Daily Tech Digest - November 23, 2019

Cheap 5G phones won't come to the masses until these things happen first

One reason why 5G phones cost so much is that the chips cost more, too. Without a 5G-ready chip that can talk to the carrier network, your phone can never reach those lightning speeds.  Right now, these 5G chips are tailor-made to each carrier's particular wireless spectrum. So even if you buy the Galaxy S10 5G for AT&T, 5G data won't necessarily work on T-Mobile, Verizon or Sprint. Making 5G phones more or less bespoke to each carrier requires extra time and expense to develop, test and deploy. ... Separate 5G chipsets and modems may not be the norm for long. Qualcomm is working on a way to integrate the two into a single unit. The world's largest mobile chipmaker also plans to eventually make 5G available on multiple carrier bands. Both these changes will simplify what it takes to build a 5G phone, which in turn should make them cheaper to make and maintain. Competition will also help lower the price, especially if players like MediaTek, known for undercutting Qualcomm on processors and modems, can target the 5G midrange chipset market abroad. Qualcomm itself is also committed to making a midrange 5G processor for cheaper phones.

5G: A transformation in progress

The road to 5G began back in 2015, with the ITU's IMT-2020 framework, which set out the general requirements and future development of the next-generation mobile technology (IMT stands for International Mobile Telecommunications) ... The ITU's broad goal for IMT-2020/5G was to accommodate "new demands, such as more traffic volume, many more devices with diverse service requirements, better quality of user experience (QoE) and better affordability by further reducing costs". The key driver for this effort was the need to "support emerging new use cases, including applications requiring very high data rate communications, a large number of connected devices, and ultra-low latency and high reliability applications" ... According to the GSA's latest (January 2019) figures, eleven operators claim to have launched 5G services (either mobile or FWA): AT&T (USA), Elisa (Finland and Estonia), Etisalat (UAE), Fastweb (Italy), LG Uplus (South Korea), KT (South Korea), Ooredoo (Qatar), SK Telecom (South Korea), TIM (Italy), Verizon (USA), and Vodacom (Lesotho). 

Target Sues Insurer Over 2013 Data Breach Costs

In its lawsuit, Target argues that its general liability policy with ACE covers property damage that includes "loss of tangible property that is not physically injured." This, according to Target's lawsuit, includes the replacement of those payment cards because they were "damaged" by the 2013 and could no longer be used. "ACE has refused to acknowledge coverage for the payment card claims and has further disregarded its contractual obligation to indemnify Target for the settlement payments relating to the payment card claims," according to the lawsuit. "ACE has improperly refused to indemnify Target for settlement payments falling within its aggregate coverage layer." ... A Target spokesperson told Information Security Media Group that the company had been negotiating with ACE for a year over this issue before deciding to file the lawsuit in federal court earlier this month. "We believe the costs are covered within the scope of the insurance policy Target has with ACE and are focused on resolving the outstanding claim," the Target spokesperson says.

Extreme targets data center automation with software, switches

Extreme Fabric Automation is hosted as an application on a guest virtual machine of the two new switches, providing on-premises and private-cloud deployment options, said Dan DeBacker, director of product management at Extreme. “The idea is to remove the need for IT to have to do manual switch-by-switch configurations,” he said. In addition, the software gives IT teams the ability to scale the network up and down to meet changes in demand, and it reduces the cost of operating the network. For those using the guest VM, it eliminates the need for an external server, DeBacker said. The Extreme Fabric Automation package now integrates with orchestration software including OpenStack, VMware vCenter, and Microsoft System Center Virtual Machine Manager (SCVMM). Each integration is a separate microservice and additional integrations will be available in future releases of the software, Extreme said. The orchestration software further automates network configuration, coordination, and management of resources, DeBacker said.

Why SaaS-based AI training will be a game changer

What strikes me about this approach to AI training is that you need a sound training data set. In some cases, it can be obtained from open or proprietary training data brokers. In most instances, you format your own data to train the machine learning model. However, what if other trained machine learning models could train models, anywhere and any time? The idea is not new. Since the advent of AI we’ve toyed with the idea of having one AI engine teach another, either by sharing training data or, better yet, sharing knowledge and experience through direct, automatic interaction. Having one AI engine mentor yours provides outside experience and thus makes the AI model more valuable and effective. This is easier said than done. Machine learning engines typically don’t talk to each other, even if they are the same software. They are designed from the ground up to be stand-alone learners and interact with non-AI systems or humans. However, inter-AI engine training is on most vendor radar screens.

BankThink Charter or not, fintechs are already ‘banking’

Despite these challenges, many fintechs (Varo Money, LendingClub, OnDeck, Robinhood, Square and Revolut, among others) are actively trying to become some type of a bank. The reasons they want to be a “real” bank are obvious. Licensed banks in the U.S. get extremely valuable privileges, including direct access to the payments system, low-cost deposits, stable funding and a national platform to preempt conflicting state laws. This would be especially valuable for fintech lenders and payments innovators. But no one has made it to the goal line yet. What about the contradictory proposition that, today, anyone can be a fintech bank? Just look around. So many fintech and big tech companies have created so-called synthetic banks. These are companies that provide insured checking and savings accounts, payment cards and most of the capabilities of a traditional consumer bank without actually being a licensed bank

Cybersecurity: Are your payments systems fortified against a growing threat?

Lack of adequate defenses against cyberattacks can render all other efforts to maximize working capital moot. For many companies, the loss of working capital, which essentially is a measure of a company’s liquidity and short-term financial picture, could be crippling, or even force a sale. Therefore, it’s vitally important that businessowners understand the nature of the threat companies face in general and work with their bank to implement financial solutions to safeguard their working capital. While breaches of large companies are regularly in the news, those of smaller enterprises don’t typically receive media attention. However, sophisticated criminals are actively infiltrating and stealing large sums of money from companies of all sizes. These attacks are an expensive problem for victimized companies. The average reported cost for a compromise at small and midsized companies was $1.24 million for the fiscal year ended Sept. 30, up 24% from the same period two years ago, according to research firm Ponemon Institute. The average cost for business disruption rose to $1.9 million, up 57%, during the same period.

Sacha Baron Cohen gave the greatest speech on why social networks need to be kept in check

Facebook, YouTube and Google, Twitter and others—they reach billions of people. The algorithms these platforms depend on deliberately amplify the type of content that keeps users engaged—stories that appeal to our baser instincts and that trigger outrage and fear. It's why YouTube recommended videos by the conspiracist Alex Jones billions of times. It's why fake news outperforms real news, because studies show that lies spread faster than truth. And it's no surprise that the greatest propaganda machine in history has spread the oldest conspiracy theory in history—the lie that Jews are somehow dangerous. As one headline put it, "Just Think What Goebbels Could Have Done with Facebook." On the internet, everything can appear equally legitimate. Breitbart resembles the BBC. The fictitious Protocols of the Elders of Zion look as valid as an ADL report. And the rantings of a lunatic seem as credible as the findings of a Nobel Prize winner. We have lost, it seems, a shared sense of the basic facts upon which democracy depends.

Ghost ships, crop circles, and soft gold: A GPS mystery in Shanghai

Nobody knows who is behind this spoofing, or what its ultimate purpose might be. These ships could be unwilling test subjects for a sophisticated electronic warfare system, or collateral damage in a conflict between environmental criminals and the Chinese state that has already claimed dozens of ships and lives. But one thing is for certain: there is an invisible electronic war over the future of navigation in Shanghai, and GPS is losing. ... In fact, something far more dangerous was happening, and the Manukai’s captain was unaware of it. Although the American ship’s GPS signals initially seemed to have just been jammed, both it and its neighbor had also been spoofed—their true position and speed replaced by false coordinates broadcast from the ground. This is serious, as 50% of all casualties at sea are linked to navigational mistakes that cause collisions or groundings. When mariners simply lose a GPS signal, they can fall back on paper charts, radar, and visual navigation. But if a ship’s GPS signal is spoofed, its captain—and any nearby vessels tracking it via AIS— will be told that the ship is somewhere else entirely.

Federal Reserve Report Raises Concerns About 'Stablecoins'  

While the Federal Reserve report acknowledges that stablecoins offer innovation in the global financial payment systems, it notes that without proper regulation and controls, these virtual currencies can lead to financial instability as well as security issues. "The possibility for a stablecoin payment network to quickly achieve global scale introduces important challenges and risks related to financial stability, monetary policy, safeguards against money laundering and terrorist financing, and consumer and investor protection," the report states. And while the Federal Reserve report did not offer specific policy recommendations, James Wester, an analyst at IDC who studies cryptocurrency and blockchain, believes that the central bank decided to address this issue because of Facebook's Libra plans. "What this activity means is that the idea of stablecoins and digital currencies is being looked at seriously and thoughtfully," Wester tells Information Security Media Group.

---

Quote for the day:

"The leadership team is the most important asset of the company and can be its worst liability." -- Med Jones

---

Daily Tech Digest - November 22, 2019

What is Neuromorphic Computing? Let’s Dive Deep Into It

The concept of neuromorphic computing was spearheaded by Caltech teacher Carver Mead during the 1980s. In any case, neuromorphic figuring (also alluded to as neuromorphic engineering) is still in its nascent stages yet continually evolving, and just over the most recent couple of years, it has become feasible for business use cases. To imitate the human brain and nervous system, researchers and scientists are building artificial neural systems that replace neurotransmitters with nodes. One of the hindrances to these systems is the binary nature held by digital processing. CPUs send messages through circuits that are either on or off; there is no space for degrees of subtlety. Unexpectedly, engineers tackled this issue by returning to simple circuits, or basically analog circuits. Accordingly, they have manufactured processors that can moderate the amount of current flowing between nodes, like the fluctuating electric impulses in the brain that structure and modify brain chemistry.

75% of developers worry about app security, but half lack dedicated security experts on their team

This most recent study found that mobile app security is an ongoing problem. Some 43% of respondents said they still prioritize meeting their app release deadlines over security measures. With pressure to deliver functional apps by certain dates, coders either disregard security or take shortcuts to meet the deadline, the report found. Nearly 60% of developers said they are aware security should be a priority, but the pressure of meeting a deadline prevents them from treating it as such. Because of these pressures, more than half (52%) of respondents said they've experienced burnout. Burnout can be detrimental to an employee's physical and mental health, as well as have a negative impact on job performance, according to the report. "While developers' concerns about securing their code are on an upward trajectory, it's clear the industry has a long way to go. Developers are on the front lines when it comes to protecting their organizations from cyberattacks, and they need the right tools and training to handle this burden," Joseph Feiman, chief strategy officer at WhiteHat Security, said in the press release.

Slack: Microsoft Teams not only copies our product but our ads too

Microsoft this week announced that its answer to messaging platform Slack, Microsoft Teams, now has 20 million daily active users (DAU), making it almost twice the size of Slack. Teams has achieved that in just two years since its launch, thanks in part to being bundled with Office 365. Slack has argued that DAUs don't reflect user engagement and says users from its paid customers spend more than nine hours a day connected to Slack, and more than 90 minutes per day actively using it. Microsoft defines DAUs as "as "the maximum daily users performing an intentional action in the last 28-day period across the desktop client, mobile client and web client". Needless to say, competition is fierce in the enterprise chat space but Teams is an existential threat for Slack, whereas for Microsoft it is just a part of a much bigger pie in Office 365 and Microsoft 365. In a Twitter post titled 'ok boomer' – a reference to younger generations who feel ripped off by the Baby Boomer generation – Slack draws attention to the similarities between its own ad for the Slack Frontiers conference in April and later promotional videos, and Microsoft's 'The Art of Teamwork' ad, which was published in November.

5G security and privacy for smart cities

Connected services and infrastructure is a double-edged sword that helps provide better visibility, efficiency and performance, but is making non-critical infrastructure critical and therefore exposing more of the population to unaffordable risks. The general public is being ‘lulled’ into welcoming the convenience and continuous visibility provided by 5G, though in the event of a disruption, public order could be at stake. The conventional boundaries of critical infrastructure such as water supply, energy grid, and military facilities, and financial institutions will expand much further to other unprecedented areas in a 5G-connected world. All these will require new standards of safety. On the privacy side, matters become more complex. The advent of 5G with its short range will definitely mean more cell communication towers and building antennas being deployed in dense urban centers. With the right toolset, someone could collect and track the precise location of users. Another issue is that 5G service providers will have extensive access to large amounts of data being sent by user devices that could show exactly what is happening inside a user’s home and at the very least describe via metadata their living environment, in-house sensors and parameters.

Does your legal department spark joy?

Historically, when companies wanted to identify deals trends to present to their clients, they deployed teams of junior lawyers to analyze contract databases, a project that could take months. Today, forward-thinking companies with a digital contract repository and basic analytics technology can do a similar exercise in just a few clicks. Digitization and the active life-cycle management of contracts should now be relatively easy tasks to accomplish, not a leap into technology so sophisticated or cutting-edge that expert operators are required. Although many organizations have taken steps to move contracts from filing cabinets into cloud repositories, these actions have often been inconsistently implemented across the company, siloed within individual business units. The legal department, however, intersects with all parts of the business, and thus is in a unique position to oversee contract management. In the life cycle of a typical contract under the old system, the legal team is involved only twice: at the start, in drafting, negotiating, and executing the document; and at the end, in renewal, termination, or management of a dispute.

Should cybersecurity be taught in schools?

It is safe to say that young people are too often unaware of the risks that excessive sharing of photos and posting sensitive information on social media involves, nor do they associate such habits with problems that may ensue, such as grooming, sexting, cyberbullying, and phishing. After all, this is confirmed by findings gathered in a project called “Promoting information security in the school environment” (only available in Spanish) and prepared by the National University of Córdoba, Argentina. As the project’s creators explain, the proliferation of such poor cyber-habits has created the need for parents and educational institutions to actively seek information about privacy and security, notably about various aspects of data protection, cryptography, and prevention from identity and information theft and web-based cyberattacks. Meanwhile, the Computer Emergency Response Team of the National Autonomous University of Mexico (UNAM-CERT) echoes the view in that children and teens don’t have sufficient cybersecurity skills when they complete primary and secondary education. While computing classes do sometimes include aspects of good cyber-hygiene practices, online behavior isn’t thoroughly addressed. 

Pegasus like spyware could be snooping on you right now!!

Until the last incident, Pegasus was gaining entry into a user’s mobile, by tricking the user into clicking a link. The user still had control over whether or not to click the link & prevent Pegasus spyware from getting installed. However, in a bold and game-changing move, Pegasus spyware has now been found to exploit a vulnerability in WhatsApp that doesn’t even require any action from the victim. All that it needs to take over the victim’s phone is just make a missed call on WhatsApp and there’s absolutely nothing the mobile user can do to control this. Sounds scary right!! It is. Typically, in this case, users realized that they had been compromised by Pegasus only when WhatsApp sent them a message on its platform notifying them about the same. There are paid/free applications available on App stores (of respective operating system providers) that claim stellar detection capabilities for this insidious spyware. However, there is no clear indication of the success of their functionality.

New Database For Data Scientists

TileDB consists of a new multi-dimensional array data format, a fast, embeddable, open-source C++ storage engine with data science tooling integrations, and a cloud service for easy data management and serverless computations. The developers say traditional databases aren't ideal for data science use as they're not cloud-optimized, while cloud object stores suffer from object immutability, eventual consistency, and IO request limiting. A second problem is that some formats lack sufficient support for efficient data updates. They give the example of updating a Parquet file requiring the creation of a new file, pushing the entire update logic to the user’s higher-level application, and say similar problems arise whenever the update logic is not built into the format and storage engine, but it is rather delegated to higher-level applications. Finally, the developers cite limited scope as a problem, on the basis that most data science applications require at least two separate file formats to handle both array data and dataframes; multi-dimensional arrays for uses such as linear algebra; and dataframes for OLAP operations.

Edge vs. Chrome: Microsoft's Tracking Prevention hits Google the hardest

Microsoft has yet to publish formal documentation for this feature. As a result, the implementation has a "black box" feel to it. There's also no obvious way to customize its actions or to replace the built-in lists with third-party alternatives. If you're running the new Edge, you'll find Tracking Prevention on the Edge Settings page, under the Privacy And Services heading. The simple user interface includes an on-off switch for the feature (1), three boxes that define the extent of tracker blocking (2), and a place to manage exceptions (3). By default, Tracking Prevention is turned on, with the Balanced setting selected. According to Microsoft, that setting "blocks potentially harmful trackers and trackers from sites you haven't visited," without breaking functionality in the websites you visit. Bumping that setting up to Strict blocks "the majority of trackers across all sites ... but could cause some websites to not behave as expected." On my Windows 10 test PC, the Trust Protection Lists are located in the current user's profile, at %LocalAppData%\Microsoft\Edge Beta\User Data\Trust Protection Lists\, in a subfolder that identifies the version number of the current lists.

Balancing control and speed when integrating AI

Within the cloud space, AI is being considered for collaboration more and more as the likes of IBM, Amazon and Microsoft delve into this kind of technology. Automated management of hard drive-free data is bound to speed up the process of storage management. Also, AI, with its need for a large amount of processing power, can thrive within the cloud, which is known for its ability to manage large projects with ease. But according to Domo‘s VP of Data and Curiosity, Ben Schein, it’s vital that the agility and speed that AI can provide is balanced with integration and control. To achieve this, Schein said it “comes down to a sense of empathy for the people that have to use intelligence”. He went on to suggest addressing the fear that some employees feel about AI by making it easily accessible and encouraging feedback. “If I’ve been running a store for 20 years, for a retailer, I have a lot of knowledge that’s actually valuable within that setting, and if you’re not setting it up to give that feedback into it, then you’re in trouble,” said Schein.

---

Quote for the day:

"People will not change their minds but they will make new decisions based upon new information." -- Orrin Woodward

---

Daily Tech Digest - November 21, 2019

California's IoT Security Law: Why It Matters And The Meaning Of 'Reasonable Cybersecurity'

According to the law, a reasonable security feature must be “appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure, as specified.” The law is specific about security as it relates to authentication for devices outside a local area network, stating that “the preprogrammed password is unique to each device manufactured” and “the device contains a security feature that requires a user to generate a new means of authentication before access is granted to the device for the first time.” As you can see, guidance included as part of the law is specific to authentication, and it remains vague regarding other reasonable cybersecurity measures that are necessary beyond password management. However, companies can look to prior guidance for clarity, which defines compliance with the 20 security controls in the CIS Critical Security Controls for Effective Cyber Defense as the "floor" for reasonable cybersecurity and data protection.

Serverless HTTP With Durable Functions

Durable functions rely on a main orchestrator function that coordinates the overall workflow. Orchestrator functions must be deterministic and execute code with no side effects so that the orchestration can be replayed to “fast forward” to its current state. Actions with side effects are wrapped in special activity tasks that act as functions with inputs and outputs and manage things like I/O operations. The first time the workflow executes, the activity is called, and the result evaluated. Subsequent replays use the returned value to ensure the deterministic code path. Until the release of version 2.0, this meant interacting with HTTP endpoints required creating special activity tasks. As of 2.0, this is no longer the case! Now, with the introduction of the HTTP Task, it is possible to interact with HTTP endpoints directly from the main orchestration function! The HTTP Task handles most of the interaction for you and returns a simple result. There are some trade-offs.

Google's new AI tool could help decode the mysterious algorithms that decide everything

Users can pull out that score to understand why a given algorithm reached a particular decision. For example, in the case of a model that decides whether or not to approve someone for a loan, Explainable AI will show account balance and credit score as the most decisive data. Introducing the new feature at Google's Next event in London, the CEO of Google Cloud, Thomas Kurian, said: "If you're using AI for credit scoring, you want to be able to understand why the model rejected a particular model and accepted another one." "Explainable AI allows you, as a customer, who is using AI in an enterprise business process, to understand why the AI infrastructure generated a particular outcome," he said. The explaining tool can now be used for machine-learning models hosted on Google's AutoML Tables and Cloud AI Platform Prediction. Google had previously taken steps to make algorithms more transparent. Last year, it launched the What-If Tool for developers to visualize and probe datasets when working on the company's AI platform.

The cybercrime ecosystem: attacking blogs

Thirty-seven percent of the top 40 blogs in Sweden where running an outdated version of WordPress, with the oldest version being from 2012, vulnerable to a lot of exploits—even full remote code execution allowing the attacker to compromise not just the WordPress installation, but the server it is running on, too. When checking the server hosting this extremely old WordPress installation, I found that 13 other websites were running on the same server. Most of the outdated WordPress installations where from 2018. As mentioned before, this is a very common way for cybercriminals to spread malware, but how does it work in real life? After the WordPress site is compromised, the most common technique is to redirect the user to a so-called exploit kit. This is a system which will enumerate the browser, and if a list of requirements is met, deliver the malicious payload to the victim. For example, some of the requirements may be to exploit a certain browser only, if the exploit kit only has exploits for Firefox. In that case, nothing will happen if you visit the website in Chrome or Internet Explorer.

Blockchain-based storage service takes on Amazon AWS, unveils pricing

"These services may be half the price of Amazon S3, but they’re 100 times greater risk given the decentralized nature of the storage and the nascent companies behind them," Bala said via email. "Comparatively, AWS is a trusted provider with 10s of exabytes under management. I am also very skeptical of the performance claims being made relative to S3, particularly when objects need to be rebuilt in case a peer in the storage network disappears." Cloud storage provider Backblaze offers capacity through its B2 service at a quarter the price of Amazon AWS, but without the risk a P2P architecture poses, Bala said. "B2 is built and operated by sophisticated people from a technical perspective with a successful track record. So one need not use a P2P storage service just to save money," Bala said. Bala also criticized P2P-based storage services for claiming to use blockchain's innate cryptography and resilliency when, in fact, the distributed ledger technology is only used for the purposes of payment.

How to Build a Regex Engine in C#

This is an ambitious article. The goal is to walk you through the building of a fully featured regular expression engine and code generator. The code contains a complete and ready to use regular expression engine, with plenty of comments and factoring to help you through the source code. First of all, you might be wondering why we would develop one in the first place. Aside from the joy of learning how regular expressions work under the hood, there's also a gap in the .NET framework's regular expression classes which this project fills nicely. This will be explained in the next section. I've previously written a regular expression engine for C# which was published here, but I did not explain the mechanics of the code. I just went over a few of the basic principles. Here, I aim to drill down into a newer, heavily partitioned library that should demystify the beast enough that you can develop your own or extend it. I didn't skimp on optimizations, despite the added complication in the source. I wanted you to have something you could potentially use "out of the box."

Under the microscope: inbound versus outbound email protection

Times change, technologies continue to evolve, and yet email remains the easiest avenue of attack for cybercriminals looking to hack into your business Need convincing? Well, in 2018 94% of malware attacks were deployed by email, 78% of cyber espionage incidents used phishing, and 32% of all reported breaches involved phishing (let’s not dwell too much on the possible scale of unreported breaches). The truth is that email has been the easiest avenue of attack for at least two decades and, unless there are some fundamental changes in how the problem is addressed at a global level, it will probably remain so for another decade. In the meantime, businesses continue to look for ways of increasing their level of inbound protection – deploying security products that attempt to block access to infected sites or identify unsavoury email content before it reaches the recipient. These products come in many different shapes and sizes and are then augmented by a ‘human shield’, i.e. the vigilance of the employees to spot phishing scams and fraudulent messages that have outwitted the technology.

Q&A on the Book Rebooting AI

There are many legitimate concerns about AI. People with bad intentions - criminals, terrorists, militaries carrying out war, authoritarian governments carrying out surveillance - will undoubtedly misuse it, as they do every powerful technology. People, both in the general public and in positions of authority, are apt to trust it too much. Unless it is audited very carefully, AI can perpetuate existing social biases, as we've seen in many scandals over the last decade, such as the Amazon job recruitment program that was unshakably biased against women applicants.But our largest concern is that the great potential of AI that could benefit mankind will end up unrealized: first, because people will be frightened by the dangers and, after a certain point, discouraged by the limitations and failures of existing AI; and, second, because AI research, fixated on the short-term successes of machine learning, will fail to explore other approaches that have longer-term payoffs but a greater benefit in the long term.

IoT sensors must have two radios for efficiency

For the Internet of Things to become ubiquitous, many believe that inefficiencies in the powering of sensors and radios has got to be eliminated. Battery chemistry just isn’t good enough, and it’s simply too expensive to continually perform truck-rolls, for example, whenever batteries need changing out. In many cases, solar battery-top-ups aren’t the solution because that, usually-fixed, technology isn’t particularly suited to mobile, or impromptu, ad hoc networks. Consequently, there’s a dash going on to try to find either better chemistries that allow longer battery life or more efficient chips and electronics that just sip electricity. An angle of thought being followed is to wake-up network radios only when they need to transmit a burst of data. Universities say they are making significant progress in this area. “The problem now is that these [existing] devices do not know exactly when to synchronize with the network, so they periodically wake up to do this even when there’s nothing to communicate,” explains Patrick Mercier, a professor of electrical and computer engineering at the University of California, San Diego, in a media release.

Facebook: Microsoft's Visual Studio Code is now our default development platform

While Facebook is making VS Code the default developer environment, Marcey notes that Facebook does not have a "mandated development environment" and that some developers use other IDEs such as Vim and Emacs. Nonetheless, the default status for VS Code means that Facebook is backing it for its development future. "Visual Studio Code is a very popular development tool, with great investment and support from Microsoft and the open-source community," said Marcey. "It runs on macOS, Windows, and Linux, and has a robust and well-defined extension API that enables us to continue building the important capabilities required for the large-scale development that is done at the company. Visual Studio Code is a platform we can safely bet our development platform future." Facebook is also teaming up with Microsoft to improve the remote-desktop experience with VS Code via remote development VS Code extensions. Microsoft in May announced previews of three extensions that enable development in containers, remotely on physical or virtual machines, and with the Windows Subsystem for Linux (WSL).

---

Quote for the day:

"Leadership cannot just go along to get along. Leadership must meet the moral challenge of the day." -- Jesse Jackson

---

Daily Tech Digest - November 20, 2019

Mind-reading technology is everyone's next big security nightmare

Non-invasive systems read neural signals through the scalp, typically using EEG, the same technologies used by neurologists to interpret the brain's electrical impulses in order to diagnose epilepsy. Non-invasive systems can also transmit information back into the brain with techniques like transcranial magnetic stimulation, again already in use by medics. Invasive systems, meanwhile, involve direct contact between the brain and electrodes, and are being used experimentally to help people that have experienced paralysis to operate prostheses, like robotic limbs, or to aid people with hearing or sight problems to recover some element of the sense they've lost. Clearly, there are more immediate hazards to invasive systems: surgery always brings risks, particularly where the delicate tissue of the brain is concerned. So given the risks involved, why choose an invasive system over a non-invasive system – why put electronics into your grey matter itself? As ever, there's a trade-off to be had. Invasive systems cut out the clutter and make it easier to decode what's going on in the brain.

Mobile security perceptions don't approach reality

Banks, for very good reasons, keep as many details about their security programs secret for as long as they can. So how can consumers claim to switch businesses based on information that they can't possibly access? The bottom line is that they can't. But — and here's where Molly Hetz, an Iovation product marketing manager and the main author of the report, makes a useful observation — those consumers can make such a decision based on their perception of security. And that's where things get tricky. Consider: One of the best security and authentication approaches today is continuous authentication, where the system considers typing speed, typing pressure (for mobile devices), IP address, time of access, what files are being accessed, duration of session, typing accuracy (number of typos per minute), etc. — and compares all of it against a profile of a session that presumably was of the actual user associated with those credentials. The best part about continuous authentication is that it's indeed continuous, meaning that it won't theoretically be fooled by an attacker who does everything properly and within character for 10 minutes and then does the evil things that the attacker always planned to do.

Technical Debt: How to Balance Between the Velocity of Production and Code Quality?

It is also important to create a road map of tech debt projects and evaluate the risks so the company can plan accordingly. According to Dmitriy Barbashov, the Chief Technology Officer at QArea, a service-level agreement might help as well. “I would say that transparent SLA established and agreed with developers would be a good reference point for them,” he notes. It goes without saying that striving for perfection in development is not always the right choice. For example, if a startup is building its first prototype, quickly created MVP minimizes the risk of investing much effort into an idea that won't work. Developers should be very careful when trying to deliver features rapidly or make some quick fixes. On one side, investing time in a solid foundation may help build new features in the future. On the other side, some hacky fixes or some cheapest and fastest solutions may accumulate and turn into too much technical debt. Like in many aspects, smooth communication plays an important role in finding and proving the balance between code quality and speed. Open conversation between executives and developers is crucial.

The leader’s secret weapon: Listening

Listening can be particularly challenging for anyone in a management or leadership position, given all the pressures they face. Dozens of unread emails pile up by the hour, and calendars are a wall of back-to-back meetings. It can be hard to be present in the moment. But listening is not just a nice-to-have skill for senior executives; it is essential for effective leadership for two distinct reasons. First, to navigate the disruptive forces roiling every industry, leaders realize they need to build a team that brings a diversity of perspectives and experiences to the challenges their company faces. Getting this right is just the start. Once they have assembled a diverse team, leaders then have to draw out opinions with intentional listening. Leaders can remind themselves in these team meetings of the WAIT acronym, which stands for “Why am I talking?” It’s a powerful reminder for senior executives to let others share their opinions first, and also to be brutally honest with themselves about their motives for speaking when they do chime in.

How to Become a Credible IT Leader

Building credibility, like many things in life, is easier said than done. I learned a hard lesson on credibility early in my career—one that, ironically, centered on failure. At the time, we were working on a complex, massive, and difficult IT project, one which turned out to be a lot more difficult than initially anticipated, and we were struggling to meet the demanding deadlines. We were working weekends for months on end, and I drove into the office one Saturday morning with boxes of donuts for the team. But I could see on their faces and in their body language a level of stress that no amount of sugar would fix. I stood in front of the group and told them we were delaying the project. Immediately, I could sense their relief. Their bodies relaxed, their jaws unclenched, and I felt the stress leaving the room. We regrouped, set new priorities and eventually delivered the project with the key functionality necessary for the business users. After we went live with the new system, our company CEO said, “I was worried how the delay may negatively impact your reputation within the company, however, the quality of delivery proved otherwise.”

10 tips to push past your leadership comfort zone: Women in IT Award winners share

Nicole Hu, CTO and co-founder, One Concern: As CTO, I don’t really code anymore. So the biggest strides I’ve made have been on the non-engineering aspects of my responsibilities, such as getting people to rally behind the business and managing the delicate and often complicated parts of people dynamics. It’s not just about the coding. I realized I had different shoes to fill. That really caused me to transform, because if I didn’t do it, it was going to hurt the entire team and company. I was very scared. I think that’s normal. Good support systems (your family, friends, partner) will help you believe in what you’re doing because there are days you won’t have the belief, or you’ll lose your resolve. Constantly surround yourself with people who are clear with what you want to do, have confidence in your ability to do it, and empower you to do your work. For me, the key was in realising the cost of inaction. What would happen if I didn’t step up? If I’m not loud enough in a meeting, what will happen?

Swedish hospitals suffer IT crashes

“The computers that have experienced serious crashes are spread all over the West Götaland region, in every division,” said Thomas Schulz Rohm, press secretary for the West Götaland authority. Maria Skoglöf, manager of the authority’s IT support centre, said the matter was being taken very seriously because many computers were affected. “The problem is not solved,” she said. “But the number of hard disk crashes has gone down since last week.” Skoglöf said she could not say where the problems had hit the hardest. “It is up to every division to say how they were hit and how they solved it,” she added. Staff have resorted to manual processes to alleviate the problems, said Skoglöf. “It is important to have manual routines to use when there are no computers available.” Skoglöf said that as far as she knew, the computer crashes had not affected any patients’ health.

Predicting Time to Cook, Arrive, and Deliver in Uber Eats

There’s no other way to ensure accuracy without utilizing machine learning technologies. However, challenges arise along the way with its core development. Compared with other machine learning problems, our biggest challenge is lacking ground truth data, which is pretty common in the online-to-offline (O2O) business model. However, it’s the most critical component in machine learning, as we all know "garbage in, garbage out." Another one is the uniqueness of Uber Eats as a three-sided (delivery partners, restaurants, and eaters) marketplace, which makes it necessary to take all partners into account for every decision we make. Fortunately, Uber’s in-house machine learning platform - Michelangelo has provided tremendous help in simplifying the overall process for data scientists and engineers to solve machine learning problems. It provides generic solutions for data collecting, feature engineering, modeling, serving both offline and online predictions, etc., which saves a lot of time compared to reinventing the wheels. ... The greedy matching algorithm only starts looking for a delivery partner when there’s an order coming in. The result is optimal for a single order but not for all the orders in our system from a global perspective. Therefore, we changed to the global matching algorithm so that we can solve the entire set of orders and delivery partners as a single global optimization problem.

Singapore moots regulated trading in cryptocurrencies

The regulator said: "While advancements in digital cryptography and distributed ledger technology have the potential to improve access to services, generate cost efficiencies, and spur competition between new and conventional business models, the specific use cases for digital tokens have, thus far, remained embryonic. Meanwhile, their transformative possibilities may produce new sources of risks, requiring participants and regulators to think of new ways to mitigate these risks, and retain the trust and stability in the financial sector." It noted that the trading of popular digital tokens such as Bitcoin and Ether had largely been on unregulated markets, which had been fraught with allegations of fictitious trades and market manipulation. This had spurred interest amongst international institutional investors for an alternative, regulated environment in which some of these risks could be mitigated, MAS said, adding that Bitcoin futures, for instance, currently were listed an traded on the US futures exchanges.  The Singapore regulator last year had warned eight cryptocurrency exchanges against engaging in unauthorised trading, specifically, those involving securities or futures contracts.

Bitcoin, blockchain jobs remain unfilled as interest drops off

While the number of jobs related to blockchain and cryptocurrencies such as bitcoin has skyrocketed in the past four years, the number of searches for those jobs has drastically dropped recently, according to job search site Indeed. Over the past year, the share of cryptocurrency- and blockchain-related job postings per million has slowed on Indeed, increasing 26%. At the same time, the share of searches per million for jobs in the field has decreased by 53%. ... Bitcoin's value has been on a roller coaster ride in the past two years. In 2018, the cryptocurrency's price plummeted from nearly $19,500 in Februrary to around $3,600 by the end of last year. Over the past year, however, bitcoin's value jumped to more than $12,000 before settling back to about $9,200 today. The volatility seems to be turning potential job seekers off. "For the first time, the number of jobs per million exceeded the number of searches per million," Cavin wrote. It could be reasonable to assume that if bitcoin drops dramatically again, a candidate looking for a blockchain role would run into less competition than they would after a large increase."

---

Quote for the day:

"The quality of leadership, more than any other single factor, determines the success or failure of an organization." -- Fred Fiedler and Martin Chemers

---

Daily Tech Digest - November 19, 2019

AI Projects Fail — Here's Why

We tend to expect that AI systems perform intellectual tasks as well as we do — or better. That’s a reasonable thing to expect since we all know that “AI is outperforming humans at more and more tasks.” It is. It even beat a Go champion. However, our minds are much more flexible than AI systems. Think about recommendations: you meet an interesting person at a startup event. Let’s give him a name: it’s John. John enjoys talking to you and appreciates your knowledge of business and technology - he asks for a recommendation of a book that will help him gain more knowledge about these things too. You quickly run through all the titles in your head. There’s book A, B, C, D, E… OK, John, I’ve got it. You should read (insert title here). How did you know what you should recommend to John? Your brain scanned the information you’ve gathered so far — what John knows, what he was interested in when talking to you, what his style is - to assess which book will be best for him, even though you have no idea about his actual taste in books. You had a feeling he’ll like it, and you might be right. Now, let’s look at an AI system that “meets” John. John enters the website of an online bookstore and he’s instantly welcomed with a list of bestselling books.

Application Security Report: Urgent Need for Remediation

WhiteHat Security isn’t the only organization that has addressed problems with app vulnerability remediation. Their report is the among most recent, but Deloitte, Edgescan and other organizations have made similar revelations. The risks associated with app security issues are too grave to ignore. A report from Positive Technologies found that inadequate web app security was responsible for 75% of network penetrations. Another study published earlier this year found that 46% of websites had high security vulnerabilities, which was largely due to app security flaws. The discovery of app security flaws coincides with a 38% increase in SQL injection attacks. Since many security breaches are caused by security vulnerabilities in web apps, remediation needs to be a top priority moving forward. Organizations need to take a variety of measures to deal with web app security risks. The following findings have been highlighted by multiple independent web security reports, which suggests they warrant the most attention. Security analysis must be performed during the development stage of enterprise applications - Security issues are sometimes introduced during updates or patches after the initial app is released.

Julia VS Python: Can This New Programming Language Unseat The King?

Alan Edelman, Jeff Bezanson, Stefan Karpinski, and Viral Shah started to create Julia in 2009, and they took inspiration from Python. Their objective was to create a programming language for better and faster numerical computing. They launched the 1st version of Julia in February 2019, and it’s an open-source language. Julia caters specifically to scientific computing, machine learning, data mining, and large-scale linear algebra. The language also caters to distributed and parallel computing. The creators of Julia wanted a language as fast as C, moreover, it should be as dynamic as Ruby. They intended that their creation should be as useful for general purpose as Python, however, it should be as useful as R for statistics. The team of 4 lead developers also wanted Julia to have the good features of Perl and MATLAB. Read more about the history of Julia in “Julia | Definition, Programming, History”. Julia has seen plenty of development already. At the time of writing, its stable release is v1.2.0, which was released in August 2019. Despite it being a new language, the usage of Julia is picking up, as you can read in “How a new programming language created by four scientists now used by the world’s biggest companies”.

Best Programming Languages To Build Smart Contracts

A smart contract is a self-executing contract where the terms of the agreement between the buyer and the seller are directly written into lines of code. The code and the agreements are contained therein exist over a distributed, decentralized blockchain network. Smart contracts allow for trusted transactions and agreements to be carried out among anonymous parties without the need for a central entity, external enforcement mechanism, or legal system. This way, the transactions are transparent, irreversible, and traceable. Implementing smart contracts across various blockchains is made possible through Solidity, the high-level object-oriented programming language. ... Solidity was first developed by Gavin Wood, Yoichi Hirai, Christian Reitweissner, and many other core contributors of Ethereum to help develop smart contracts. With the Ethereum blockchain leading the way as a major smart contract platform, many alternative blockchains want to make use of Solidity compatible contracts to run on their networks. Smart contracts that are deployed on the Ethereum network can be easily ported to alternative blockchain networks. 

What is edge computing and why it matters

Increasingly, though, the biggest benefit of edge computing is the ability to process and store data faster, enabling for more efficient real-time applications that are critical to companies. Before edge computing, a smartphone scanning a person’s face for facial recognition would need to run the facial recognition algorithm through a cloud-based service, which would take a lot of time to process. With an edge computing model, the algorithm could run locally on an edge server or gateway, or even on the smartphone itself, given the increasing power of smartphones. Applications such as virtual and augmented reality, self-driving cars, smart cities and even building-automation systems require fast processing and response. “Edge computing has evolved significantly from the days of isolated IT at ROBO [Remote Office Branch Office] locations,” says Kuba Stolarski, a research director at IDC, in the “Worldwide Edge Infrastructure (Compute and Storage) Forecast, 2019-2023” report.

Programming Languages You Should Learn in 2020

Programming languages and computer coding have made life simpler for us. Whether it’s automobiles, banks, home appliances, or hospitals, every aspect of our lives depends on codes. No wonder, coding is one of the core skills required by most well-paying jobs today. Coding skills are especially of value in the IT, data analytics, research, web designing, and engineering segments. So, which programming languages will continue to be in demand in 2020 and beyond? How many languages should you know to pursue your dream career? We will attempt to answer these tricky questions in this post. The ever-growing list of programming languages and protocols can make it tough for programmers and developers to pick any one language that’s most suitable for their jobs or project at hand. Ideally, every programmer should have knowledge of a language that’s close to the system (C, Go, or C++), a language that’s object-oriented (Java or Python), a functional programming language (Scala), and a powerful scripting language (Python and JavaScript). Whether you are aiming at joining a Fortune 500 firm or desire to pursue a work-from-home career in programming, it’s important to know what’s hot in the industry. Here are a few programming languages we recommend for coders who want to make it big in 2020.

Hacking and cyber espionage: The countries that are going to emerge as major threats

"Over the last five years you've seen more and more countries gaining offensive cyber capabilities. You have a lot of different tiers, but none of them are at the level of the big four attackers that we talk about," says Sahar Naumaan, threat intelligence analyst at BAE Systems. "There's a huge number in that second and third tier that are upcoming that haven't got to the level of professionalised level of APT you see from other states: but it's only a matter of time before you see them develop," she says. While they don't sit up there with the most sophisticated hacking groups – at least yet – some of these operations have already emerged onto the world stage. One of these is APT 32, also known as OceanLotus, which is a group working out of Vietnam that appears to work on behalf of the interests of its government. The main target of attacks are foreign diplomats and foreign-owned companies inside Vietnam. Many of these campaigns begin with spear-phishing emails that encourage victims to enable macros to allow the execution of malicious payloads. It's not a sophisticated campaign, but it appears to be doing the job for now – and that's enough.

Space-sourced power could beam electricity where needed

“Developers envision a system that is a constellation of satellites with solar panels, about 10,000-square meters, or about the size of a football field or tennis court,” writes Scott Turner of the Albuquerque Journal. The Air Force Research Laboratory (AFRL), in Albuquerque, along with defense technology company Northrop Grumman have just announced that they plan to spend $100 million dollars developing the hardware, called the Space Solar Power Incremental Demonstrations and Research (SSPIDR) project. Two kinds of solar-panel technology are in common use on land now. Photovoltaic solar panels work by converting energy from the sun into electricity. They don’t have moving parts, so are inexpensive to maintain, unlike turbines. Another kind of solar panel uses mirrors and lenses. They grab, and then concentrate sunlight, producing heat, which then operates steam turbines. “This whole project is building toward wireless power transmission,” Maj. Tim Allen, a manager on the project, told Turner. It will “beam power down when and where we choose.” Precise power beams will automatically track the target that needs the power, too. “We can put them down in specific locations and keep them there,” he says.

13 Practices for Better Code Reviews

As an implementer, if you get a comment to rename a variable but think the suggested names are similar, with no clear difference: accept it. As a reviewer, if you want to suggest a change, but you cannot explain a clear advantage for your suggestion: skip it. You may think, "My solution is as good as my peer's solution. Why should I retreat?" The answer is clear. Your assumption is wrong. What seems equally good to you, may not be true for your teammate. If in your weighting system, the options are equivalent, you are the one who can tolerate it and show flexibility. So do it. Save the debate for the cases that matter to you. ... In comments and comment responses, don’t complain or blame, just append your reasoning if it’s not clear. Commenting can be a hard situation on its own. You are going to disagree with a teammate; you are going to catch a problem in their work. So don’t make it even harder by complaining. When your teammate reads your note, they may not read it with the same tone and strength you intended. If it’s a negative sentence, it’s not a surprise if they read it as a shout in their face or as it was written with total contempt. Emoji icons can help, but it’s difficult to show both seriousness and respectfulness with an emoji!

Antivirus vendors and non-profits join to form 'Coalition Against Stalkerware'

The goal of this new initiative is to build a wireframe for fighting abuse perpetrated with the aid of stalkerware. The coalition plans to operate on multiple fronts to achieve this. It will work with antivirus vendors to improve the detection of known stalkerware apps that are often used by abusers to spy and track their partners. It will also work to develop and share technical guides on how to deal with stalkerware at the level of frontline non-profits that handle victims of domestic abuse. Finally, the coalition hopes that sometime in the future, it will establish partnerships with law enforcement agencies to go after the companies that sell stalkerware apps. In alphabetical order, founding members of the Coalition Against Ransomware include Avira, the Electronic Frontier Foundation, the European Network for the Work with Perpetrators of Domestic Violence (WWP), G DATA CyberDefense, Kaspersky, Malwarebytes, National Network to End Domestic Violence (NNEDV), NortonLifeLock (formerly Symantec), Operation Safe Escape, and the WEISSER RING.

---

Quote for the day:

"Leaders who won't own failures become failures." -- Orrin Woodward

---