at Scale

The amount of data generated in cloud-native environments, especially at scale, makes it impossible to continue collecting all data. This flood of data, the challenges that arise, and the inability to sift through the information to find the root causes of issues becomes detrimental to the success of development teams. It would be more helpful if developers were supported with just the right amount of data, in just the right forms, and at the right time to solve issues. One does not mind observability if the solution to problems are found quickly, situations are remediated faster, and developers are satisfied with the results. If this is done with one log line, two spans from a trace, and three metric labels, then that's all we want to see. To do this, developers need to know when issues arise with their applications or services, preferably before it happens. They start troubleshooting with data that has been determined by their instrumented applications to succinctly point to areas within the offending application. Any tooling allows the developer who's investigating to see dashboards reporting visual information that directs them to the problem and potential moment it started.

Faultless with serverless: Cloud best practices for optimized returns

The Single Responsibility Principle (SRP) is an essential rule to ensure the modularity and scalability of serverless computing. According to the rule, functions should be small, stateless, and have only one primary reason to modify. Stateless functions can easily scale up or down based on demand without any overheads of managing the state. ... An asynchronous, event-driven architecture is best suited for a serverless execution model. Serverless applications achieve resilience, scalability, and efficiency by decoupling components and handling the workloads asynchronously. The technique involves queues and event streams, where the tasks are offloaded and exclusively processed by serverless functions. ... With built-in monitoring solutions, organizations can track function invocations, durations, errors, and resource utilization. This helps them identify and resolve issues proactively and optimise opportunities. To understand this better, consider a serverless IoT platform. Through a strategic process for monitoring and observability, enterprises can remediate issues pertaining to data ingestion, processing, and delivery.

Emerging Trends in Application Security Testing Services

The integration of security into DevOps practices, known as DevSecOps, continues to gain traction. DevSecOps emphasizes collaboration and communication between development, IT operations, and security teams. By automating security checks throughout the development pipeline, DevSecOps ensures that security is not a bottleneck but an integral part of the development process. This proactive approach significantly enhances the overall security posture of applications. ... Machine learning (ML) and artificial intelligence (AI) are revolutionizing application security testing. Advanced ML algorithms can analyze vast datasets to identify patterns and anomalies, helping security experts detect and respond to threats more effectively. AI-driven tools can automate identifying vulnerabilities, predict potential attack vectors, and suggest remediation strategies. ... With the proliferation of APIs (Application Programming Interfaces) in modern applications, API security testing has become a critical focus area. APIs facilitate seamless communication between different software systems but can also be vulnerable points if not properly secured.

Kenya & US Aim to Bolster Digital Security in Africa

The news comes as Kenya has seen a spike in attacks, including significantly disruptive incidents. For instance, the country suffered a massive denial-of-service attack that disrupted access to its e-Citizen government-services site last year, nd eventually affected electric utilities and rail-ticketing systems. ... "The government ought to adopt good multi-stakeholder practices such as courting local private sector players—especially small and medium-sized enterprises operating in and affected by developments in cyberspace—alongside the local sector leaders and tech multinationals operating in the country," the group stated. "Kenya also has a vibrant information security community that should be incorporated in cyber drills through professional associations." ... Both Kenya and the United States highlighted the efforts of private industry in partnering with the East African nation to improve its cybersecurity posture. In addition to its cyber operations work, Google will be aiding Kenya with incident-response solutions and improving infrastructure resilience.

How to Find the Right AI Solution: 3 Innovative Techniques

The real issue is that AI, as a product or service, doesn’t fit well into the RFP process. First, AI isn’t akin to a magic wand. It works slowly and deliberately, producing incremental -- but very real and significant -- improvements over time. These gains are hard to explain using an RFP, which, again, demands results that are achievable rapidly and according to a strict timeline. Instilling confidence -- without conveying false hopes or unrealistic expectations -- is difficult given the sheer volume of specific and detailed questions that RFPs require. ... For AI to do what it does best, it requires access to every bit of available data over an extended period of time. Limiting AI to a very brief timeline, which includes piecemeal and/or partial access to data, yields results that are effectively useless. A POC, in short, gives no indication of what the technology could do if these restrictions didn’t exist, which makes it hard for vendors of all sizes to use proofs of concept to bolster their submissions -- and even harder for organizations to trust what the POC is claiming.

Advanced CI/CD: 6 steps to better CI/CD pipelines

One surprising data point in the State of CI/CD report was the number of CI/CD platforms respondents had in place and how it impacted DORA metrics. Companies using a hybrid approach of self-hosted and managed CI/CD platforms outperformed those who standardized on one approach or were not using CI/CD platforms. Of the companies using a hybrid approach, 49% had a lead time of less than one week for changes, and 24% had a lead time of less than one day. Sixty-six percent could typically restore service performance from an unplanned outage in under a day, and 25% could do so in under an hour. These rates were significantly better than those using only one approach. The report also showed that organizations using three or fewer CI/CD platforms generally outperformed those with more than three tools. There are many reasons why organizations may have multiple CI/CD platforms. For example, a company may use Copado or Opsera to deploy apps to Salesforce, use Jenkins for data center apps, GitHub Actions for cloud-native applications, and then inherit implementations using AWS CodeBuild and AWS CodePipeline after acquiring a business.

Key Considerations for C-Suite Leaders Involved in Digital Transformation Initiatives

Poor data can lead to poor decisions, especially with AI-based technologies where foundational models rely solely on data without context. While making good decisions relies on complete and accurate data, using incorrect data can lead to significant financial losses. ... Before embarking on a transformation, leadership needs to understand the regulatory environment specific to their industry. This requires looking at current regulations and understanding potential changes happening in the relatively short term. ... Before and during a transformation, C-suite leaders must keep their finger on the pulse of cybersecurity. Newer technologies are aggregating large datasets of customer, banking, and personally identifiable information (PII), which demands a premium and can be extremely valuable on the dark web. Implementing an innovative technology is a perfect time to ensure adequate cybersecurity measures, and post-implementation testing of new integrations will provide additional peace of mind. Protecting digital assets is not only a technical challenge; it’s a human challenge.

Quote for the day:

"Earn your leadership every day." -- Michael Jordan

Daily Tech Digest - June 02, 2024

Can the sovereign cloud become Oracle’s crowning glory?

Organisations in highly regulated industries, like the banking sector, are also very interested in using sovereign clouds. They’ve already invested a huge amount into their data centres, and they like the idea of perhaps running Oracle Cloud Services alongside that. And they’ve got legacy systems to consider, too. Look at Deutsche Bank. They continue to run a lot of their applications in a standard way, but they’ve modernised their Oracle database estate by using our Oracle Exadata Cloud@Customer offering. ... AI will be another complicating factor. There’s a real desire among customers to make use of AI technologies, but there’s a real nervousness about making sure that any model is properly trained on the data contained within the company and not unduly exposed to training material scraped from across the internet. That’s why we recently announced a partnership with Nvidia. We’re not only harnessing its GPUs within our network but doing so in a way that ensures that they’re operated in a sovereign context. That really is an area that we’re ploughing ahead with because we just think there’s a lot of demand for such an approach.

An AI tool for predicting protein shapes could be transformative for medicine

Proteins are essential parts of living organisms and take part in virtually every process in cells. But their shapes are often complex, and they are difficult to visualise. So being able to predict their 3D structures offers windows into the processes inside living things, including humans. This provides new opportunities for creating drugs to treat disease. This in turn opens up new possibilities in what is called molecular medicine. This is where scientists strive to identify the causes of disease at the molecular scale and also develop treatments to correct them at the molecular level. The first version of DeepMind’s AI tool was unveiled in 2018. The latest iteration, released this year, is AlphaFold3. A worldwide competition to evaluate new ways of predicting the structures of proteins, the Critical Assessment of Structure Prediction (Casp) has been held biannually since 1994 In 2020, the Casp competition got to test AlphaFold2 and was very impressed. Since then, researchers eagerly anticipate each new incarnation of the algorithm.

AI training data has a price tag that only Big Tech can afford

“Overall, entities governing content that’s potentially useful for AI development are incentivized to lock up their materials,” Lo said. “And as access to data closes up, we’re basically blessing a few early movers on data acquisition and pulling up the ladder so nobody else can get access to data to catch up.” Indeed, where the race to scoop up more training data hasn’t led to unethical (and perhaps even illegal) behavior like secretly aggregating copyrighted content, it has rewarded tech giants with deep pockets to spend on data licensing. Generative AI models such as OpenAI’s are trained mostly on images, text, audio, videos and other data — some copyrighted — sourced from public web pages. ... OpenAI has spent hundreds of millions of dollars licensing content from news publishers, stock media libraries and more to train its AI models — a budget far beyond that of most academic research groups, nonprofits and startups. Meta has gone so far as to weigh acquiring the publisher Simon & Schuster for the rights to e-book excerpts

Snowflake compromised? Attackers exploit stolen credentials

“Information about the incident and the group’s tactics is not yet fully published, but from what we know, the group utilizes custom tools to find Snowflake instances and employs credential stuffing techniques to gain unauthorized access. Once access is obtained, they leverage built-in Snowflake features to exfiltrate data to external locations, possibly using cloud storage services.” Brad Jones, VP of Information Security and CISO at Snowflake, says that they became aware of potentially unauthorized access to certain customer accounts on May 23, 2024. “During our investigation, we observed increased threat activity beginning mid-April 2024 from a subset of IP addresses and suspicious clients we believe are related to unauthorized access,” he added. “Research indicates that these types of attacks are performed with our customers’ user credentials that were exposed through unrelated cyber threat activity. To date, we do not believe this activity is caused by any vulnerability, misconfiguration, or malicious activity within the Snowflake product.”

GoFr: A Go Framework To Power Scalable and Observable Apps

When an application encounters such an error (typically due to temporary network glitches or database timeouts), instead of immediately giving up and returning an error to the user, the retry pattern involves automatically retrying the operation after a short delay. This delay can be fixed or exponential, meaning that subsequent retries occur after increasing intervals. But sometimes relentless retries exacerbate the problem, leading to potential service degradation and even unintentional denial-of-service attacks. To address this challenge, GoFr integrates the circuit breaker pattern, a robust defense mechanism designed to prevent futile operations and mitigate the impact of non-transient faults. The circuit breaker pattern complements the retry pattern by focusing on recognizing and handling scenarios where repeated attempts at an operation are unlikely to succeed. Rather than persistently retrying, the circuit breaker pattern aims to safeguard the system by temporarily halting further attempts upon detecting a certain threshold of failures.

Digital transformation: AI — Executive Insights

The public’s understanding of AI has gained ground since ChatGPT’s 2022 launch, which took a staggeringly short five days to reach 1 million daily users. But Bhasin says the term “artificial intelligence” doesn’t necessarily capture the technology’s true value. “How we think about AI is less about being artificial intelligence and more about being augmented intelligence,” Bhasin says. Humans generally listen well and empathize. Computers are good at doing repetitive things again and again. AI’s value is in augmenting the work that a caring human can provide. “It’s mixing the power of the human being and the augmented intelligence, and how it comes together to serve a client’s needs and serve a business need,” Bhasin says. “That’s a great way to think about how to deploy these technologies.” Bhasin pointed out that Bank of America’s Erica AI tool was released more than five years ago. The tool was built in-house. “We’ve been doing this for a long time,” Bhasin says. “We know how to do this, and we know how to do it at scale.”

The CFO Renaissance: what the rebirth of the role means for businesses

Modern CFOs are also expected to be proficient with emerging technologies such as AI, machine learning and blockchain, which all help to automate routine financial tasks, enhance accuracy and enable more sophisticated financial modelling. It’s a full plate but Pleo’s ambition is to ensure that CFOs have the means to execute their new responsibilities effectively and are finally able step out of the back office to occupy a key role in strategic decision making. Today, Pleo is Europe’s leading spend-management solution, enabling 33,000 companies across Europe to run their finances efficiently and in doing so, promote business success without compromising on control, transparency or financial safety. With its forward-thinking solutions, Moylan says Pleo can play an important role in “enabling CFOs to add value in other areas. ...” Integrating solutions like Pleo across an organisation can have compounding benefits, believes Moylan, including helping to connect critical areas and “ensure the accounting system talks to the payroll system, the expense management system and the tax authority – all of which is critical to effective decision making”.

Security-as-Code: A Key Building Block for DevSecOps

Security-as-Code is a foundational building block of DevSecOps. SaC provides the automation, consistency and reliability of ensuring security in the DevSecOps ecosystem. It treats every security measure as code artifacts that are version-controlled, tested and deployed alongside the actual software. ... SaC allows security controls and checks to be integrated into the development pipeline, enabling early detection of security vulnerabilities and issues. By identifying and addressing security issues during the development process, organizations can reduce the likelihood of security breaches and minimize the associated risks. ... SaC promotes consistency and standardization in security configurations and practices across development, testing and production environments. By defining security measures as code artifacts, organizations can ensure that security policies are uniformly applied and enforced throughout the software development lifecycle. ... SaC automates security processes, such as vulnerability scanning, compliance checks, and configuration management, leading to increased agility and efficiency.

Robotics Reshaping Manufacturing and the Future of Work

The growing adoption of industrial robots is driven by a range of factors. Advances in sensors, computing power and AI are making robots more capable, flexible, and user-friendly. Labour shortages and rising wage costs in many countries are also spurring companies to automate more tasks, while the COVID-19 pandemic highlighted the resilience and efficiency benefits of robotic systems, accelerating automation plans in numerous industries. Recent advances in deep learning algorithms have also allowed robots to perform more complex tasks, with increasing numbers of industry leaders now predicting that the robotics industry is set to dramatically accelerate. “We have many partners developing applications using AI to allow our robots to perform more complex and diverse functions,” comments Anders Billesø Beck, Vice President of Strategy and Innovation at Universal Robots. “For example, AI allows robots to have human-like perception, handle variation, move parts precisely, adapt to changing environments, and learn from their own experience.

How Software Architecture Choices Impact Application Scalability, Resiliency and Engineering Velocity

As organizations grapple with how to tackle ATD and balance the trade-offs between architectures, the pivotal role of software architects becomes evident. However, the survey reveals a disconnect between architects, who are responsible for the long-term integrity of system architecture, and the modern DevOps processes that drive iterative software delivery. While C-suite leaders rank the enterprise architect as primarily responsible for addressing ATD within their organizations, engineering teams placed architects much lower on that list, below directors and engineering leadership. This fundamental lack of clarity around roles and responsibilities highlights the complexity of the issue within enterprises. ... To confront the mounting ATD crisis, organizations are turning to architectural observability. After being presented with a definition of architectural observability as "the ability to analyze applications statically and dynamically to understand their architecture, detect drift, and find/fix architectural debt", an overwhelming 80% of respondents acknowledged that having these capabilities would be extremely or very valuable within their organizations.

Quote for the day:

"The art of leadership is saying no, not yes. It is very easy to say yes." -- Tony Blair

Daily Tech Digest - June 01, 2024

AI Governance: Is There Too Much Focus on Data Leakage?

While data leakage is an issue it’s by no means the only one. GenAI stands apart due to its autonomous nature and its unique ability to create new content from the information it is exposed to, and this introduces a whole host of new problems. Data poisoning, for instance, sees a malicious actor intentionally compromise the data feed of the AI to skew results. This might involve seeding an LLM with examples of deliberately vulnerable code resulting in issues being adopted in new code. Without proper checks and balances in place, this could result in the poisoned data being pulled into organisational codebases via requests from developers. The code could then end up in production application and services which would be vulnerable to a zero-day attack. AI hallucinations, sometimes referred to as confabulations, are another issue. Unlike poisoning, this is the result of the AI’s autonomy which can see it make incorrect deductions based on the data its presented with. GenAI can and does make mistakes, and there are numerous notable examples here too.

12 Key AI Patterns for Improving Data Quality (DQ)

While there are many solutions and options to improve data quality, AI is a very viable option. AI can significantly enhance data quality in several ways. Here are 12 key use cases or patterns from four categories where AI can help in improving the data quality in business enterprises. ... Firstly, as LLMs such as ChatGPT and Gemini are trained on enormous amounts of public data, it is nearly impossible to validate the accuracy of this massive data set. This often results in hallucinations or factually incorrect responses. No business enterprise would like to be associated with a solution that has even a small probability of giving an incorrect response. Secondly, data today is a valuable business asset for every enterprise. Stringent regulations such as GDPR, HIPAA, and CCPA are forcing companies to protect personal data. Breaches can lead to severe financial penalties and damage to the company’s reputation and brand. Overall, organizations want to protect their data by keeping it private and not sharing it with everyone on the internet. Below are some examples of hallucinations from popular AI platforms.

Experts Warn of Security Risks in Grid Modernization

Experts recommend requiring comprehensive security assessments on all GETs and modern grid components. They say malicious actors and foreign adversaries already possess unauthorized access to many critical infrastructure sectors. The Cybersecurity and Infrastructure Security Agency has steadily released a series of alerts in recent months warning of a Chinese state-sponsored hacking group known as Volt Typhoon. The group is aiming to pre-position itself using "living off the land" techniques on information technology networks "for disruptive or destructive cyber activity against U.S. critical infrastructure in the event of a major crisis or conflict with the United States," according to CISA. "The Volt Typhoon alerts have said the quiet part out loud," said Padraic O'Reilly, chief innovation officer for the risk management platform CyberSaint Security. "The [threat] is in the networks, so new infrastructure must not allow for lateral movement on OT assets." Biden's federal-state grid modernization plan emphasizes the need to "speed up adoption and deployment" of GETs.

Corporations looking at gen AI as a productivity tool are making a mistake

Taking the time to focus on the bigger picture will set up organizations for more success in the future, Menon said. AI is transformational and requires a comprehensive reevaluation of current business processes, data strategies, technology platforms, and people strategies, Pallath said. “Implementing AI effectively necessitates simplifying and revamping business processes with an AI-first mindset,” Pallath said. “Effective change management and governance are crucial to ensure that the entire organization is prepared for and engaged in this transformation.” What often happens, he said, is that employees worry more about AI’s impact on their jobs, rather than how they can leverage the technology to help them work smarter, thereby hindering the necessary changes in process to make AI successful. Executive leadership and sponsorship are also critical. “AI initiatives need strong leadership support to overcome inertia and gain the necessary resources,” Pallath said. “Without a clear vision from the top, AI projects are more likely to get stalled or diluted.” A dedicated AI team headed by a chief AI officer can help ensure success.

Why HTML Actions Are Suddenly a JavaScript Trend

Actions in React look a lot like HTML actions, but they also look similar to event handlers like onsubmit, or unclick, Clark said. “Despite the surface-level similarities, though, actions have some important abilities that set them apart from regular event handlers,” he continued. “One such ability is support for progressive enhancement. Form actions in React are interactive before hydration occurs. Believe it or not, this works with all actions, not just actions defined on the server.” If the user interacts with a client action before it is finished hydrating, React will cue the action and replay as soon as it streams it, he said. If the user interacts with a server action, action can immediately trigger a regular browser navigation, without hydration or JavaScript. Actions also can handle asynchronous logic, he said. “React actions have built-in support for UX patterns like optimistic UI and error handling,” he said. “Actions make these complex UX patterns super simple by deeply integrating with React features like suspense and transitions.

Indonesia to Create 'Super Apps' to Run Government Services

The government has entrusted state-owned technology company Perum Peruri, commonly known as Peruri, with developing the new applications, digitizing government services and implementing the government's Electronic-Based Government System, which will run modernized applications and digital portals. ... The company said its rich history of developing high-security solutions makes it the ideal choice to lead the government's digital transformation program. "Peruri presents a fresh visual identity that illustrates how we are able to produce quality services to maintain the authenticity of products, identities and complex digital systems," said President and Director Dwina Septiani Wijaya. "The transformation process we are undergoing does not only focus on business and infrastructure, but we also understand the importance of quality human resources. ... The government's planned integration of government applications could make it easier for IT security teams to manage far fewer applications than before, but could also make the new super applications prime targets for hacking attacks considering the amount of public data they would process.

Within two years, 90% of organizations will suffer a critical tech skills shortage

Among the challenges organizations face when trying to expand the skills of their employees is resistance to training. Employees complain that the courses are too long, the options for learning are too limited, and there isn’t enough alignment between skills and career goals, according to IDC’s survey. ... IT leaders need to employ a variety of strategies to encourage a more effective learning environment within their organization. That includes everything from classroom training to hackathons, hand-on labs, and games, quests, and mini-badges. But fostering a positive learning environment in an organization requires more than just materials, courses, and challenges. Culture change begins at the top, and leaders need to demonstrate why learning matters to the organization. “This can be done by aligning employee goals with business goals, promoting continuous learning throughout the employee’s journey, and creating a rewards program that recognizes process as well as performance,” IDC’s report stated. “It also requires the allocation of adequate time, money, and people resources.”

RIG Model - The Puzzle of Designing Guaranteed Data-Consistent Microservice Systems

The RIG model sets the foundation for the saga design. It is founded in the CAP theorem and the work of Bromose and Laursen. The theoretical work results in a set of microservice categories and rules that the sagaS must comply with if we are to guarantee data consistency. The RIG model divides microservices behavior within a saga into three categories:Guaranteed microservices: Local transactions will always be successful. No business constraints will invalidate the transaction. Reversible microservices: Local transactions can always be undone and successfully rolled back with the help of compensating transactions. Irreversible microservices: Local transactions cannot be undone. ... A reversible microservice must include support for a compensating transaction and be able to handle an incoming "cancel transaction" message. When receiving a "cancel transaction" request, the microservice must "roll back" to the state before the saga. Handling compensating transactions in a reversible microservice must behave as a "Guaranteed" service.

3 reasons users can’t stop making security mistakes — unless you address them

People are naturally inclined to find the fastest possible route at work, and that often translates into taking shortcuts that compromise security for the sake of convenience. Even tech employees are not immune when, for example, importing libraries from public repositories assuming these are safe, as they continue to be used to distribute malware and steal passwords. To avoid these shortcuts that can threaten systems, CISOs can put automated MFA prompts in place to avoid risks due to compromised passwords and restrict access to services that could put data at risk, including generative AI or downloadable libraries of code. ... Users should use out-of-band communication for verification to deter attacks and scams. Contacting those businesses through a phone number or email previously established as legitimate is a good way to ascertain whether or not the message is authorized by the entity it claims. While CISOs can’t eliminate all human risk, they can significantly reduce incidents and promote a cyber-aware culture with a strategy that addresses the psychological drivers behind poor decisions.

Elevating Defense Precision With AI-Powered Threat Triage in Proactive Dynamic Security

AI-powered threat triage operates on the principle of predictive analytics, leveraging machine learning algorithms to sift through massive datasets and identify patterns indicative of potential security threats. By continuously analyzing historical data and monitoring network activity, AI systems can detect subtle anomalies and deviations from normal behavior that may signify an impending attack. Moreover, AI algorithms can adapt and learn from new data, enabling them to evolve and improve their threat detection capabilities over time. In the perpetual battle against an ever-expanding array of cyber threats, organizations are increasingly turning to innovative technologies to bolster their defenses and stay ahead of potential attacks. ... At the forefront of this technological revolution is the integration of Artificial Intelligence (AI) into threat triage processes, and the intricate dynamics of advanced algorithms and machine learning capabilities ushering in a new era of proactive defenses that explores the transformation of traditional cybersecurity strategies.

Quote for the day:

"A leadership disposition guides you to take the path of most resistance and turn it into the path of least resistance." -- Dov Seidman

Daily Tech Digest - May 31, 2024

Flawed AI Tools Create Worries for Private LLMs, Chatbots

The research underscores that the rush to integrate AI into business processes does pose risks, especially for companies that are giving LLMs and other generative-AI applications access to large repositories of data. ... The risks posed by the adoption of next-gen artificial intelligence and machine learning (AI/ML) are not necessarily due to the models, which tend to have smaller attack surfaces, but the software components and tools for developing AI applications and interfaces, says Dan McInerney, lead AI threat researcher with Protect AI, an AI application security firm. "There's not a lot of magical incantations that you can send to an LLM and have it spit out passwords and sensitive info," he says. "But there's a lot of vulnerabilities in the servers that are used to host LLMs. The [LLM] is really not where you're going to get hacked — you're going to get hacked from all the tools you use around the LLM." ... "Exploitation of this vulnerability could affect the immediate functioning of the model and can have long-lasting effects on its credibility and the security of the systems that rely on it," Synopsys stated in its advisory.

Cyber resiliency is a key focus for us: Balaji Rao, Area VP – India & SAARC, Commvault

Referring to the classical MITRE framework, the recommendation is to “shift right” – moving focus towards recovery. After thoroughly assessing risks and implementing various tools, it’s crucial to have a solid recovery plan in place. Customers are increasingly concerned about scenarios where both their primary and disaster recovery (DR) systems are compromised by ransomware, and their backups are unavailable. According to a Microsoft report, in 98% of successful ransomware cases, backups are disabled. To address this concern, the strategy involves building a cyber resilient framework that prioritises recovery. ... For us, AI serves multiple purposes, primarily enhancing efficiency, scanning for threats, and addressing customer training and enablement needs. From a security perspective, we leverage AI extensively to detect ransomware-related risks. Its rapid data processing capabilities allow for thorough scanning across vast datasets, enabling pattern matching and identifying changes indicative of potential threats. We’ve integrated AI into our threat scanning solutions, strengthening our ability to detect and mitigate malware by leveraging comprehensive malware databases.

The importance of developing second-line leaders

Developing second-line leaders helps your business unit or function succeed at a whole new level: When your teams know that leadership development is a priority, they start preparing for future roles. The top talent will cultivate their skills and equip themselves for leadership positions, enhancing overall team performance. As the cascading effect builds, this proactive development has a multiplicative impact, especially if competition within the team remains healthy. It's also important for your personal growth as a leader: The most fulfilling aspect is the impact on yourself. Measuring your leadership success by contribution, attribution, and legacy, developing capable successors fulfils all three criteria. It ensures you contribute effectively, gain recognition for building strong teams, and leave a lasting legacy through the leaders you've developed. ... It starts with the self. Begin with delegation without abdication or evasion of accountability. This skill is a cornerstone of effective leadership, involving the entrusting of responsibilities to others while empowering them to assume ownership and make informed decisions.

Navigating The AI Revolution: Balancing Risks And Opportunities

Effective trust management requires specific approaches, such as robust monitoring systems, rigorous auditing processes and well-defined incident response plans. More importantly, in order for any initiative to address AI risks to be successful, we as an industry need to build a workforce of trained professionals. Those operating in the digital trust domain, including cybersecurity, privacy, assurance, risk and governance of digital technology, need to understand AI before building controls around it. The ISACA AI survey revealed that 85% of digital trust professionals say they will need to increase their AI skills and knowledge within two years to advance or retain their jobs. This highlights the importance of continuous learning and adaptation for cybersecurity professionals in the era of AI. Gaining a deeper understanding of how AI-powered attacks are altering the threat landscape, along with how AI can be effectively utilized by security practitioners, will be essential. As security professionals learn more about AI, they need to ensure that the methods being deployed align with an enterprise’s overarching need to maintain trust with its stakeholders.

CISO‘s Guide to 5G Security: Risks, Resilience and Fortifications

A strong security posture requires granular visibility into 5G traffic and automated security enforcement to effectively thwart attackers, protect critical services, and safeguard against potential threats to assets and the environment. This includes a focus on detecting and preventing attacks at all layers, interface and threat vector — from equipment (PEI) and subscriber (SUPI) identification, applications, signaling, data, network slices, malware, ransomware and more. ... To accomplish the task at hand brought about by 5G, CISOs must be prepared to provide a swift response to known and unknown threats in real time with advanced AI and machine learning, automation and orchestration tools. As connotation shifts from viewing 4G as a more consumer-focused mobile network to the power of private 5G when embedded across enterprise infrastructure, any kind of lateral network movement can bring about damage. ... Strategy and solution start with zero trust and can go as far as an entire 5G SOC dedicated to the nuances brought about by the next-gen network. The change and progress 5G promises is only as significant as our ability to protect networks and infrastructure from malicious actors, threats, and attacks.

Cloud access security brokers (CASBs): What to know before you buy

CASBs sit between an organization’s endpoints and cloud resources, acting as a gateway that monitors everything that goes in or out, providing visibility into what users are doing in the cloud, enforcing access control policies, and looking out for security threats. ... The original use case for CASBs was to address shadow IT. When security execs deployed their first CASB tools, they were surprised to discover how many employees had their own personal cloud storage accounts, where they squirreled away corporate data. CASB tools can help security teams discover and monitor unauthorized or unmanaged cloud services being used by employees. ... Buying a CASB tool can be complex. There’s a laundry list of possible features that fall within the broad CASB definition (DLP, SWG, etc.) And CASB tools themselves are part of a larger trend toward SSE and SASE platforms that include features such as ZTNA or SD-WAN. Enterprises need to identify their specific pain points — whether that’s regulatory compliance or shadow IT — and select a vendor that meets their immediate needs and can also grow with the enterprise over time.

What is model quantization? Smaller, faster LLMs

Why do we need quantization? The current large language models (LLMs) are enormous. The best models need to run on a cluster of server-class GPUs; gone are the days where you could run a state-of-the-art model locally on one GPU and get quick results. Quantization not only makes it possible to run a LLM on a single GPU, it allows you to run it on a CPU or on an edge device. ... As you might expect, accuracy may be an issue when you quantize a model. You can evaluate the accuracy of a quantized model against the original model, and decide whether the quantized model is sufficiently accurate for your purposes. For example, TensorFlow Lite offers three executables for checking the accuracy of quantized models. You might also consider MQBench, a benchmark and framework for evaluating quantization algorithms under real-world hardware deployments that uses PyTorch. If the degradation in accuracy from post-training quantization is too high, then one alternative is to use quantization aware training.

Europe Declares War on Tech Spoofing

In the new Payment Services Regulation, members of the European Parliament argued that messaging services such as WhatsApp, digital platforms such as Facebook, or marketplaces such as Amazon and eBay could be liable for scams that originate on their platforms, on a par with banks and other payment service providers. ... Europe’s new payment regulations are now up for negotiation in Brussels. Large US tech firms and messaging apps are pushing to lower the liability risk. They argue banks, not them, should be responsible. With spoofing or impersonation scams, the fraudulent transaction occurs on banking service portals, not the platforms. And so, banks themselves should enhance their security measures or pay the price. Banks, not surprisingly, disagree. They cannot control the entry points that fraudsters use to reach consumers, whether it is by phone, messaging apps, online ads, or the dark web. Why shouldn’t telecom network operators, messaging, and other digital platforms also be obliged to avoid fraudsters from reaching consumers and if they fail, be held liable?

Process mining helps IT leaders modernize business operations

Process mining provides the potential to enable organizations make quicker, more informed decisions when overhauling business processes by leveraging data for insights. By using the information gleaned from process mining, companies can better streamline workflows, enhance resource allocation, and automate repetitive tasks. ... Successful deployment and maintenance of process mining requires a clear vision from the management team and board, Mortello says, as well as commitment and persistence. “Process mining doesn’t usually yield immediate, tangible results, but it can offer unique insights into how a company operates,” he says. “A leadership team with a long-term vision is crucial to ensure the technology is utilized to its full potential.” It’s also important to thoroughly analyze processes prior to “fixing” them. “Make sure you have a good handle on the process you think you have and the ones you really have,” Constellation Research’s Wang says. “What we see across the board is a quick realization that what’s assumed and what’s done is very different.”

Could the Next War Begin in Cyberspace?

In a cyberwar, disinformation campaigns will likely be used to spread misinformation and collect data that can be leveraged to sway public opinion on key issues, Janzen says. "We can build very sophisticated security systems, but so long as we have people using those systems, they will be targeted to willingly or unwillingly allow malicious actors into those systems." ... How long a cyberspace war might last is inherently unpredictable, characterized by its persistent and ongoing nature, Menon says. "In contrast to conventional wars, marked by distinct start and end points, cyber conflicts lack geographical constraints," he notes. "These battles involve continuous attacks, defenses, and counterattacks." The core of cyberspace warfare lies in understanding algorithms, devising methods to breach them, and inventing new technologies to dismantle legacy systems, Menon says. "These factors, coupled with the relatively low financial investment required, contribute to the sporadic and unpredictable nature of cyberwars, making it challenging to anticipate when they may commence."

Quote for the day:

"It's fine to celebrate success but it is more important to heed the lessons of failure." -- Bill Gates

Daily Tech Digest - May 30, 2024

Single solution for regulating AI unlikely as laws require flexibility and context

In drafting the AI Act – the world’s first major piece of AI legislation – with an “omnibus approach,” Mazzini says, the EU aimed for a blanket coverage that allows for few loopholes. It aims to avoid overlap with existing sectoral laws, which can be enforced in addition to the AI Act. With the exception of exclusions around national security, military and defense (owing to the fact that the EU is not a sovereign state), it “essentially covers social and economic sectors from employment to vacation to law enforcement, immigration, products, financial services,” says Mazzini. “The main idea that we put forward was the risk-based approach.” ... Kortz believes it is “unlikely that we will see a sort of omnibus, all-sector, nationwide AI set of regulations or laws in the U.S. in the near future.” As in the case of data privacy laws, individual states will want to maintain their established authority, and while Kortz says some states – “especially, I think, here, of California” – may try something ambitious like a generalized AI law, the sectoral approach is likely to win out.

Why Intel is making big bets on Edge AI

“Edge is not the cloud, it is very different from the cloud because it is heterogeneous,” she says. “You have different hardware, you have different servers, and you have different operating systems.” Such devices can include anything from sensors and IoT devices to routers, integrated access devices (IAD), and wide area network (WAN) access devices. One of the benefits of Edge AI is that by storing all your data in an Edge environment rather than a data center, even when large data sets are involved, it speeds up the decision-making and data analysis process, both of which are vital for AI applications that have been designed to provide real-time insights to organizations. Another benefit borne out of the proliferation of generative AI is that, when it comes to training models, even though that process takes place in a centralized data center, far away from users; inferencing – where the model applies its learned knowledge – can happen in an Edge environment, reducing the time required to send data to a centralized server and receive a response. Meanwhile, talent shortages, the growing need for efficiency, and the desire to improve time to market through the delivery of new services have all caused businesses to double down on automation.

Tensions in DeFi industry exposed by LayerZero’s anti-Sybil strategy

If identity protocols could eliminate Sybil farming and solutions already exist, why have they not already become standard practice? Cointelegraph spoke with Debra Nita, a senior crypto strategist at public relations firm YAP Global, to better understand the perceived risks that liveness checks might introduce to the industry. “Protocols may be reluctant to solve issues they face with airdrops using better verification processes — including decentralized ones — for reasons including reputational. The implications vary from the impact on community sentiments, key stakeholders and legal standing,” said Nita. Nita continued, “Verification poses a potential reputational problem, whereby it, from the outset, potentially excludes a large group of users.” Nita cited EigenLayer’s airdrop, which disqualified users from the United States, Canada, China and Russia despite allowing participation from these regions. This left a sour taste in the mouths of many who spent time and money on the platform only to receive no reward for their efforts.

Investing in employee training & awareness enhances an organisation’s cyber resilience

One essential consideration is the concept of Return on Security Investment (ROSI). Boards scrutinise security spending, expecting a clear demonstration of value. Evaluating whether security investments outweigh the potential costs of breaches is crucial. Therefore, investments should be made judiciously, focusing on technologies and strategies that offer substantial RoI. A key strategy is to consolidate and unify security technologies. Many organisations deploy a multitude of security solutions, often operating in silos. ... Furthermore, prioritising skill development is essential. With each additional technology, the demand for specialised expertise grows. Investing in training and development programs ensures that internal teams possess the necessary skills to effectively manage and leverage security solutions. Additionally, strategic partnerships with trusted vendors and service providers can augment internal capabilities and broaden access to specialised expertise. Ultimately, consolidating security technologies, focusing on ROI, and investing in skill development are key best practices for maximisng the effectiveness of existing security investments.

Modular, scalable hardware architecture for a quantum computer

To build this QSoC, the researchers developed a fabrication process to transfer diamond color center “microchiplets” onto a CMOS backplane at a large scale. They started by fabricating an array of diamond color center microchiplets from a solid block of diamond. They also designed and fabricated nanoscale optical antennas that enable more efficient collection of the photons emitted by these color center qubits in free space. Then, they designed and mapped out the chip from the semiconductor foundry. ... They built an in-house transfer setup in the lab and applied a lock-and-release process to integrate the two layers by locking the diamond microchiplets into the sockets on the CMOS chip. Since the diamond microchiplets are weakly bonded to the diamond surface, when they release the bulk diamond horizontally, the microchiplets stay in the sockets. “Because we can control the fabrication of both the diamond and the CMOS chip, we can make a complementary pattern. In this way, we can transfer thousands of diamond chiplets into their corresponding sockets all at the same time,” Li says.

NIST launches ambitious effort to assess LLM risks

NIST’s new Assessing Risks and Impacts of AI (ARIA) program will “assess the societal risks and impacts of artificial intelligence systems,” the NIST statement said, including ascertaining “what happens when people interact with AI regularly in realistic settings.” ... The first will be what NIST described as “controlled access to privileged information. Can the LLM protect information it is not to share, or can creative users coax that information from the system?” The second area will be “personalized content for different populations. Can an LLM be contextually aware of the specific needs of distinct user populations?” The third area will be “synthesized factual content. [Can the LLM be] free of fabrications?” The NIST representative also said that the organization’s evaluations will make use of “proxies to facilitate a generalizable, reusable testing environment that can sustain over a period of years. ARIA evaluations will use proxies for application types, risks, tasks, and guardrails — all of which can be reused and adapted for future evaluations.”

Researchers Detailed Modern WAF Bypass Techniques With Burp Suite Plugin

One of the key vulnerabilities Shah discussed is the request size limit inherent in many WAFs. Due to performance constraints, WAFs typically inspect only a portion of the request body. For instance, AWS WAFs inspect up to 8 KB for Application Load Balancer and AWS AppSync protections and up to 64 KB for CloudFront and API Gateway protections. Similarly, Azure and Akamai WAFs have their size limits, often leading to uninspected portions of large requests. This flaw can be exploited by placing malicious payloads beyond the inspection limit, bypassing the WAF. Shah introduced the nowafpls Burp Plugin to facilitate the exploitation of these request size limits. This tool simplifies the process by automatically padding out requests to exceed WAF inspection limits. Depending on the content type, the plugin inserts junk data at the cursor’s position, making it easier to bypass WAFs without manual intervention. For example, it adds comments in XML, junk keys and values in JSON, and junk parameters in URL-encoded data.

Four Essential Principles To Empower Your Decision-Making

First and foremost, write down your options. It's astonishing how tangled our thoughts can become when we don't have a clear view of our choices. By putting pen to paper, we untangle the knots and pave the way for clarity. Then comes the crucial shift from chasing perfection to embracing the best available option. Jeff Bezos' wisdom rings true here; waiting for 90% of the data often means missing out on opportunities. Sometimes, 70% is all we need to move forward. And once the decision is made, it's made. Dwelling on the "what-ifs" serves no purpose other than to tether us to the past. As Bezos famously put it, most decisions are reversible "two-way doors." So why let fear of making the wrong choice paralyze us? Indecision, I've learned, is its own form of suffering. Committing to a choice, even if it's not perfect, is infinitely more empowering than languishing in uncertainty. ... Decision-making, I've come to realize, is not an innate talent but a cultivated skill. It demands a shift in mindset, a commitment to better practices and a willingness to confront our own limiting beliefs.

How CPUs will address the energy challenges of generative AI

Industry AI alliances, such as the AI Platform Alliance, play a crucial role in advancing CPU technology for artificial intelligence applications, focusing on enhancing energy efficiency and performance through collaborative efforts. These alliances bring together a diverse range of partners from various sectors of the technology stack—including CPUs, accelerators, servers, and software—to develop interoperable solutions that address specific AI challenges. This work spans from edge computing to large data centers, ensuring that AI deployments are both sustainable and efficient. These collaborations are particularly effective in creating solutions optimized for different AI tasks, such as computer vision, video processing, and generative AI. By pooling expertise and technologies from multiple companies, these alliances aim to forge best-in-breed solutions that deliver optimal performance and remarkable energy efficiency. Cooperative efforts such as the AI Platform Alliance fuel the development of new CPU technologies and system designs that are specifically engineered to handle the demands of AI workloads efficiently.

Driving Business and Digital Transformation: The CIO Agenda for 2024 and Beyond

Business transformation is a comprehensive process that aims to enhance overall business performance by increasing revenue, reducing operating costs, improving customer satisfaction, and boosting workforce productivity. ... Digital transformation, on the other hand, focuses on integrating digital technologies into all aspects of a business, fundamentally changing how it operates and delivers value to customers. This transformation requires significant investments in technology and tech-enabled processes, driving innovation and operational efficiency. ... Business and digital transformation are complementary processes. While business transformation aims to enhance overall performance and achieve strategic goals, digital transformation provides the technological foundation and innovative capabilities necessary to drive these changes. ... In 2024, Chief Information Officers (CIOs) are at the forefront of driving AI and innovation-led digital business transformations. Their role has evolved from managing technology infrastructure to becoming strategic leaders who drive business transformation through digital innovation.

Quote for the day:

"Courage is doing what you're afraid to do. There can be no courage unless you're scared." -- Eddie Rickenbacker

Daily Tech Digest - May 29, 2024

Algorithmic Thinking for Data Scientists

While data scientists with computer science degrees will be familiar with the core concepts of algorithmic thinking, many increasingly enter the field with other backgrounds, ranging from the natural and social sciences to the arts; this trend is likely to accelerate in the coming years as a result of advances in generative AI and the growing prevalence of data science in school and university curriculums. ... One topic that deserves special attention in the context of algorithmic problem solving is that of complexity. When comparing two different algorithms, it is useful to consider the time and space complexity of each algorithm, i.e., how the time and space taken by each algorithm scales relative to the problem size (or data size). ... Some algorithms may manifest additive or multiplicative combinations of the above complexity levels. E.g., a for loop followed by a binary search entails an additive combination of linear and logarithmic complexities, attributable to sequential execution of the loop and the search routine, respectively.

Job seekers and hiring managers depend on AI — at what cost to truth and fairness?

The darker side to using AI in hiring is that it can bypass potential candidates based on predetermined criteria that don’t necessarily take all of a candidate’s skills into account. And for job seekers, the technology can generate great-looking resumes, but often they’re not completely truthful when it comes to skill sets. ... “AI can sound too generic at times, so this is where putting your eyes on it is helpful,” Toothacre said. She is also concerned about the use of AI to complete assessments. “Skills-based assessments are in place to ensure you are qualified and check your knowledge. Using AI to help you pass those assessments is lying about your experience and highly unethical.” There’s plenty of evidence that genAI can improve resume quality, increase visibility in online job searches, and provide personalized feedback on cover letters and resumes. However, concerns about overreliance on AI tools, lack of human touch in resumes, and the risk of losing individuality and authenticity in applications are universal issues that candidates need to be mindful of regardless of their geographical location, according to Helios’ Hammell.

Comparing smart contracts across different blockchains from Ethereum to Solana

Polkadot is designed to enable interoperability among various blockchains through its unique architecture. The network’s core comprises the relay chain and parachains, each playing a distinct role in maintaining the system’s functionality and scalability. ... Developing smart contracts on Cardano requires familiarity with Haskell for Plutus and an understanding of Marlowe for financial contracts. Educational resources like the IOG Academy provide learning paths for developers and financial professionals. Tools like the Marlowe Playground and the Plutus development environment aid in simulating and testing contracts before deployment, ensuring they function as intended. ... Solana’s smart contracts are stateless, meaning the contract logic is separated from the state, which is stored in external accounts. This separation enhances security and scalability by isolating the contract code from the data it interacts with. Solana’s account model allows for program reusability, enabling developers to create new tokens or applications by interacting with existing programs, reducing the need to redeploy smart contracts, and lowering costs.

3 things CIOs can do to make gen AI synch with sustainability

“If you’re only buying inference services, ask them how they can account for all the upstream impact,” says Tate Cantrell, CTO of Verne, a UK-headquartered company that provides data center solutions for enterprises and hyperscalers. “Inference output takes a split second. But the only reason those weights inside that neural network are the way they are is because of massive amounts of training — potentially one or two months of training at something like 100 to 400 megawatts — to get that infrastructure the way it is. So how much of that should you be charged for?” Cantrell urges CIOs to ask providers about their own reporting. “Are they doing open reporting about the full upstream impact that their services have from a sustainability perspective? How long is the training process, how long is it valid for, and how many customers did that weight impact?” According to Sundberg, an ideal solution would be to have the AI model tell you about its carbon footprint. “You should be able to ask Copilot or ChatGPT what the carbon footprint of your last query is,” he says.

EU’s ChatGPT taskforce offers first look at detangling the AI chatbot’s privacy compliance

The taskforce’s report discusses this knotty lawfulness issue, pointing out ChatGPT needs a valid legal basis for all stages of personal data processing — including collection of training data; pre-processing of the data (such as filtering); training itself; prompts and ChatGPT outputs; and any training on ChatGPT prompts. The first three of the listed stages carry what the taskforce couches as “peculiar risks” for people’s fundamental rights — with the report highlighting how the scale and automation of web scraping can lead to large volumes of personal data being ingested, covering many aspects of people’s lives. It also notes scraped data may include the most sensitive types of personal data (which the GDPR refers to as “special category data”), such as health info, sexuality, political views etc, which requires an even higher legal bar for processing than general personal data. On special category data, the taskforce also asserts that just because it’s public does not mean it can be considered to have been made “manifestly” public — which would trigger an exemption from the GDPR requirement for explicit consent to process this type of data.

Avoiding the cybersecurity blame game

Genuine negligence or deliberate actions should be handled appropriately, but apportioning blame and meting out punishment must be the final step in an objective, reasonable investigation. It should certainly not be the default reaction. So far, so reasonable, yes? But things are a little more complicated than this. It’s all very well saying, “don’t blame the individual, blame the company”. Effectively, no “company” does anything; only people do. The controls, processes and procedures that let you down were created by people – just different people. If we blame the designers of controls, processes and procedures… well, we are just shifting blame, which is still counterproductive. ... Managers should use the additional resources to figure out how to genuinely change the work environment in which employees operate and make it easier for them to do their job in a secure practical manner. Managers should implement a circular, collaborative approach to creating a frictionless, safer environment, working positively and without blame.

The decline of the user interface

The Ok and Cancel buttons played important roles. A user might go to a Settings dialog, change a bunch of settings, and then click Ok, knowing that their changes would be applied. But often, they would make some changes and then think “You know, nope, I just want things back like they were.” They’d hit the Cancel button, and everything would reset to where they started. Disaster averted. Sadly, this very clear and easy way of doing things somehow got lost in the transition to the web. On the web, you will often see Settings pages without Ok and Cancel buttons. Instead, you’re expected to click an X in the upper right to make the dialog close, accepting any changes that you’ve made. ... In the newer versions of Windows, I spend a dismayingly large amount of time trying to get the mouse to the right spot in the corner or edge of an application so that I can size it. If I want to move a window, it is all too frequently difficult to find a location at the top of the application to click on that will result in the window being relocated. Applications used to have a very clear title bar that was easy to see and click on.

Lawmakers paint grim picture of US data privacy in defending APRA

At the center of the debate is the American Privacy Rights Act (APRA), the push for a federal data privacy law that would either simplify a patchwork of individual state laws – or run roughshod over existing privacy legislation, depending on which state is offering an opinion. While harmonizing divergent laws seems wise as a general measure, states like California, where data privacy laws are already much stricter than in most places, worry about its preemptive clauses weakening their hard-fought privacy protections. Rodgers says APRA is “an opportunity for a reset, one that can help return us to the American Dream our Founders envisioned. It gives people the right to control their personal information online, something the American people overwhelmingly want,” she says. “They’re tired of having their personal information abused for profit.” From loose permissions on sharing location data to exposed search histories, there are far too many holes in Americans’ digital privacy for Rodgers’ liking. Pointing to the especially sensitive matter of childrens’ data, she says that “as our kids scroll, companies collect nearly every data point imaginable to build profiles on them and keep them addicted. ...”

Picking an iPaaS in the Age of Application Overload

Companies face issues using proprietary integration solutions, as they end up with black-box solutions with limited flexibility. For example, the inability to natively embed outdated technology into modern stacks, such as cloud native supply chains with CI/CD pipelines, can slow down innovation and complicate the overall software delivery process. Companies should favor iPaaS technologies grounded in open source and open standards. Can you deploy it to your container orchestration cluster? Can you plug it into your existing GitOps procedures? Such solutions not only ensure better integration into proven QA-tested procedures but also offer greater freedom to migrate, adapt and debug as needs evolve. ... As organizations scale, so too must their integration solutions. Companies should avoid iPaaS solutions offering only superficial “cloud-washed” capabilities. They should prioritize cloud native solutions designed from the ground up for the cloud, and that leverage container orchestration tools like Kubernetes and Docker Swarm, which are essential for ensuring scalability and resilience.

Why Testing Must Shift Left for Microservices

Shifting left is a cultural and practice shift, but it also includes technical changes to how a shared testing environment is set up. ... The approach scales effectively across engineering teams, as each team or developer can work independently on their respective services or features, thereby reducing dependencies. While this is great advice, it can feel hard to implement in the current development environment: If the process of releasing code to a shared testing cluster takes too much time, it doesn’t seem feasible to test small incremental changes. ... The difference between finding bugs as a user and finding them as a developer is massive: When an operations or site reliability engineer (SRE) finds a problem, they need to find the engineer who released the code, describe the problem they’re seeing, and present some steps to replicate the issue. If, instead, the original developer finds the problem, they can cut out all those steps by looking at the output, finding the cause, and starting on a fix. This proactive approach to quality reduces the number of bugs that need to be filed and addressed later in the development cycle.

Quote for the day:

"The best and most beautiful things in the world cannot be seen or even touched- they must be felt with the heart." -- Helen Keller