Daily Tech Digest by Kannan Subbiah

November 05, 2014

Remote working puts business data at risk, study shows
Banks said that – even though eight in ten of the employees interviewed read or write work emails on the move, and around seven in ten work on electronic documents outside their office – businesses fail to provide tools for secure remote working, or put the right security policies in place. Fewer than six in ten respondents said their organisation had a remote working policy. Of those that did have a policy, over a quarter admitted they had broken the policy to work remotely, either knowingly or unwittingly.

Using PouchDB for Offline/Data Sync
PouchDB offers not only client data replication to remote servers, but also provides a robust key/value data store for the browser as well. And not only the browser, but any JavaScript environment with disk access, including Node.js. The PouchDB web site has an introductory tutorial that steps you through the process of building a simple single page app (SPA). The app is modeled after the vanilla JavaScript implementation of the excellent TodoMVC benchmark for JavaScript frameworks. If you’re looking for a great comparison of SPA frameworks by the way, I’d highly recommend checking out TodoMVC.

Driving Innovation with IaaS
New technologies and service models can change how businesses operate, and become key drivers in innovation and cutting back operational expenditure. Infrastructure-as-a-Service (IaaS) is one such model where servers and other resources are provisioned as required over the cloud. This model provides self-service, on-demand access to IT resources, which means users can create and access tools they need within minutes, instead of days, weeks or months.

BlackEnergy cyberespionage group targets Linux and Cisco
Variants of the BlackEnergy plug-ins developed by the cyberespionage group were discovered for both Windows and Linux systems. They enhance the malware program with capabilities like port scanning, password stealing, system information gathering, digital certificate theft, remote desktop connectivity and even hard disk wiping. Different selections of plug-ins are deployed from command-and-control servers for every victim, depending on the group's goals and the victim's systems, the Kaspersky researchers said.

A CIO fights to keep his tech options open
"The impact on customer choice and negotiating positions" is very strong, he added. The concern about a narrowing of choices isn't limited to platforms. The industry consolidations resulting from mergers and acquisitions could lead to the discontinuation of development work on certain systems. "That may force us to switch tools and vendors," Spears said. The impact of consolidation can be particularly acute in certain markets. The banking sector, in particular, may be the canary in the coal mine that offers an early sign of the risks of IT consolidation.

AT&T, Others Launch OpenDaylight SDN Alternative
OpenDaylight has seen some recent momentum with two code releases, and heightened support from its own member companies. Brocade will ship this month an OpenDaylight-based SDN controller. And initial skeptics HP and Dell have raised their investment and participation in the effort. Like OpenDaylight, ONOS delivers an SDN control plane featuring northbound and southbound APIs, and a range of management, control, and service applications. Initially targeted to service providers, the community’s goal is to extend the platform for cloud service providers, enterprises and mainstream deployments.

The Only Way to Save Your CRM from Failure
Data also decays naturally, compounding the effect of human error. Estimates put the rate of data decay at around 2 percent per month. It is a completely natural process, and it is unavoidable. As your contacts change jobs, get married, change email addresses or get promoted, your CRM will start to lose track. Looking closely at CRM failure rates, we have a range of statistics to work from. C5 Insight estimates that the failure rate of CRM software is around 16 percent. It says that this figure is “optimistic”, and puts its own estimates at 38 percent.

Despite skeptics, security awareness training for employees is booming
"Effective education is a non-trivial thing, and it takes a very solid understanding of the audience and how you're going to measure the effectiveness of that education," said Walls. "Within the industry, the history of security education has ignored all that. It doesn't worry about impact; it doesn't worry about [asking] 'Is this effective?' "As a result, the word on the street is that security training isn't worth the time and money," Walls continued. "It's the classic syndrome of blaming the tools … the fault lies with you, not the audience."

Why coding's cool for school
There are some initiatives leading the way here. Google's Made with Code, for example, provides great inspiration for young women by showcasing the diverse career routes taken by those with an interest in tech. And Capability Jane is another notable organisation, aiming to improve diversity across sectors by encouraging businesses to hire working mothers on a more flexible basis. Such initiatives are crucial in encouraging the next generation of young women to study STEM subjects with a view to a career in tech.

A Look at ETW – Part 3
Although a strength of ETW is its strongly-typed events, after seeing several examples which use more “generic” events yet still benefit from ETW and its tooling, I’m going to try that and go with a few general-purpose events. Several of the logging frameworks use the concept of “category” (or a dictionary of categories), so I’ve decided that might be useful here too. Since I want to trace both methods and code blocks I use “Action” and “actionName” to designate either. I also want to make timing optional: ETW events have a high-resolution timestamp and some tools will pair up start/stop events, so doing my own timing isn’t always necessary.

Quote for the day:

"Doing the same thing over and over, yet expecting different results, is the definition of crazy." -- Unknown

November 04, 2014

How Smart, Connected Products Are Transforming Competition
Some have suggested that the internet of things “changes everything,” but that is a dangerous oversimplification. The rules of competition and competitive advantage still apply. ... The increasing capabilities of smart, connected products not only reshape competition within industries but expand industry boundaries. This occurs as the basis of competition shifts from discrete products, to product systems consisting of closely related products, to systems of systems that link an array of product systems together. A tractor company, for example, may find itself competing in a broader farm automation industry.

Gartner Hype Cycle: Exploring the leading-edge technologies for a digital business
"Skinput provides a new input technique based on bioacoustic sensing technology that allows the skin to be used as a finger input surface." Tapping your skin in various places creates distinct acoustic signals, which sensing devices can pick up. The software can process differences based on bone density, size, and effects produced by soft tissues and joints. "Interactive capabilities can be linked to different locations on the body." Skinput is a 21st century approach to the classic computing notion of input.

An open source ERP system built to self-implement
Another key aspect of the industry is that users would need an IT consulting company to implement and customize an ERP. We want to change that. ERPs should be simple enough to be self-implemented. This is why users are selecting ERPNext over other alternatives, because we are completely focused on the do-it-yourself user. There are a couple of good open source ERPs out there, but they are still hard to configure and need a partner to help you get started.

Information Security - Cost Analysis
In the best interests of the investors, any spending or investment should be backed up with an appropriate cost-benefit analysis. Applying this cost-benefit-justifications to Information Security function is gaining focus but remains a challenge. Quantification forms the basis for being able to perform the cost-benefit analysis. The advantages of quanti fication are its accuracy, objectivity, and comparability. In addition, quanti cation is the basis for calculations and statistical analyses. While costing is a comparatively easier aspect, quantifying the benefits is still a challenge as it depends on the occurrence of uncertain events.

Collection Pipeline
Collection pipelines are a programming pattern where you organize some computation as a sequence of operations which compose by taking a collection as output of one operation and feeding it into the next. (Common operations are filter, map, and reduce.) This pattern is common in functional programming, and also in object-oriented languages which have lambdas. This article describes the pattern with several examples of how to form pipelines, both to introduce the pattern to those unfamiliar with it, and to help people understand the core concepts so they can more easily take ideas from one language to another.

A Brain-Inspired Chip Takes to the Sky
The first time the drone was flown into each room, the unique pattern of incoming sensor data from the walls, furniture, and other objects caused a pattern of electrical activity in the neurons that the chip had never experienced before. That triggered it to report that it was in a new space, and also caused the ways its neurons connected to one another to change, in a crude mimic of learning in a real brain. Those changes meant that next time the craft entered the same room, it recognized it and signaled as such.

The next wave of IT fadeouts
IT and its hosting enterprises have passed through monumental changes over the past decade. Through it all, CIOs have maintained a strategic eye on 'next thing' technologies. However, with relatively flat IT budgets, they have also looked for IT investments that are on the decline. Some of these technology 'fadeouts' are internal approaches to IT and general business operations and management that just don't seem to work well any more. Others involve a particular technology solution that has seen its day. ... What are the likely technology fadeouts?

Why LinkedIn’s data science reorg actually makes a lot of sense
And no, the shakeup hasn’t brought product innovation to a halt. Employees still get one “InDay” per month to do things they don’t ordinarily do. Look, for instance, at a project Lutz did a few months ago, right after the reorg happened. Finger, who generally does work for internal consumption, used LinkedIn’s vast supply of information on users to predict the career trajectory of a reporter at Mashable. “It was just an idea,” Finger said. His colleagues thought it was awesome, he said, and supported it.

Forecast 2015: IT spending on an upswing
When it comes to new technology, business leaders don’t know what they don’t know, he says. Therefore, it’s part of his innovation strategy to make all parts of the organization aware of new technologies that can improve business processes and bring in new customers. And why not? With the economy slowly improving, IT leaders are more optimistic that corporate purse strings will loosen up in 2015, and they’re eager to bring new technologies into the fold in addition to just keeping the lights on.

Updated Principles of Service Orientation
A SO ecosystem is “a space in which people, processes and machines act together to deliver those capabilities as services”. In a SO ecosystem, “there may not be any single person or organization that is really ‘in control’ or ‘in charge’ of the whole” ecosystem. Services in the SO ecosystem are the means by which “the needs of a consumer are brought together with the capabilities of a provider”. Services are the realization of business functionality accessible through defined service interfaces.

Quote for the day:

"Our expectation in ourselves must be higher than our expectation in others." -- Victor Manuel Rivera

November 03, 2014

Look at what Google and Amazon are doing with databases: That's your future
"The era of the one-size-fits-all database is over. It used to be when I grew up as a developer that for the architect in the project, when it came to choosing the bottom layer of the stack — the persistence layer — the choice was Microsoft, or IBM, or Oracle, or Sybase. It was a vendor choice," he said. "They were all the same type of database. But that era has gone forever and it will never come back because data is just so big and so irregularly shaped now that you're always going to be able to get a hundred times improvement, a thousand times improvement, a million times improvement if you get a data technology that is shaped like the shape of your data.

It’s Not HR’s Job to Be Strategic
Companies will really start feeling the consequences over the next decade. Millennial Branding and Monster.com found that one-third of Millennials rank training and development opportunities as a prospective employer’s top benefit. Cutting corners in this area may jeopardize employee engagement and retention in a demographic that will represent 75% of the U.S. labor force by 2025. A centralized HR department is ill equipped to address this. But embedding learning and development — along with talent acquisition — within each business function can solve the problem because it will shift the focus from cost reduction to value creation.

When It’s Sink or Swim
Walking away from a two-year project that’s at 200% of budget, yet seems 2% away from the finish line, is a tough call to make and is no small admission of misspent resources. But, even worse, what if the new approach were to fail at its own 95% point? What then? The company weighed the risk factors of each choice, gave us leash to further prove our new technology stack, and made the decision to switch platforms. Ultimately, time was the enemy posing the greatest threat, and they had to stand up a robust product soon. Fast-forward eight weeks and finally they had their “Netflix” platform, a stable, fully functioning health information exchange.

Where the data science jobs are, by sector and by state
The data science meme has been trending for several years now. Nearly everyone wants to be a data scientist, talk to a data scientist, hire a data scientist or invest in a data science startup. But where are all those data scientists working? And what are they working on? A good place to get a handle on the data science sector is Data Science Central, one of the industry’s leading data science community sites and blogs. It’s the online watering hole for data scientists and its edited and run by Vincent Granville.

8 Strategies to Fund Your New Business
As many first-time entrepreneurs know, or have found out, getting a traditional bank or even an SBA loan to start a new business isn't easy. So where else can you go to fund your dream? Fortunately, today entrepreneurs have many options than ever when it comes to funding their new business or business idea, many of which are less difficult to obtain and less expensive than a bank loan. Here are eight strategies for financing a new business, product or service.

Your 2015 IT Security Plan: What You Need to Know
Over 80 percent answered that IT departments actually felt secure with the technology that they had in place, but they feared what end users might do, either intentionally (example: Edward Snowden) or unintentionally (example: CryptoLocker). The response was that, although IT departments are the focus of where to combat the new threats, it’s the actions of end users that are often the root cause of the problem. Despite the great innovation in newer security products, the industry itself is still in a reactionary mode, responding to modern threats rather than being a step ahead. Therefore, while the technology is important, other areas of the business need to be addressed in order to make a company more secure.

Does the internet need rebooting?
Perrig has now developed a network architecture with his team that may enable all these drawbacks to be remedied. This concept, called Scion, is not only supposed to make the internet safer, but also more straightforward and efficient. The central idea is to divide the internet into several independent units, so-called “isolation domains”. In every domain, the autonomous systems themselves control the paths along which they exchange data. Therefore, autonomous systems in Domain 1 no longer have an influence on the data traffic in Domain 2 and vice versa. Of course, a global data exchange is also possible with this new structure – via so-called edge routers at the boundaries of the individual domains.

Data retention won't catch terrorists without big data strategy
The real crux of big data analysis is to look for patterns and for testing hypotheses. We should also remember that predictive analytics techniques are not perfect by definition, i.e. they have to be coupled with other intelligence and research. Finally, it's a hard sell to believe a tech-savvy terrorist would use the same IP address or the same mobile phone that they used a year ago. Once people learn about the legislation, it won't be difficult for them to bypass the system. A better solution would be for the federal government to work with telcos and ISPs on real-time anomaly data detection techniques by enabling/funding them to deploy big data techniques within their firms.

The Ethics of Data, Visualized [INFOGRAPHIC]
In all, the biggest problem with data collection for most people is this: they didn't know it was happening. For better or worse, understanding around what type of data is being collected and how it is being used is relatively low. And, because of this, many companies easily sneak data collection methods into Terms of Service agreements most users never read, or wouldn't fully understand if they did. What we are lacking here in transparency and accountability in data collection and use. And this is a big deal, because much of this data is personal, non-anonymous and can be hacked, stolen or used to discriminate against particular groups or segments.

What's new with Java
Unsigned applets run in a Java sandbox, walled off from the host system. Although the sandbox is far from perfect, reasonable people might consider applets confined to a sandbox safer. Oracle considers them more dangerous. In my opinion, they are placing way too much faith in the Certificate Authority system. Nonetheless, because Oracle thinks they are a greater security risk, they make it harder to run an unsigned applet than a signed one. The other big factor in running applets is the Java security level. Java 7 has three security levels, Java 8 (as of Update 20) has only the two highest levels from Java 7. Both versions of Java default to the second highest level, which Oracle calls "high".

Quote for the day:

"Nothing is easier than saying words. Nothing is harder than living them day after day." -- Arthur Gordon

November 02, 2014

The Minimum Viable Product and Incremental Software Development
The MVP is used in the context of the “build-measure-learn” feedback loop. From the Lean Startup site: “The first step is figuring out the problem that needs to be solved and then developing a minimum viable product (MVP) to begin the process of learning as quickly as possible. Once the MVP is established, a startup can work on tuning the engine. This will involve measurement and learning and must include actionable metrics that can demonstrate cause and effect question.” Now the question is: What is the right way to build the MVP? Of course we should adopt some form of incremental development, in which the MVP should be concluded after a few initial iterations.

Introducing Pair Programming
In an environment where every line of code is reviewed as it is written, code quality goes up dramatically. The quality of the code review gets increased because the reviewer is fully in the context of the code and actively participating in its formation. Several studies such as this one by Alistair Cockburn and Laurie Williams have compared side by side code written in pairs vs code written solo, and concluded that the paired code had fewer defects, and better design than the soloed code. In the Cockburn and Williams study, the paired programs were "consistently 20 percent shorter than their individual counterparts, indicating a more elegant and maintainable solution."

Random Image Experiment Reveals The Building Blocks of Human Imagination
Here’s a curious experiment. Take some white noise and use it to produce a set of images that are essentially random arrangements of different coloured blocks. Show these images to a number of people and ask whether any of the images remind them of, say, a car. Most of the time, these random images will appear to people as, well, random. But every now and again somebody will say that an image does remind them of a car. Set this image aside. And repeat. After assessing, say, 100,000 images in this way, you’ll end up with a set of essentially random pictures that remind people of cars.

You’ve Got To Admit It’s Getting Better
Even test-driven development — the notion that a development team’s automated tests are even more important than the actual software they write, and should be written first — is being criticized. Once this belief seemed almost sacrosanct (although in my experience most of the industry paid it only lip service.) Now, though, Pieter Hintjens argues, “The more you test software, the worse it will be.” Peter Sargeant agrees: “The whole concept of Test-Driven Development is hocus, and embracing it as your philosophy, criminal.”

The 5 Most Common Data Relationships Shown Through Visualization
As the amount of data available to organizations and marketing departments grows, visualizations of that data are growing more complex. That’s not to say that data visualizations are becoming unwieldy – quite the opposite. The increasing amount of information being displayed in visual form helps viewers understand the often convoluted relationships between ranges of data. However, when presented with the choice to visually represent data relationships, it can be difficult to choose which model to apply. Different types of data work better with specific visualization models.

Eight Docker Development Patterns
A foundation for all of my Docker experiments, is keeping state that should persist in volumes, so that the Docker containers themselves can be re-created at will without data loss (unless I've been naughty and modified container state without updating the Dockerfile's - and regularly rebuilding the containers helps stop that bad habit). The examples Dockerfiles below are all focused on that: Creating containers where the containers themselves can be replaced at any time without having to think about it. The more regularly the containers are recreated; the more habitual this becomes, the more it reinforces a habit of avoiding state outside of clearly defined locations that are explicitly persisted.

Foundations of Data Science
The field of algorithms has traditionally assumed that the input data to a problem is presented in random access memory, which the algorithm can repeatedly access. This is not feasible for modern problems. The streaming model and other models have been formulated to better reflect this. In this setting, sampling plays a crucial role and, indeed, we have to sample on the fly. in Chapter we study how to draw good samples efficiently and how to estimate statistical, as well as linear algebra quantities, with such samples.

The Potential Of Beacon Technology
Beacons are a unique and sophisticated tool in the world of merchandising and advertising. However, if we take a step back and think about exactly how beacons are reaching retail locations, there is reason for concern rather than excitement. Currently, beacon networks are fragmented and closed. At quick glance, this may not be a concern, but thinking ahead, this fragmentation will likely result in long-term negative implications for consumers, retailers and developers alike. An analogy for beacon technology is GPS. Since its inception, GPS technology has always been an “open system” onto which developers could innovate and extend new product applications.

Exploring the Hexagonal Architecture
A hexagonal architecture has three layers with the key part being the Domain model containing all the logic and rules of the application. No technology concerns, e.g. HTTP contexts or database calls, are referenced in the domain, allowing changes in technology to be made without affecting the domain. Around the domain model is the Ports layer receiving all requests that corresponds to a use case that orchestrates the work in the domain model. The ports layer is a boundary with the domain on the inside and external entities on the outside.

Oxford Economics Study Reveals EMEA Companies Unprepared for Workforce 2020
All of this isn’t to say that EMEA-based companies aren’t taking steps to address the top issues of the future workforce. “Workforce development is seen by the board as a strategic priority as it’s critical to meeting corporate objectives and growing the business,” said Kevina Wepukhulu, Chief Manager, Human Resource and Administration, Kenya Power and Lighting Co. “The effort is arrayed around key areas, including strategies for systems, for the organization, and for teams and individuals. The approach is based on learning and development, which enables us to retain the workers we hire and train.”

Quote for the day:

"Great leaders use delegation as a time management tool for themselves and as a development tool for their team." -- @ManagersDiary

November 01, 2014

How Streaming Analytics Detects Fraud and Keeps Customers Happy
The most challenging aspect of fraud prevention is detecting it as it occurs across the entire account base. Because hackers can fleece individual accounts within seconds of infiltration on a large scale, if your security systems can’t detect fraudulent behavior within individual accounts in real-time, you are essentially compounding your losses with each passing second. With streaming analytics, banks can continuously ingest, correlate, enrich, and analyze streams of data across diverse sources – including third parties – to immediately spot anomalies indicating fraud down to the second of occurrence and implement immediate automated remediation measures.

The Periodic Table of IoT
The promise of connecting devices across homes, retail stores, automobiles, and physical machinery, otherwise referred to as the Internet of Things, has emerged into what is now a substantial ecosystem of private companies, corporations, venture investors and acquirers. ... we’re excited to introduce the Periodic Table of IoT (Internet of Things) – a guide to help make sense of the key players in the growing Internet of Things universe. The 141 companies, investors and acquirers on the list were drawn from analysis using CB Insights data around financial health, company momentum, investor quality and M&A activity.

The 1s and 0s behind cyber warfare
Chris Domas is a cybersecurity researcher, operating on what's become a new front of war, "cyber." In this engaging talk, he shows how researchers use pattern recognition and reverse engineering (and pull a few all-nighters) to understand a chunk of binary code whose purpose and contents they don't know.

Why Microsoft loves Linux
Nadella admitted that 20 percent of the operating systems on Azure are Linux. The open-source operating system is already contributing a lot to Microsoft's bottom line. Today, Azure — while it doesn't support the top business Linux, Red Hat Enterprise Linux (RHEL) — already supports CoreOS Linux, CentOS, Oracle Linux, SUSE, and Ubuntu on Azure. ... It's not just Linux that Microsoft loves. After decades of resistance, Microsoft supports a variety of open-source programs such as the big data Hadoop; Docker containers; and Facebook's Open Compute datacenter project. Indeed, Microsoft is even open-sourcing more of its own technologies such as parts of .Net.

Security vendor coalition cleans 43,000 malware infections used for cyberespionage
So far the vendors’ disruptive action called Operation SMN resulted in the removal of 43,000 instances of malicious tools installed by the Axiom attackers on compromised computers, according to a full report published Monday by Novetta, the data analytics firm that led the coalition. The clean-up effort was done through Microsoft’s Malicious Software Removal Tool (MSRT), which is updated and distributed through Windows Update monthly, and through the security products of other vendors involved in the operation. One hundred eighty infections were instances of Hikit, a malware program used by Axiom for data exfiltration and persistence during the last stages of its attacks, Novetta said.

Data Science 101: Scalable Machine Learning with Apache Spark
In the presentation below, courtesy of the SF Machine Learning Meetup group in San Francisco, Xiangrui Meng introduces Spark and show how to use it to build fast, end-to-end machine learning workflows. Using Spark’s high-level API, you can process raw data with familiar libraries in Java, Scala or Python (e.g. NumPy) to extract the features for machine learning. Then, using MLlib, its built-in machine learning library, you can run scalable versions of popular algorithms. The talk also covers upcoming development work including new built-in algorithms and R bindings.

Learn to Boost Data Center Capacity With Public Cloud
Without a doubt, one of the most powerful benefits of cloud computing is the ability to extend the existing environment beyond the current datacenter walls. Administrators are able to do more with less as cloud computing components have become much more affordable. Now that both unified computing and WAN-based solutions have come down in price, IT environments are quickly seeing the direct benefits that cloud computing can bring to an organization.

Backup and restore of MySQL to OpenStack Swift
xbcloud uploads and downloads full or part of xbstream archive to/from OpenStack Swift. So what is xbstream? xbstream is a streaming format available in Percona XtraBackup that overcomes some limitations of traditional archive formats such as tar, cpio and others which did not allow streaming dynamically generated files, for example dynamically compressed files. Archive uploading will employ multipart upload for Large Objects on Swift. Along with this, the xbstream archive index file will be uploaded which contains list of files and their parts and offsets of those parts in xbstream archive. This index is needed for downloading only part of archive on demand.

Major banks ready their own mobile payment apps
The most likely way will be through a technology called host card emulation, that was introduced in Android 4.4 “KitKat” and allows software apps to emulate the secure element chip found on some bank cards and the iPhone 6. Using software means wider compatibility with phones than if a dedicated chip was required. The mobile payments market had been relatively quiet until recently. Google Wallet and Softcard, a competitor backed by cellular carriers, were in the market but consumer awareness and interest appeared to be low.

Drupal warns unpatched users: Assume your site was hacked
"Attackers may have copied all data out of your site and could use it maliciously," the Drupal security team said. "There may be no trace of the attack." The vulnerability also allows the installation of multiple backdoors in the site's database, code, file directories and other locations and it's impossible for an administrator to say with complete confidence that all of them were found. Attackers may use such backdoors to attack and compromise other services on the underlying Web server, allowing them to expand their access beyond the website itself, the Drupal security team said.

Quote for the day:

“I suppose it is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail.” -- Abraham Maslow