Daily Tech Digest - May 03, 2020

Communicating with Management About Technical Debt

In making your case to business leaders on the need to address technical debt, it’s important to adopt a campaign approach. Think like advertisers who measure their impact in terms of reach and frequency–how many people they reach and how many times those people are exposed to their message. While you’re not running an advertising campaign, you need to be prepared to make your case over time, and to reach both the decision makers and the people who influence the decision makers. One email, or one presentation to management, isn’t going to get your message across. Technical debt is inevitable and, in some cases, makes sound business sense–i.e., when speed-to-market is critical, when resources are limited or information is incomplete. If technical debt reaches a certain level, it makes good business sense to forego immediate gratification projects in order to pay it down. That’s why framing technical debt in a manner that business leaders understand can make business leaders more inclined to realize the importance of managing it, as they do other risks facing the business.

WHO Reports 'Dramatic' Increase in Cyberattacks

While the WHO is one of the most high-profile agencies targeted by cybercriminals and nation-state hacking groups, other organizations have seen a dramatic rise in various security incidents, especially around phishing attempts. This week, security firm Zscaler released on report concerning phishing campaigns and malicious domains using COVID-19 as a lure. In January, the company reported about 1,200 of these incidents, but that number increased to 380,000 incidents in March. That's an eye-popping 30,000 percent increase, according to the report. In addition, Zscaler found that since the start of the healthcare crisis in January, about 130,000 suspicious domains have been registered. These domains include keywords such as "test," "mask," "Wuhan" and "kit," according to the report. And while attackers have focused on using COVID-19 as a lure, Brock Bell, principal consultant with the Crypsis Group, an incident response and risk management firm, notes that these tactics are likely to change over time as cybercriminal and hacking groups adjust to their messages based on the news of the day.

3 ways SMBs use machine learning to power digital transformation

Another good use case for ML is contract management, specifically automating the signing process. Software company Conga helps businesses automate contract lifecycle management (CLM) including the need for multiple signatures on a paper document. The platform allows Salesforce users to manage contracts directly in the application, while automating CLM from creation to signature. The software also automates reporting, tracking, and reminders. Conga's Digital Transformation Officer, Aishling Finnegan said that the best approach to using ML is to map technology to a company's existing processes and build an individualized road map for digital transformation. "If you have a more programmatic approach, you're more in control, and it feels less overwhelming," she said, adding that demos of AI software are often too complicated. Finnegan said that automating the contract process is especially important now that entire companies are working remotely. "Sales teams are able to generate vital important documents at home and get them to clients quickly," she said.

Is Augmented Intelligence The Best Perspective On AI?

One interesting insight comes not from AI, but rather from another technology that aimed to replace human activity - the Automated Teller Machine (ATM). When ATM machines were first put into place in the 1980s, there was widespread concern that it would eliminate the jobs of ordinary bank tellers and bank operations. However, according to Davenport, "One of my favorite statistics is that there are roughly the same number of bank tellers now, as there was in 1980 despite all the ATMs, internet banking, and other such changes." From this perspective he sees AI too not having the same sort of disruptive effects on employment as many might at first assume. From Davenport’s point of view, introducing technology that automates and performs tasks previously accomplished by humans actually creates more jobs for people who take time to learn about how they work. For example, these new machines create opportunities for technicians and programmers and whole new industries that are enabled by new technology.

How to make algorithms fairer

Of course, most of us would be reluctant to give up on procedural fairness entirely. If a referee penalises every minor infringement by one team, while letting another get away with major fouls, we’d think something had gone wrong — even if the right team wins. If a judge ignores everything a defendant says and listens attentively to the plaintiff, we’d think this was unfair, even if the defendant is a jet-setting billionaire who would, even if found guilty, be far better off than a more deserving plaintiff. We do care about procedural fairness. Yet substantive fairness often matters more — at least, many of us have intuitions that seem to be consistent with this. Some of us think that presidents and monarchs should have the discretion to offer pardons to convicted offenders, even though this applies legal rules inconsistently — letting some, but not others, off the hook. Why think this is justified? Perhaps because pardons help to ensure substantive fairness where procedurally fair processes result in unfairly harsh consequences. Many of us also think that affirmative action is justified, even when it looks, on the face of it, to be procedurally unfair, since it gives some groups greater consideration than others.

Cybersecurity pros share insights into their current work situations

Some of the themes that came to light included a lack of hardware to support a larger number of remote workers, the struggle between organizational priorities for quick deployment of remote technology and the commensurate level of security to protect systems, and helping end users understand and abide by security policies outside the office. One respondent commented, “Security at this point is a best effort scenario. Speed has become the primary decision-making factor. This has led to more than a few conversations about how doing it insecurely will result in a worse situation than not doing it at all.” ... “COVID-19 hit us with all the necessary ingredients to fuel cybercrime: 100% work from home [WFH] before most organizations were really ready, chaos caused by technical issues plaguing workers not used to WFH, panic and desire to ‘know more’ and temptation to visit unverified websites in search of up-to-the-minute information, remote workforce technology supported by vendors driven by ‘new feature time to market’ and NOT security, employees taking over responsibilities for COVID-19 affected co-workers, and uncertainty regarding unexpected communication supposedly coming from their employers.”

Self-supervised learning is the key to human-level intelligence

“There’s a lot of progress that could be achieved by bringing together things like grounded language learning, where we’re jointly trying to understand a model of the world and how high-level concepts are related to each other. This is a kind of joint distribution,” said Bengio. “I believe that human conscious processing is exploiting assumptions about how the world might change, which can be conveniently implemented as a high-level representation. Those changes can be explained by interventions, or … the explanation for what is changing — what we can see for ourselves because we come up with a sentence that explains the change.” Another missing piece in the human-level intelligence puzzle is background knowledge. As LeCun explained, most humans can learn to drive a car in 30 hours because they’ve intuited a physical model about how the car behaves. By contrast, the reinforcement learning models deployed on today’s autonomous cars started from zero — they had to make thousands of mistakes before figuring out which decisions weren’t harmful.

OpenAI unveils neural network capable of creating music and releases debut mixtape

While we were expecting something along the lines of a series of neurons misfiring over a theremin, overall, the songs are fairly impressive. At a low volume, these jams could pass in most environments without raising any eyebrows, however, once you take a more discerning listen or even a slight gander at the lyrics the wheels start to fall off a bit. To assist, the lyrics in the released songs "have been co-written by a language model and OpenAI researchers." The lyrics for the most part pass muster aside from maybe a line or two in the Sinatra nod. This song, in particular, opens with: "It's Christmas time, and you know what that means, Ohhh, it's hot tub time!" The overall quality and clarity of the "rudimentary singing" varies wildly from track to track. As noted in an OpenAI release, "singing voices generated by those models, while often sung in a compelling melody, are mostly composed of babbling, rarely producing recognizable English words." The Sinatra track sounds more or less like ol' Blue Eyes. The country ode to Alan Jackson passes and in all honesty could potentially even inconspicuously slide right in the middle of a few classic saloon hits.

Why Enterprise Blockchains Fail: No Economic Incentives

First and foremost, firms have been putting technical design ahead of economic design. They prioritize hiring technical teams and developing code, and then delay important discussions about the value that the product delivers and users’ incentives to adopt it. By the time the team addresses incentive design, teams have boxed themselves in to a narrow set of economic design options that are compatible with the existing code, or face deleting and rewriting huge chunks of the platform. Firms want to make a return on their investments, and these questions reflect that desire. However, they betray a fundamental misunderstanding of the economics of blockchain networks and the path to creating long-term monetization. Like social networks, blockchain consortia derive much of their value from network effects: that the value of the network to each participant increases with each additional participant. Many teams are familiar with this concept, which was popularized by Google Chief Economist Hal Varian and UC Berkeley Professor Carl Shapiro in the late 1990s.

The 7 Habits Of Good Data Scientists

More than just data analytics, more than just big data insight, more than just the ability to handle new streams of raw unstructured data and more than just knowing how to drive a database while blindfolded, data scientists have to understand business and be flexible super-performers. So what core attributes make a good data scientist? “The work of data scientists is, by definition, experimental. They need to be allowed to experiment and the outcomes may or may not be successful, but do enough experiments in the right areas... and you will find the value,” said Asplen-Taylor. “Considering problem solving experimentation further, data scientists need to follow not to lead i.e. they need to be given a problem to fix, which means they need business analysts to define the problem… and, after their experimentation phase, they need someone to test the outcome of their projects, validate the results (so they are not marking their own homework) and they need IT people who will put their models into a production environment…”

---

Quote for the day:

"Don't measure yourself by what you have accomplished. But by what you should have accomplished with your ability." -- John Wooden

---

Daily Tech Digest - May 02, 2020

CISO position burnout causes high churn rate

Even the most impressive professional pedigree can't guarantee a CISO's success. Those with technical backgrounds often find navigating the politics of the C-suite "extremely stressful," according to Budge. On the other hand, CISOs who come from management environments may be unprepared for the day-to-day grind of operational support, said Tony Buffomante, principal and cybersecurity leader at professional services firm KPMG. "Taking those calls and fixing systems in the middle of the night -- that's the part that drives burnout," he added. Budge suggested that problems arise when the right CISO takes the wrong job. "A lot of us are so eager for that title, we don't actually do the homework," she said, adding that she knows few security executives who conducted adequate due diligence before accepting job offers. In her research, Budge identified six distinct types of CISO, all with different backgrounds and abilities: transformational, post-breach, tactical/operational, compliance/risk, steady-state and customer-facing evangelist. Transformational CISOs, for example, tend to be energetic, business-oriented types with large appetites for change.

The home networks we need today are coming tomorrow

Recently, though, two wireless networking developments have paved the way to a future in which bandwidth-intensive applications from powerful client devices will have access to far greater spectrum than they ever have, while devices that need very little bandwidth -- but battery life that extends for months -- will be able to tap into an industry-shaping collaboration that will allow unprecedented interoperability. The first of these is the Wi-Fi 6E. Following a recent ruling by the FCC, Wi-Fi will soon be able to operate in the 6GHz range whereas today's Wi-Fi is limited to the heavily taxed 2.4GHz range and 5.8GHz range. This opens up more spectrum to Wi-Fi than the older two ranges have offered combined. Its impact will be felt particularly strongly once people start gathering again in venues such as conferences and arenas. However, it should also help improve network congestion in the home. There is a small catch. While new Wi-Fi standards have always required both the access point and client to be upgraded to take full advantage of what they can offer, backward compatibility has always been assumed.

AIOps 2020: IT Talent Is the Game-Changer 

Automation is the backbone of technology, but true AIOps panacea is found when the right technologists know how to use the information AIOps provides. Think of a medical MRI: Once the technology identifies issues, human intervention steps in to determine how and when to improve and fix things. The same is true with AIOps. It frees an IT team to prioritize the most important items and who should tackle them, instead of combing through endless logs and wasting every developer’s time on break fixes. How a highly qualified, on-demand workforce makes a tangible, measurable difference here is a factor not to be underestimated. Talented technologists who can immediately ramp up on teams and systems—because it’s what they do day in and day out—seamlessly augment internal development staff and can address/remediate issues. The future of AIOps goes beyond the technology itself and rests in the hands of dynamically built, virtual teams that can address issues just as quickly as the AIOps platforms identify them.

Java Feature Spotlight: Text Blocks

A text block uses triple-quotes (""") as its opening and closing delimiter, and the remainder of the line with the opening delimiter must be blank. The content of the text block begins on the next line, and continues up until the closing delimiter. ... Java's string literals do not support interpolation of expressions, as some other languages do; text blocks do not either. (To the extent that we may consider this feature at some point in the future, it would not be specific to text blocks, but applied equally to string literals.) Historically, parameterized string expressions were built with ordinary string concatenation (+); in Java 5, String::format was added to support "printf" style string formatting. Because of the global analysis surrounding whitespace, getting the indentation right when combining text blocks with string concatenation can be tricky. ... What may be surprising is the number of different ways that such a feature is expressed in popular languages. It's easy to say "we want multi-line strings", but when we survey other languages, we find a surprisingly diverse range of approaches in both syntax and goals.

How much does it cost to launch a cyberattack?

Buying an individual piece of malware or even a full phishing kit isn’t enough to launch an attack: attacks require hosting, distribution channels, obfuscation for malware, account checkers and more. In a new report, Black-market ecosystem: Estimating the cost of “Pwnership,” Deloitte has gone beyond just listing the piecemeal costs and instead calculated the total cost of operations — from malware and keyloggers to things like domain hosting, proxies, VPNs, email distribution, code obfuscation and more — for threat actors to launch a full campaign against organizations. “The groups behind these types of large campaigns need multiple layers of services,” says Loucif Kharouni, threat intelligence leader at Deloitte Cyber Risk Services. For an operation to deliver a banking Trojan, you would need to use at least five or six services.” The report found that the dark web is awash with a variety of readily accessible services to suit the individual needs of the attacker, with pricing that accommodates all levels of investment.

Revealing leaders’ blind spots

As much as executives try to be self-aware, gaps — often big ones like Stephen’s — inevitably appear between how they think they are showing up in the world and how people perceive them. What is noteworthy is how widespread these misperceptions are. An analysis by Merryck & Co. and the Barrett Values Centre of the self-assessments of 500 leaders and then 10,000 of their peers over a period of 16 years offers a humbling insight for any senior executive who aspires to be self-aware: The top areas leaders identified in themselves as needing work barely ever overlapped with what their peers and key colleagues saw as areas that needed improvement. The conclusion is that leaders are mostly oblivious to the way their colleagues view their weaknesses. And these disconnects have consequences. Leaders’ blind spots can limit their opportunities, impede their performance, and ultimately drag down their career. For executives in the most critical roles, these limitations can also hamper their organization’s ability to execute its strategy, as was the case with Stephen.

Determined AI makes its machine learning infrastructure free and open source

“Machine learning is going to be a big part of how software is developed going forward. But in order for companies like Google and Amazon to be productive, they had to build all this software infrastructure,” said CEO Evan Sparks. “One company we worked for had 70 people building their internal tools for AI. There just aren’t that many companies on the planet that can withstand an effort like that.” At smaller companies, ML is being experimented with by small teams using tools intended for academic work and individual research. To scale that up to dozens of engineers developing a real product… there aren’t a lot of options. “They’re using things like TensorFlow and PyTorch,” said Chief Scientist Ameet Talwalkar. “A lot of the way that work is done is just conventions: How do the models get trained? Where do I write down the data on which is best? How do I transform data to a good format? All these are bread and butter tasks. There’s tech to do it, but it’s really the Wild West. And the amount of work you have to do to get it set up… there’s a reason big tech companies build out these internal infrastructures.”

Data Science for analytical minds | Introduction

Data science requires a lot of data wrangling, multiple model testing and optimisation along with visualisation to draw right insights, make inferences, do predictions or enable decisions. What’s more is that this needs to be done every day with varying data scale and capacity within the organisation. Therefore, knowing scripting programming languages that can best automate and optimise the work — from data cleaning to visualisation — is essential for any data scientist. R and python are most famously used programming languages used by data scientists but there are a lot more which we will discuss in detail in the coming section. Economists or statisticians are mostly taught STATA and basics of R or python in some universities, which is a good stepping stone but there is a long road ahead in learning how to write R or python scripts that are optimised for agility and speed.

YubiKey hands-on: Hardware-based 2FA is more secure, but watch out for these gotchas  

Hardware-based security, on the other hand, is much more difficult to successfully attack remotely. To sign in, you have to insert the key and then tap it in response to a prompt to submit the proof of identity. The Yubikey devices I tested support hundreds of services that use a handful of standards, including FIDO2 Web Authentication (WebAuthn). A full list of supported services is available on the Yubico website, where you can search and filter to find the ones that interest you. It's worth noting that support for hardware-based authentication is considered a premium feature for many services; for example, if you use the password managers LastPass, Dashlane, or Bitwarden, you must upgrade to a Business, Premium, or Enterprise plan to enable a security key as a second factor. I tested both YubiKey devices with a representative sample of the kind of services you're likely to use regularly, including 1Password, Dropbox, Namecheap, GoDaddy, and Twitter. I also used the hardware key to secure Microsoft and Google accounts, as well as to sign in to a local account on a MacBook Pro.

Successful Transformation: Challenge the Status Quo

“The organization needs a shift in culture to encourage all employees to become more open to changes in their daily processes and tools–digital transformation is largely about creating a culture of constant learning. Without the pressure to provide perfect continuity in current technologies, IT leaders can become more comfortable trying new things,” said Stringer. “This is one of the reasons why it’s common to see large organizations collaborate with smaller companies for projects,” said Hennelund. “In the financial sector we see a flourishing fintech and insurtech market around established banks and insurance companies. Companies successful in challenging their status quo are those that can navigate between these collaborations or even small in-house sub-divisions that develop new digital IT-based projects,” added Hennelund. “Putting into place a quick decision-making process is also critical.” This could include making it possible for stakeholders to hold meetings and move forward with their consensus without always having to get board approval. Such shifts in behavior require culture change. So, how do organizations and IT leaders get there?

---

Quote for the day:

"Without courage, it doesn't matter how good the leader's intentions are." -- Orrin Woodward

---

Daily Tech Digest - May 01, 2020

Running business intelligence using data: Connect the dots

The better an organisation’s visibility into their data and the easier access they have, the better able they are to make good business decisions. In my early career, seeing organisations cut costs, increase profits, or lower customer churn was the proof point I needed to shift my focus from business process re-engineering (BPR) to business intelligence (BI) and analytics, as merging both skillsets was a great way to work with organisations and support them through their data journeys. In the not-for profit sector, business intelligence data and analytics are really important for showing donors how their funds are being used, so that they continue to invest in causes that they support. As an example, the largest privately-funded not-for-profit organisation in the world, United Way, ensures good governance by conducting regular studies to collect data on donations and outcomes. 

TABi to the Rescue – the Process Automation Bot

“The result of having this next level Robotic Process Automation (RPA) technology for transportation and logistics operations is more time that can be used to grow your business,” Gonzalez added. “It also means you can improve your focus on continually ensuring customer satisfaction, and enhance the way your employees view your company as a great place to work.” TABi uses RPA, a rules-based software technology driven by Machine Learning and AI, to turn unstructured and semi-structured data in documents, spreadsheets, and emails into structured data that can be automatically integrated with any transportation or enterprise management system. The technology also does not require the development of an API. “Through our partnership with Automation Anywhere,” explained Gonzalez, “integrating data between multiple platforms is as easy as setting up a new user account. TABi becomes the new user and seamlessly pulls information from one platform to the next. No lengthy integration process, no manual data entry. Let TABi take care of the mundane so humans can perform the social, creative, service-oriented aspects of a job. The fun stuff!”

Microsoft to rebrand Planner app in Teams as 'Tasks'

The move seems similar to what Microsoft announced recently around Yammer in Teams. The Yammer Teams app is being rechristened as "Communities." But outside of Teams, the Yammer app will continue to be known as Yammer. And I believe outside of Teams, the Planner app will remain "Planner," but I am asking Microsoft just to be sure. There is more going on than just a rebranding in the case of Planner in Teams, however. The Microsoft 365 roadmap, which now includes an item called "Tasks in Teams," describes the coming Tasks app as providing users with a consolidation of tasks across Microsoft To Do, Teams channels, Planner, and Outlook Tasks.  Microsoft announced plans to consolidate To Do and Planner last Fall but didn't provide specifics around timing for the new Tasks in Teams experience at that time. Officials said a new Tasks app and Tasks tab would be coming to Teams and that Outlook endpoints would be coming, as well in 2020. With the new Tasks experience in Teams, we are delivering several capabilities that will support new levels of team collaboration.

Industrial robots could 'eat metal' to power themselves

Robots will "eat metal for energy," according to a news article published in Medium. The researchers' vision for a "metal-air scavenger" could solve one of the quandaries of future IoT-enabled factories. That quandary is how to power a device that moves without adding mass and weight, as one does by adding bulky batteries. The answer, according to the University of Pennsylvania researchers, is to try to electromechanically forage for energy from the metal surfaces that a robot or IoT device traverses, thus converting material garnered, using a chemical reaction, into power. "Robots and electronics [would] extract energy from large volumes of energy dense material without having to carry the material on-board," the researchers say in a paper they've published in ACS Energy Letters. It would be like "eating metal, breaking down its chemical bonds for energy like humans do with food." Batteries work by repeatedly breaking and creating chemical bonds. The research references the dichotomy between computing and power storage.

Healthcare AI for Individuals

AI has already drastically reduced the cost of sequencing and is bound to reduce the cost even further. As we move forward, the use of AI can help boost precision medicine available to each and every one. According to the Precision Medicine Initiative, precision medicine can be defined as “an emerging approach for disease treatment and prevention that takes into account individual variability in genes, environment, and lifestyle for each person.” With an increasing number of datasets, the Healthcare industry can leverage the fast computational techniques that our AI-based systems have in their artillery. In place of treating generalized symptoms, AI can help medicine shift towards prevention, personalization, and ultimately precision medicine. This will help in the medication of individuals precisely for themselves and could potentially improve lifespan by a year at average globally. 

Latest Version of Open Source IPFS Improves Performance

IPFS is a distributed file system that makes use of a global namespace to connect all computing devices. The fundamental difference between IPFS and other distributed file systems is a decentralized system of operators who hold a portion of the overall data, which serves to create a highly resilient system for storing and sharing files. Any operator on the network can serve a file by its content address, and IT teams can find and request content from any node using a distributed hash table (DHT). Molly Mackinlay, project lead for IPFS and a senior product manager for Protocol Labs, which provides protocols, systems and tools to improve how the internet works, said the latest 0.5 update to IPFS significantly improves the content routing performance in addition to adding support for the Transport Layer Security (TLS) protocol. IPFS can now also add files to the IPFS network twice as fast, in addition to performance improvements that have been made to the core file transfer mechanism.

Critical SaltStack vulnerability affects thousands of datacentres

Successfully exploited, they enable attackers to execute code remotely with root privileges on Salt master repositories, meaning they could, for example install backdoors into systems, carry out ransomware attacks, or take over systems to mine cryptocurrencies. F-Secure said it had already found 6,000 such repositories openly vulnerable on the public internet. F-Secure principal consultant Olle Segerdahl said this meant the vulnerabilities were particularly dangerous and urged Salt users to download two new patches – versions 3000.2 and 2019.2.4 – that were issued by SaltStack on 29 April 2020, prior to the co-ordinated disclosure. “Patch by Friday or compromised by Monday,” said Segerdahl. “That’s how I’d describe the dilemma facing admins who have their Salt master hosts exposed to the internet.” Segerdahl said the 6,000 Salt masters he found during the course of his research, which are popular in environments such as Amazon Web Services (AWS) and Google Cloud Platform (GCP), were of particular concern.

Google open-sources faster, more efficient TensorFlow runtime

Google today made available TensorFlow RunTime (TFRT), a new runtime for its TensorFlow machine learning framework that provides a unified, extensible infrastructure layer with high performance across a range of hardware. Its release in open source on GitHub follows a preview earlier this year during a session at the 2020 TensorFlow Dev Summit, where TFRT was shown to speed up core loops in a key benchmarking test. TFRT is intended to address the needs of data scientists looking for faster model iteration time and better error reporting, Google says, as well as app developers looking for improved performance while training and serving models in production. Tangibly, TFRT could reduce the time it takes to develop, validate, and deploy an enterprise-scale model, which surveys suggest can range from weeks to months (or years). And it might beat back Facebook’s encroaching PyTorch framework, which continues to see rapid uptake among companies like OpenAI, Preferred Networks, and Uber.

Facebook releases its 'Blender' chatbot as an open-source project

FAIR has focused on three specific behaviors -- the ability to display empathy, personality and knowledge -- to further humanize Blender’s responses. But it’s not so much that Blender can produce those three behaviors so much as it can switch seamlessly between them as the conversation progresses thanks to its unique Blended Skill Talk feature.  “We, in the past two years of research, have designed tasks for each one of these skills,” Emily Dinan, a research engineer at FAIR, told Engadget. “This is the first time we've really shown that you can blend all of these aspects of conversation seamlessly in one. Our evaluation setup showed that models that were fine-tuned on these nice conversational skill datasets are more engaging and consider more human, more lifelike than models which were not.” This means that Blender is emotionally smart enough to know to congratulate you if you tell it you just got a promotion at work and offer condolences when you reveal that your dog just died. FAIR has also taught it to give more than rote cursory responses when asked about a particular subject.

CorePlus: A Microsoft Bot Framework v4 Template

After working on a pioneering project with Microsoft Bot Framework v3, I realized the need to restart studying the platform almost from scratch. Microsoft was releasing a new version with lots of breaking changes. Actually, a completely different framework that rendered obsolete all v3 projects. BFv4 is a complete re-write of the framework with new concepts, terminology, documentation, architecture, etc. Quoting Microsoft: Bot Framework SDK V4 is an evolution of the very successful V3 SDK. V4 is a major version release which includes breaking changes that prevent V3 bots from running on the newer V4 SDK. Microsoft has developed a number of samples to help you get started with the Bot Builder SDK v4, as well as a set of templates powered by the scaffolding tool Yeoman. This article introduces CorePlus, a Microsoft Bot Framework v4 template that I have created, based on a previous version of the Core Bot template (Node.js) supported by the generator-botbuilder Yeoman generator.

---

Quote for the day:

"Pull the string and it will follow wherever you wish. Push it and it will go nowhere at all." -- Dwight D. Eisenhower

---

Daily Tech Digest - April 30, 2020

Why the Public Versus Private Blockchain Debate Is the Wrong Conversation

The conversation regarding public versus private blockchain doesn’t have to be a polarizing one. It’s not an either/or debate but rather a question of application. Private blockchains don’t have to be viewed as the enemy, or a replacement for public ones. They are simply a case-specific option. When taken out of the theoretical arena, there is room for both open read-and-write blockchains and those with access restrictions. What we find in practice, having developed numerous blockchain applications for both entrepreneurs and intrapreneurs, is that the apparently different requirements of each tend to converge over time. That is, many applications built by entrepreneurs will integrate with one or more large corporate enterprises at some point, and will therefore need to address their needs. Similarly, many enterprise applications are tackling obstacles that currently prevent them from making their solutions more open and capable of incorporating tokens of some form. Both sides are invested in the value of bringing integrity around data. 

Cybersecurity staff are being transferred to IT support. That's adding to the risk of data breaches

It's because of the sudden change in working that 47% of those surveyed say they've found themselves reassigned to general IT tasks as organisations adapt to the new reality. In 90% of cases, the security team is working remotely full-time – the remaining 10% that are still going to an office are doing so either because their organisation is sensitive in nature and the work can't be done from home, or the company doesn't have the capability to allow full-time remote work. In many cases, these people would prefer to stay home, but as some respondents put it, "duty calls". In a significant number of cases, those duties involve dealing with a rise in the number of cyberattacks and other security incidents: overall 23% said the number of these had gone up since the transition to remote work and in some cases security teams are tracking double the number of incidents. Worryingly, 30% of those security professionals who've been reassigned to IT say there's been a rise in security incidents against their organisation, compared to 17% who haven't changed roles but say they're dealing with more attacks.

Shade Ransomware Operation Apparently Shuts Down

Jornt van der Wiel, another security researcher at Kaspersky, notes that even though the decryption keys are real, the true motive behind why the Shade operators decided to end their operations may never be known. "Keys can be stolen by a rival gang who put the message on Github, or it can be the real authors," van der Wiel tells Information Security Media Group. "We will never know until law enforcement agencies do some arrests." Those who say they are the operators of Shade, which is also known as Troldesh or Encoder.858, say in their GitHub post that they shut down their operations at the end of 2019 and that they were publishing their decryption keys, which can help security companies create their own tools to help remove the malware and recover any other crypto-locked files. "We are also publishing our decryption; we also hope that, having the keys, anti-virus companies will issue their own more user-friendly decryption tools. All other data related to our activity was irrevocably destroyed," according to the GitHub post. "We apologize to all the victims of the Trojan and hope that the keys we published will help them to recover their data."

Designing software to include older people in the digital world

“If you design for older people, you’re making inclusive choices for design and accessibility for everyone,” says Froso Ellina, product design manager at software development consultant VMware Pivotal Labs. On text, Ellina says that as well as using high colour contrasts and larger sizes, the choice of typography is important. A small number of simple fonts – with sans-serif ones such as Arial often the more accessible choice – can increase readability. Subtitling online videos means they can be used by those with poor hearing or no ability to hear, but also makes these work for those who are in a location where they can’t use audio. Older people can also find it harder to use touch screens due to declining motor skills. Ellina says that one centimetre is a good minimum length for a target area such as a button or link, and it makes sense to leave plenty of space between them. Short-term memory tends to decline with age, which has implications for how software is updated.

AI cannot be recognised as an inventor, US rules

The US Patent and Trademark Office rejected two patents where the AI system Dabus was listed as the inventor, in a ruling on Monday. US patent law had previously only specified eligible inventors had to be "individuals". ... Dabus designed: interlocking food containers that are easy for robots to grasp; and a warning light that flashes in a hard-to-ignore rhythm. And its creator, physicist and AI researcher Stephen Thaler, had argued that because he had not helped it with the inventions, it would be inaccurate to list himself as the inventor. But patents offices insist innovations are attributed to humans - to avoid legal complications that would arise if corporate inventorship were recognised. Some academics, however, have previously suggested this should no longer apply. The European Patent Office has seen a surge in AI-driven filings, according to Powell Gilbert LLP intellectual property law specialist Penny Gilbert. "AI is a fast-evolving field, set to revolutionise many industries, and raises many untested issues around patentability and ownership of inventions that are made using it," she told BBC News.

Reinforcement Machine Learning for Effective Clinical Trials

Machine Learning (ML) is often thought to be either Supervised (learning from labeled data) or Unsupervised (finding patterns in raw data). A less talked about area of ML is Reinforcement Learning (RL) – where we train an agent to learn by “observing” an environment rather than from a static dataset. RL is considered to be more of a true form of Artificial Intelligence (AI) – because it’s analogous to how we, as humans, learn new things – observing and learning by trial and error. ... A simpler abstraction of the RL problem is the Multi-armed bandit problem. A multi-armed bandit problem does not account for the environment and its state changes. As shown in figure 2 below, here the agent only observes the actions it takes and rewards it receives and tries to devise the optimal strategy. The idea in solving multi-armed bandit problems is to try and explore the action space and understand the distribution of the unknown rewards function. 

Get to know edge storage and the technology around it

Edge computing: Data is rarely static and often moves from where users are collecting and using it to the cloud or to a central data center for analysis, processing and storage. But data centers and clouds are often far from where the data is collected. Transmission takes time and inserts latency and inefficiencies into the processing equation. That's time that most organizations using IoT functionality just don't have. For instance, an autonomous vehicle can't wait for an answer on whether to swerve right or left; it needs a real-time response. Edge computing closes that data transmission distance and puts compute and storage closer to where the data is collected. This approach essentially decentralizes the traditional data center. Fog computing: Fog computing refers to a decentralized computing infrastructure in which data, applications, compute and storage sit between where the data originates and the cloud. Fog computing brings the cloud's intelligence, processing, compute and storage capabilities closer to the data for faster analysis and processing. Like edge computing, fog eliminates inefficiencies that come with data transmission and solves privacy and security issues inherent in data transmission.

Data governance matters now more than ever

Records Management is built into the Microsoft 365 productivity stack and existing customer workflows, easing the friction that often occurs between enforcing governance controls and user productivity. For example, say your team is working on a contract. Thanks to built-in retention policies embedded in the tools people use every day, they can continue to be productive while collaborating on a contract that has been declared a record—such as sharing, coauthoring, and accessing the record through mobile devices. We have also integrated our disposition process natively into the tools you use every day, including SharePoint and Outlook. Records versioning also makes collaboration on record-declared documents better, so you can track when edits are made to the contract. It allows users to unlock a document with a record label to make edits to it with all records safely retained and audit trails maintained. With Records Management, you can balance rigorous enforcement of data controls with allowing your organization to be fully productive.

Australian businesses lead in AI deployment but bias challenges still exist: Genpact

Some of the reasons as to why senior executives in Australia are adopting AI is because 41% believe it frees up more time for employees to focus on more important tasks, another 40% see AI as a way to improve customer experience and service, and 39% agree AI offers businesses the ability to leverage data and analytics. Genpact Australia vice president and country manager Richard Morgan said the adoption of AI by Australian businesses signals that executives understand the potential benefits it could deliver. "I think AI is now a way to try to mine information and drive better outcomes for the company themselves, and to give clients a better experience to get them coming back and using your products and services more frequently -- that's the holy grail," he told ZDNet. Australian executives also believe that integrating AI into the talent process could help reduce gender bias in recruitment, hiring, and promotion, the study showed. On the other end of the spectrum, three-quarters of Australians said they are concerned about AI bias and another 67% fear that AI will make decisions that affect them without their knowledge.

Arming yourself against deepfake technology

Deepfakes are likely to continue causing havoc for politicians in the coming years, but equally, modern enterprises could also find themselves under threat. In 2019, the UK boss of an energy company was tricked over the phone when he was asked to transfer £200,000 to a Hungarian bank account by an individual using deepfake audio technology. The individual believed the call to be from his boss, but actually, the voice had been impersonated by a fraudster who succeeded in defrauding the man out of money. Occasions like this, particularly where there are substantial amounts of capital at risk, are reminders that organisations should be on high alert for deceptive fraudsters and arm themselves accordingly.  In sectors such as financial services, vast amounts of customer data are at risk and a breach of information or assets can have detrimental effects on all involved. When data is breached, both the consumer and organisation face potentially large consequences.

---

Quote for the day:

"When you find an idea that you just can't stop thinking about, that's probably a good one to pursue." -- Josh James

---

Daily Tech Digest - April 29, 2020

Overnight digital transformation: Welcome to the year 2025, 60 months early

Welcome to the year 2025, suddenly pushed 60 months forward. It's time to make bold moves forward with technology. Those digital dreams that have been simmering on the back burner need to be brought forward -- and IT professionals need to step up and lead the way. Blackburn and his co-authors even have data that shows boldness with technology moves keeps businesses ahead of the game. Almost half of incumbent companies adopting new digital ways, 47%, saw revenue growth exceeding 10% annually over the past three years, versus 30% of their slower-to-adopt counterparts. To accelerate digital adoption and meet the needs of a suddenly changed world, the McKinsey analysts make a series of recommendations -- which again, mean new roles and leadership opportunities for IT professionals ... This is the time to simplify and focus to avoid being overwhelmed, the McKinsey team adds. "This is perhaps the first global crisis in which companies are in the position to collect and evaluate real-time data about their customers and what they are doing, or trying to do, during this time of forced virtualization.

Sophisticated Android Spyware Attack Spreads via Google Play

Interestingly, researchers observed that the malware’s operators don’t seem interested in widescale infection. In fact, according to the firm’s telemetry, since 2016, only around 300 infection attempts were observed on Android devices — mainly in India, Vietnam, Bangladesh and Indonesia. Other infections, however, were found in Algeria, Iran and South Africa. And, several infections were found in Nepal, Myanmar and Malaysia. “Usually if malware creators manage to upload a malicious app in the legitimate app store, they invest considerable resources into promoting the application to increase the number of installations and thus increase the number of victims,” explained the researchers in the writeup. “This wasn’t the case with these newly discovered malicious apps. It looked like the operators behind them were not interested in mass spread. For the researchers, this was a hint of targeted APT activity.” The types of applications that the malware mimics include Flash plugins, cleaners and updaters.

The Simplicity Principle and why six is the perfect number for better management

Complexity is obvious when you look for it — for example, in Boeing’s 737 Max 8 design, the 500 percent increase in regulation in 25 years within the U.K. pensions industry, or the space shuttle Challenger disaster, which was preceded by warnings that were ignored because they were presented on a PowerPoint slide that has since become notorious for being so dense. Simplicity, however, is often there, hiding in plain sight. It’s not just companies such as Zentatix, dentsu X, and Tata Sons that exemplify it. Apple remains an almost perfect example of a company committed to simple and functional design, despite the back end of its actual product being fiendishly complex. As Philip Davies, a president of Siegle + Gale, told me: “Simplicity is the intersection between clarity and surprise.” This recognizes that simplicity sits neatly on a spectrum ranging from chaos and complication, all the way through to something too simplistic, and is the balancing corrective. Yes, you can have multiple product ranges, with many different iterations and requirements for design, software, manufacturing, sales, service, and so on

5 Ways Your Business Can Benefit From DataOps

DataOps is already enabling businesses to transform their data management and data analytics processes. For example, like DevOps, DataOps lets teams easily spin up isolated, safe and disposable testing environments that allow them to experiment and innovate (Principle 12 of the Manifesto). However, while developers typically focus on applications with small test databases, data analysts and scientists may need to spin up a sandbox environment that includes applications along with terabytes or even hundreds of terabytes of data. By easily implementing intelligent DataOps strategies such as automation, cloning, predictive analytics and more, spinning up massive disposable data environments becomes possible. DataOps principles are also enabling businesses to act on their massive production datasets in ways that were unimaginable just a few years ago. For example, DreamWorks can now easily share the datasets of its films in development with teams of creative artists around the world, enabling rapid collaboration and dramatically shortening production times.

Cybersecurity professionals are being repurposed during COVID-19 pandemic

"Security at this point is a best effort scenario," one respondent commented, according to (ISC)2. "Speed has become the primary decision-making factor. This has led to more than a few conversations about how doing it insecurely will result in a worse situation than not doing it at all." One respondent summed up the factors that have contributed to an opportune situation for cybercriminals–most notably, the fact that 100% of staff are working from home before most organizations were really ready, (ISC)2 said. "COVID-19 hit us with all the necessary ingredients to fuel cybercrime … chaos caused by technical issues plaguing workers not used to [working from home], panic, and desire to 'know more' and temptation to visit unverified websites in search of up-to-the-minute information," the respondent said, according to (ISC)2. Also, remote workforce technology supported by vendors is driven by "new feature time to market and not security," the respondent continued, (ISC)2 said. Other issues the respondent cited were employees taking over responsibilities for COVID-19 affected coworkers who are unfamiliar with the process

A nice taxonomy - Deep Transfer Learning

Deep learning has a very strong dependence on massive training data compared to traditional machine learning methods, because these neurons, layers and every thing in it should get a correct value as its weight after epochs of training. Although everything will be different when it comes to real-world scenarios; it’s far far away from what we learnt. There are cases where training data is expensive or difficult to collect. Therefore, there is a need to create high-performance learners trained with more easily obtained data from different domains. This methodology is referred to as transfer learning. In addition The biggest benefit of transfer learning shows when the target data set is relatively small. In many of these cases, the model may be prone to overfitting, and data augmentation may not always solve the overall problem.

The Value and Purpose of a Test Coach

The test coach role is a fundamental part of Domain Oriented Testing (DOT). It’s a way of instilling into the team a sense of product quality, pride in their code combined with a particular way of working that results in a system that’s more in tune with the business domain and requirements. ... Overall, the test coach is a demanding, highly skilled role. You must have a good grasp of all the disciplines you’re “nudging” the stakeholders towards. You must have great people skills, or at least a knack of presenting things so that people realise you’re on their side, working with them. ... In this agile climate, for many organisations QA has become a dirty word. However unfairly deserved, for many people QA is now synonymous with waterfall, big bang integration, process overload with long forms to fill out, and a department separated from the developers, promoting a “sling it over the fence to the testers” approach to software delivery. But let’s be honest, a test coach’s purpose is very similar to that of QA: to introduce and maintain a process that gets the team focused on software quality.

How the Pandemic Is Pushing Blockchain Forward

Because blockchain technologies are uniquely suited to verifying, securing and sharing data, they’re ideal for managing multi-party, inter-organizational, and cross-border transactions. Over the past five years, enterprises across the globe have vetted the technology with thousands of proofs of concept, but live deployments have been slow to come because partners using blockchain as a shared ledger have to agree on IP rights, governance, and business models. Government regulations have also impeded its widespread use. It has taken the Covid-19 pandemic to push through the obstacles to blockchain adoption. The virus has revealed the weaknesses in our supply chains, our inability to deploy resources where they are most needed to address the pandemic, and difficulties in capturing and sharing the data needed to make rapid decisions in managing it. Blockchain solutions that have been under development for years have been repurposed and unleashed to address these challenges.

Microsoft: This is how to protect your machine-learning applications

It's a long list of attack types, but understanding what's possible allows us to think about the threats our applications face. More importantly they provide an opportunity to think about defences and how we protect machine-learning systems: building better, more secure training sets, locking down ML platforms, and controlling access to inputs and outputs, working with trusted applications and services. Attacks are not the only risk: we must be aware of unintended failures -- problems that come from the algorithms we use or from how we've designed and tested our ML systems. We need to understand how reinforcement learning systems behave, how systems respond in different environments, if there are natural adversarial effects, or how changing inputs can change results. If we're to defend machine-learning applications, we need to ensure that they have been tested as fully as possible, in as many conditions as possible. The apocryphal stories of early machine-learning systems that identified trees instead of tanks, because all the training images were of tanks under trees, are a sign that these aren't new problems, and that we need to be careful about how we train, test, and deploy machine learning.

Developing Reactive REST APIs With Quarkus

This article describes how to implement reactive REST APIs in Java with Quarkus rather than using synchronous endpoints. In order to do this, the Java classes CompletableFuture and CompletionStage are needed. The article explains how to use these classes and how to chain asynchronous method invocations including exception handling and timeouts. The first question you probably ask is, why should you change old habits and not use imperative code? After all implementing asynchronous code is rather unusual for some Java developers and requires a new thinking. I think the short answer is efficiency. I’ve run two load tests where I compared reactive code with imperative code. In both cases the response times of the reactive code was only half of the duration of the imperative code. While these tests are not representative for all types of scenarios, I think they demonstrate nicely the benefits of reactive programming.

---

Quote for the day:

"If liberty means anything at all, it means the right to tell people what they do not want to hear." -- George Orwell

---