Daily Tech Digest - January 24, 2020

Top 10 IT & Technology Buzzwords You Won’t Be Able To Avoid In 2020

While IoT was a prominent feature of buzzwords 2019, the rapid advancement and adoption of the internet of things is a trend you cannot afford to ignore in 2020. This leads us to the next of our buzzwords in IT: connected retail. To explain this most essential of 2020 buzzwords: connected retail is the seamless bridge between physical and digital retail, creating a connected, cloud-based ecosystem for enhanced consumer experience and advanced data collection. Such innovations offer the ability to transfer data over a network, creating valuable experiences for both the consumer and the business itself. Connected retail is a buzzword in IT worth mentioning as it will become integral in 2020, with countless applications that offer unique data opportunities to brands across sectors. Take Walt Disney World, for instance. An innovator in the field, Disney launched a smart wristband that allowed guests to tailor their experience within the park. Working with various touchpoints and sensors, guests benefit from a wealth of tailored park information while receiving bespoke deals, discounts, and offers as they interact with the landscape around them.

Why Visual AI Beats Pixel and DOM Diffs for Web App Testing

Functional testing alone cannot help you find unexpected additions to your page. In the new version of the page as shown in the example below, terms and conditions get added at the bottom of the form. The new content requires a test for the new T&C external link (which may link to a new page, or to a hovered text box). If you forget to add a test for the new link, you are blind to its existence and blind to whether or not it behaves correctly. ... Visual AI uses computer vision technology that has been applied in everything from security systems to self-driving cars. Visual AI identifies visual elements that make up a screen or page capture. Rather than inspect pixels, Visual AI recognizes elements as elements with properties (dimension, color, text) and uses the properties of a checkpoint element to compare it to the baseline. The screens get compared at the element level, rather than the pixel level. DOM inspection helps Visual AI identify visual elements for comparison, but Visual AI ignores DOM differences. With Visual AI, you discover visible differences and ignore trivial differences.

VMware targets SD-WAN management with Nyansa acquisition

Combining VMware’s SD-WAN package with Nyansa’s cloud-based AIOps platform offering, “users will have access to a single platform that can deliver comprehensive and actionable data on network traffic and application performance from the cloud, to branch offices, to the end user and across their wired and/or wireless devices,” wrote Sanjay Uppal, VP and GM, VeloCloud Business Unit, VMware in a blog about the acquisition. “Nyansa can proactively predict client problems, optimize their network, better enable the behavior of critical IoT devices, and justify infrastructure changes based on actual user, network and application data," Uppal stated. “The combination of Nyansa’s AI/ML capabilities with VMware’s existing analytics, visibility and remediation capabilities will make it easier for [customers] to operate and troubleshoot the virtual-cloud network and accelerate the realization of a self-healing network.” The Nyansa buy, expected to close in the first quarter of VMware’s fiscal year, would be the company’s ninth acquisition in the past 13 months.

Quantum-Proof Cryptography: How It Would Work

Researchers are attempting to develop new forms of cryptography that could not be cracked by powerful quantum computing devices that are in the works. That requires devising public key cryptosystems based on computational problems that are difficult to break even using quantum algorithms, says Divesh Aggarwal, principal investigator at Singapore's Center for Quantum Technologies. "The essential idea is you have to come out with a computational problem that you can base public key cryptosystems on and for which we don't know how to solve these problems using quantum algorithms," Aggarwal says in an interview with Information Security Media Group. Today's most widely used cryptosystem - RSA - is based on the problem of factoring integers, and this could be easily solved or broken by quantum computers once they're developed, he says. The National Institute of Standards and Technology in the U.S. is working on standardized quantum proof cryptographic keys, he notes.

7 things your Android phone can do that iPhone owners can only dream of

iPhone users have Siri, but Android gives you Google Assistant. Google Assistant is a much more sophisticated tool than Apple's Siri for a slew of reasons, but the most important one is that it makes use of Google's impressive database. Google Assistant can understand common requests for businesses and names, and it gets requests right more often than wrong. It also returns high-quality responses, drawing from Google Search, a tool that Siri doesn't have access to. Google Assistant also tightly integrates with the phone's other functions, to tell you when it's time to leave for your next meeting and warn you that traffic will be heavy on the way home. If you have any Google Home or Nest Home smart speakers or other compatible devices, you can also use Assistant on your phone to control smart devices around your house like lights, outlets or your thermostat -- even from afar. And it's built right into your Android device. "OK, Google" and "Hey, Google" are the two wake phrases. If you need help knowing what to ask, you can ask Google Assistant for a list of commands: "OK, Google, What can you do?"

Fast String Matching with Wildcards, Globs, and Gitignore-Style Globs

Wildcard string matching and globbing isn’t as trivial as it may seem at first. In fact, mistakes in the past resulted in serious vulnerabilities such as denial of service. Simple patches, such as limiting the number of matches to limit the CPU time, have been applied to fix implementations that suffer exponential blow-up in execution time. More disconcerting is that buggy globbing implementations can be easily located on the Web: just search for wildmat.c to find copies of implementations that may crash when a character class range is incomplete, ... To understand how globbing implementations may cause denial of service, we will take a quick look at some examples. Recursion is often used in simple implementations of wildcard matching with * and ?. The idea is to scan the pattern and the string from left to right while pairwise matching the characters. When a star is encountered in the pattern, the do-match function is recursively called to compare the rest of the pattern to the rest of the string.

MDhex vulnerabilities impact GE patient vital signs monitoring devices

The MDhex security flaws, according to CyberMDX experts, allow an attacker with access to a hospital's network to take over vulnerable patient monitors and/or telemetry aggregation servers, and then silence alerts, putting patient lives at risk. Besides the CyberMDX advisory, the Department of Homeland Security has also published security advisories today meant to warn healthcare providers about the MDhex vulnerabilities. The DHS CISA and FDA advisories contain mitigations that hospitals and clinics can deploy to prevent attackers from exploiting the devices. The general advice is to place these devices on their own separate networks, not connected to the internet, and isolated from any other hospital systems. Patches are not available at the time of writing. A GE Healthcare spokesperson told ZDNet in an email this week that the company plans to release software updates in Q2 2020 to address the reported MDhex issues. According to CyberMDX experts, the vulnerabilities are as bad as they can be, with five out of the six MDhex bugs receiving a rating of 10 out of 10 on the CVSSv3 severity scale.

The Doomsday Clock just moved closer to midnight again. Tech is getting some of the blame.

The group of scientists warned that several major arms control treaties and negotiations have ended or been undermined during the past year, creating an environment conducive to a renewed nuclear arms race. They warned that government action on climate change still falls short. But they also said that threats to the "information ecosphere" -- like the spread of misinformation and fake news -- could also create dangerous global instability. Ongoing disinformation campaigns are corrupting the decision-making processes needed to tackle nuclear and climate threats, the scientists said. "In the last year, many governments used cyber-enabled disinformation campaigns to sow distrust in institutions and among nations, undermining domestic and international efforts to foster peace and protect the planet," the group said. While countries have long attempted to use propaganda to drive their particular political agendas, the internet now provides widespread, inexpensive access to worldwide audiences. The recent arrival of 'deepfake' audio and video could also undermine our ability to separate truth from fiction.

Cisco issues firewall, SD-WAN security warnings

The vulnerability is due to the existence of default credentials within the default configuration of an affected device, Cisco stated. An attacker who has access to an affected device could log in with elevated privileges. This vulnerability affects Cisco devices that are running Cisco IOS XE SD-WAN Software releases 16.11 and earlier. The second SD-WAN-related problem is in CLI of the Cisco SD-WAN Solution vManage software. An exploit could let the attacker elevate privileges to root-level privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted file to the affected system. This vulnerability affects Cisco SD-WAN Solution vManage Software Release 18.4.1, Cisco stated. Cisco said it has released software updates for both SD-WAN vulnerabilities. A couple of the other highly rated vulnerabilities were in Cisco’s implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.

Blazor State Management

For the best possible user experience, it's important to provide a consistent experience to the end user when their connection is temporarily lost and when they refresh or navigate back to the page. The components of this experience include: The HTML Document Object Model (DOM) that represents the user interface (UI); The fields and properties representing the data being input and/or output on the page; and The state of registered services that are running as part of code for the page. In the absence of any special code, state is maintained in two places depending on the Blazor hosting model. For Blazor WebAssembly (client-side) apps, state is held in browser memory until the user refreshes or navigates away from the page. In Blazor Server apps, state is held in special “buckets” allocated to each client session known as circuits. These circuits can lose state when they time out after a disconnection and may be obliterated even during an active connection when the server is under memory pressure.

---

Quote for the day:

"And how does one lead? We lead by doing; we lead by being." -- Bryant McGill

---

Daily Tech Digest - January 23, 2020

AI in manufacturing is stalled by lack of data infrastructure and internal buy-in

The Gartner Hype Cycle for Artificial Intelligence 2019 examines the stream of innovations and trends in the AI sector and scopes AI plans. Artificial general intelligence is at the very start of the curve with quantum computing and chatbots at the peak of inflated expectations and autonomous vehicles in the trough of disillusionment, according to Gartner. Gartner analyst Laurence Goasduff said that there are many new technologies in this year's hype cycle but only a few are fully understood and even fewer are seeing mainstream adoption. Plutoshift surveyed 250 manufacturing professionals in October 2019. The blind survey was completed online and responses were random, voluntary, and anonymous. According to the survey, some of the worrying signs about AI in the manufacturing sector include: 61% said their company has good intentions but needs to reevaluate how AI projects are implemented; 60% said their company struggled to come to a consensus on a focused, practical strategy for implementing AI; 26% said their company implemented AI projects even though other contingencies (e.g.IT infrastructure, market readiness, etc.) were outstanding

How Automation, AI and Agile are Enabling Smart Next-Generation Banking

Continuous Delivery is the foundation of business agility in the digital age and is a prerequisite for any financial company wishing to compete against digitally native neobanks and fintechs. Take our example from earlier of one of the world’s largest banks. Through its engagement with Infostretch, it was able to retire its legacy tools and move to a continuous delivery framework that accelerated time to market, increased the quality of its digital solutions while creating significant cost and time efficiencies across the entire development lifecycle. Or, consider a leading national bank we worked with where continuous delivery enabled it to enhance its entire value stream, from opportunity identification to product release. For companies whose growth has started to accelerate, their digital infrastructure must be able to scale. This is exactly how we helped GlobeOne to build out its development infrastructure to support rapid growth. ... Similarly, smart analytics can shine a light on to customers’ needs.

Ransomware, snooping and attempted shutdowns: See what hackers did to these systems left unprotected online

As more cyber criminals and hackers discovered the honeypot – under the impression it was a fully operational industrial environment – researchers saw the attacks being deployed get more advanced. A number of attackers performed reconnaissance on the network, likely in an effort to see what could be taken control of or to uncover sensitive data to steal. Some of these attackers even went so far as to enter commands to shutdown systems, something that could have had a big impact in a real smart-factory environment. Shutdown attacks repeatedly happened during the duration of the honeypot. By September, the honeypot was attracting large amounts of interest from malicious hackers and MeTech was targeted with a ransomware attack that allowed the researchers to monitor how such an incident unfolds. This started with an attacker investigating the systems and conducting reconnaissance across the network in an effort to uncover what they were dealing with. Then, using remote desktop functions and access to TeamViewer, this attacker deployed a variant of Crysis ransomware onto the network, demanding $10,000 in Bitcoin to decrypt the network.

As Hackers Target Mobile Payment Apps, Here's How to Keep Them at Bay

In the first scenario, the fraudster takes over an existing Smoothie Shop account. Since the account already has a credit card saved in the app, the fraudster can simply walk over to a Smoothie Shop, present the mobile app with the saved credit card information, and enjoy a refreshing smoothie that was paid for with someone else's stored credit card. In a second scenario, the fraudster takes over a Smoothie Shop account again, except this account lacks a saved credit card. That in turn prompts the fraudster to buy a stolen credit card off the Dark Web or some other electronic market, then add the newly obtained card to the Smoothie Shop account and app. They can then proceed to the closest shop to buy smoothies using the stolen credit card.  Why would fraudsters go through the trouble of taking over an existing account instead of just creating a brand new account to commit fraud? It's because savvy fraudsters know that "aged" accounts more than 3–6 months old with a good transaction history are less closely scrutinized than a brand new account with no transaction history.

Angular - The Future of Enterprise Application Development

Enterprise solutions run on multiple components built by multiple teams. This puts extra pressure on developers in terms of scaling and actualization. A modern web application has to be sensitive for the reaction from users and deliver impeccable performance because there are no second chances. Small and fast app development is one of the core focus areas of Angular today. The recent release of Angular 2.0, a complete re-write of the development framework from 1.0 to take full advantage of modern web and native mobile platforms, including greater modularity, support for modern browsers, TypeScript support in addition to several other feature areas. Also in the latest Angular 8.0 version, they introduced the new IVY framework which will reduce all the project size in KBS. Angular application development can increase speed and reduce codebase size. Angular team has committed to ensuring stability and a smooth forward transition between releases. The team is also heavily invested in providing tools to empower developers to seamlessly upgrade between versions in an automated way.

Developing Mobile Applications in .NET

In the traditional Xamarin approach, you create a new project for a single platform (Android or iOS). In this case, native technologies are used for creating the views (layouts in Android XML files for Android, and storyboards for iOS). ... The code for the views is still written in C# instead of Java, Kotlin, Objective C or Swift and uses .NET base class libraries. Thanks to the .NET binding libraries provided by the Xamarin platform, Native platform-specific APIs can also be invoked directly from C#. ... It’s somewhat similar to WPF and UWP in that it is XAML-based and works well with the MVVM pattern. (You can read more about WPF and UWP, and XAML in my tutorial from the previous issue of DotNetCurry Magazine – Developing desktop applications in .NET.) However, the control set is completely different because under the hood it’s just an abstraction layer on top of the traditional Xamarin approach. This means that individual controls are rendered differently on different platforms: each Xamarin.Forms control maps to a specific native control on each platform.

How to protect your organization against targeted phishing attacks

If you want to truly make a change—meaning a mindset and behavior shift that has a positive, day-to-day impact on your organization—you must commit to bringing cybersecurity to the forefront. Remember that anyone in your organization can be a target of a phishing scam and that anyone in your organization can help or hurt your security posture. Everyone in your organization should know how they can be more cyber-secure. A broad, companywide security awareness training program will help you do that. Some 78% of the organizations surveyed for the report said they found a reduction in their phishing susceptibility due to their security awareness training. You may be familiar with the "five Ws and H" that guide journalists, researchers, and investigators: who, what, where, when, why and how.  At a minimum, answer these three first: 1) Who in my organization is being targeted by attackers? The answer is not as simple as looking at the top tiers of your org chart; 2) What types of attacks are they facing? Knowing the lures and traps attackers are using can help you better position your defenses; and 3) How can I minimize risk if these attacks get through? The answer is to use the information you've gathered to deliver the right training to the right people at the right time.

Create a cost-efficient data backup plan that's also reliable

Perhaps the best and easiest way to save money is to avoid backing up data that isn't necessary for business, compliance or legal needs, noted James Meadows, managing partner at national law firm Culhane Meadows. "For example, if you're not storing or processing personally identifiable information, it's likely that it may not be necessary to comply with the multitude of standards and protections applicable to PII," Meadows said. Vetting data for backup need and frequency should begin with identifying and defining each data type. All parties within the organization who know about the use and value of each data type should review them. "As an attorney, I would strongly suggest that legal counsel be consulted for any contractual and/or regulatory standards that may need to be considered," Meadows said. Only when you address and resolve these issues can you begin actual work on the data backup plan.

Survey: Digital transformation can reveal network weaknesses

The study looked at networking and security priorities for IT professional in 2020. As part of that process, the study sought to identify how ready enterprise networks are for the digital era. According to the report, “The modern business has data and users residing everywhere. And just as the enterprise network provided performance and security to data centers and branch offices in the past, so, too, it must provide performance and security to the cloud and mobile users—both hallmarks of digital initiatives.” Without a network that delivers the right infrastructure with the right performance and security levels anywhere, digital transformation efforts can run aground. 1,333 respondents took part in the survey in late 2019. Qualified respondents were those who work in IT and are involved in the purchase of telco services for enterprises with an SD-WAN or MPLS backbone (or a mix of MPLS and Internet VPN). The vast majority of the respondents say they are moderately or extremely involved in their organization’s digital transformation initiatives.

2 cloud and AI myths you shouldn’t believe

Going back to Gartner, analyst Nick Heudecker once suggested that roughly 85 percent of big data projects fail. Two years later, IDC zeroed in on big data related AI projects and pegged the failure rate at 50 percent (for one quarter of respondents). From such survey data was born countless headlines that all basically screamed, “Most AI projects fail.” Implicit in such headlines is an accusation that the technology behind AI is immature. While AI will undoubtedly continue to advance, the fundamental truth is somewhat different. For one thing, as analyst Lawrence Hecht once told me, sometimes executive ambition to go big on AI exceeds a company’s ability to deliver: “These projects are destined to fail if there is no underlying technology need. Yes, I understand that C-levels are needed to lead everyone towards change, but sometimes it seems it’s just for change’s sake.” The problem isn’t so much that “AI is failing” as we are failing to properly prepare for what we expect AI to do. And here youth might be at fault, at least in part.

---

Quote for the day:

"The role of leadership is to transform the complex situation into small pieces and prioritize them." -- Carlos Ghosn

---

Daily Tech Digest - January 22, 2020

This new startup aims to make developers love security

The accelerating speed of development teams and the failings of traditional perimeter and agent-based security solutions in cloud-native environments. With regard to the first trend, writes Vadlamani: It allows engineers to specify their infrastructure composition in a declarative language, allowing them to use the same versioning and release management workflows as for their source code. It greatly simplifies the work associated with deployment, testing and rollbacks. It allows them to be truly agile, spinning up new services in rapid succession to respond to changing business needs, and massively reduces the "busy work" associated with setting up the right environment and providing the runtime for their software. While that's great for development, it potentially creates new security issues that traditional security solutions are a poor fit to solve. Even the best security teams may struggle with threat detection and incident response in this cloud-native world. Perimeter defenses don't really work in this environment. In addition, it's difficult to deploy agents across these new ephemeral solutions, and requires security teams to manually manage changing policies, certify deployments, and respond to alerts.

Microsoft discovers new sLoad 2.0 (Starslord) malware  

According to a Microsoft report from December 2019, sLoad had become one of the few malware strains that ported its entire host-server communications systems to the Windows BITS service. For those unfamiliar with the term, Windows BITS is the default system through which Microsoft sends Windows updates to users all over the world. The BITS service works by detecting when the user is not using their network connection and utilizing this downtime to download Windows updates. But the BITS service is not entirely reserved for the Windows Update process. Other apps can tap into BITS and use it to schedule tasks and network operations to take place when the computer's network connection goes idle. The sLoad authors appear to be some of the biggest fans of this service. Microsoft says that the malware's entire network stack was configured to work via the Windows BITS service of an infected host. The malware would set up BITS scheduled tasks that would execute at regular intervals. These tasks would be used to talk with its C&C server, download secondary malware payloads, and even send data from an infected host back to the C&C server

AI Will Give Rise To FinTech 2.0 And Longevity Banks

In the next few years, age-friendly FinTech companies and Longevity Banks will develop new financial products designed for clients who are planning to live extra long lives and want to remain high functioning and financially stable throughout. Clients of Longevity Banks will have more time to accumulate wealth, will have a longer investment horizon, and will benefit from compounding. Financial services innovators have an opportunity to enhance the financial lives of a billion people by designing new solutions and adapting existing products and services. ... The Longevity AI Consortium at King’s College London is developing sophisticated methods for translating advanced AI for Longevity solutions including novel applications of life data for insurance companies, pension funds, healthcare companies, and government bodies. This year the Consortium is planning to expand to Switzerland, Israel, Singapore, and the US. Progressive investment banks, pension funds, and insurance companies are developing new business models, and are using AI to improve the quality of the analytics used to formulate them.

How Google’s influence on AI is becoming key to business success

Google is the obvious version of that, especially as they’re so far ahead, but some of the good practices we can adopt to make things better for Google, such as consistency and clean, structured data) will be useful throughout business transformations. The past decade alone has seen huge leaps in Google’s capabilities and focus on AI, with the arrival of Google Assistant in 2016 and the Neural Matching algorithm introduced in 2018, to deliver more diverse search results by analysing language on a deeper level than previous algorithms. For the first time, Google could match words to concepts and figure out what a user wanted from a looser search. Google’s commitment only looks set to grow, with the company’s co-founder, Larry Page, taking a particularly close interest in AI, revealing that: “Google will fulfil its mission only when its search engine is AI-complete.” Google is definitely, absolutely committed to AI. Larry Page is committed, and it is viable in both short-term, by being able to out-analyse competition, and the long-term, the consequences of being the first creator of anything resembling true AI is vast.

A brave new workless world

Daniel Susskind, an Oxford professor and former government advisor, believes that work “is so entrenched in our psyches that there is often an instructive resistance to contemplating a world with less of it, and an inability to articulate anything substantial when we actually do.” His argument in A World without Work, a useful and farsighted book on the subject, is threefold: that within our lifetime, automation will result in insufficient work to go around; that this structural technological unemployment, if ignored, would make our already unfair world vastly more unequal; and that to prevent this outcome, governments’ approach to labor policy needs to be entirely rethought. Of these three strands, Susskind’s first is his most convincing. To be sure, he acknowledges, workers have regularly panicked unnecessarily about being replaced by machines. But this time, he argues, the threat is real. His best evidence of the frightening pace at which AI is developing comes through attempts to build robots to play chess and Go. For years, scientists followed an approach of trying to copy human thought and behavior.

The Human Screenome Project will capture everything we do on our phones

One of the biggest obstacles to the project’s success is likely to be that it raises fears around privacy. Having an app quietly record your activity every five seconds is a hard sell. If the past few years have shown anything, it’s that even the most inane activities online are tracked. That information is sold to advertisers at best, or to hackers and disinformation campaigns at worst. The Cambridge Analytica scandal highlighted how personality tests shared between acquaintances on Facebook were weaponized by Russians in the 2016 American election, for example. And consider what passes across our phone screens every day: bank account information; emails carrying personal data; car-sharing routes detailing addresses of destinations; meal delivery orders; texts with our loved ones; photos and videos of children; even pornography, cryptocurrency exchanges, and illicit activity. “It’s a lot of sensitive information,” Reeves concedes. His team has amassed around 30 million screenshots from volunteers in the US as well as China and Myanmar.

Modern Android App Architecture with JetPack and Dropbox Store

Dropbox recently took ownership of the open-source Store library to revamp it and bring it closer to the current Android developer ecosystem. Originally developed at the New York Times, Store has been rewritten in Kotlin on the foundations provided by Coroutines and Flow. Along with Google JetPack collection of libraries, Dropbox Store provides a solution to create modern Android apps. When Google introduced JetPack, it set an ambitious goal for it: accelerating development of high-quality apps for the Android platform. Two key ideas drove the design of JetPack towards that goal. On the one hand, JetPack aims to leverage advanced Kotlin features to reduce boilerplate code programmers had to write. On the other hand, it also provides higher-level abstractions on top of those found in the Android SDK, such as Fragments and Activities, to allow them to express complex tasks in a simpler way. JetPack includes a number of components that can be used independently on one another and cover four main concern areas: Foundation, Architecture, Behavior, and User Interface, as shown in the following image.

How remote work rose by 400% in the past decade

The report found that the rise of remote work popularity is thanks to the evolution of supporting technologies including powerful mobile devices, ultra-fast internet connections, and proliferation of cloud-based storage and SaaS solutions. "The rise of cloud-based SaaS software has been instrumental to the growth of remote work," de Lataillade said. "Employees can now instantly connect and collaborate with colleagues around the world at any time." Employees definitely took advantage: The majority (78%) of employees said they work remotely some of the time; more than half (58%) said they work remotely at least once a month; and, 36% of respondents said they work remotely at least once a week, the report found. While 36% might not seem like a huge percentage, it's a significant jump from 10 years ago. In 2010, the US Census Bureau found that only 9.5% of employees worked remotely at least once a week, indicating that the number of people working remotely on a weekly basis has grown by nearly 400% in the last decade, according to the report.

Microsoft and Google just can't agree on proposed ban on facial recognition

Speaking at a conference in Brussels on Monday, Pichai said it was important for governments to tackle regulatory questions over facial recognition and, more broadly, AI "sooner rather than later", and that the ban can be "immediate but maybe there's a waiting period before we really think about how it's being used".  ... "Accountability is an important part of our AI principles. We want our systems to be accountable and explainable and we test it for safety," Pichai told the thinktank Bruegel, which organized the conference. "I think inevitably doing that we assume it will involve human agency and humans to review it, and we specifically mention we want these systems to be accountable to society at large. And I think regulation should play a role in that as well." The European Commission acknowledges in its proposal that a temporary ban on facial recognition would "be a far-reaching measure that might hamper the development and uptake of this technology", therefore it would prefer to use existing regulatory instruments available under GDPR.

The Role of Developers in Digital Transformation

Firstly, efficient code delivered in a timely manner should be the goal of every developer. Testing and QA will, of course, reveal issues, and no one is perfect, but developers must be mindful of the impact inefficient or inaccurate code can have on a business. Workarounds may get you past a problem, but this is not best practice and leaves the business exposed should a client pick up on it–especially if the workaround causes more serious issues further down the line. Fewer bugs or defects means scrum meetings can naturally focus more on strategy and new initiatives that might help grow the business. Organizations should therefore establish best practices and coding guidelines to reduce the temptation for workarounds, ensuring code releases are reliable and ready for the production environment. Developers must also be able to comprehend the requirement to work with designs given to them by design teams, as these will align with customer expectations. Being able to dynamically incorporate client feedback into the development process is also key, particularly for those working with continuous delivery and continuous integration pipelines.

---

Quote for the day:

"Everyone carries a bucket of water and a bucket of gas in life. A leader has learned to throw the right one at the right time." - Orrin Woodward

---

Daily Tech Digest - January 21, 2020

How low-code helps CIOs accelerate digital transformation

As digital transformation has become the main agenda, CIOs are using technology strategically and leveraging digital opportunities. The fact that in 2019, 40% of technology spending (more than $2 trillion) is estimated to have been assigned to digital transformation initiatives, adoption of emerging technology has become the biggest objective for enterprises. The app economy plays a crucial in driving digital transformation and business innovation. CIOs have to consider the people, platforms, and processes that will cater to the increasing demand for modern applications. The increasing demand for enterprise applications has led to the increasing adoption of low-code platforms in the Application Development & Delivery (AD&D) market. Enterprises are working towards leveraging agile practices and incorporating development techniques to create a minimum viable product (MVP). CIOs and IT leaders have to determine what practices, what type of technology and the skills required to achieve modernisation.

.NET Core: Writing Really Obvious Code with Enumerated Values in gRPC Web Services

gRPC services support using enumerated values (enums) when creating the .proto file that drives your gPRC service and the clients that access it (for more on how that works, see the column I wrote on creating gRPC services and clients). Since the definitions of the messages that you send to and receive from a gRPC service are converted into C# classes, defining enums in your .proto file gives you the same ROCing benefits that defining enums in your code does. ... If you prefer Pascal-cased names in your code then you'll need to deploy underscores strategically. To get CreditLimit as the name of your enumerated value, you'll need to name the field using an underscore before "limit" in your .proto file (e.g. Credit_Limit, CREDIT_LIMIT, or credit_limit would do the trick). One last note on the default value: A client can't tell the difference between a property that's been set to the default value for your enum and a property that hasn't been set at all. A best practice, therefore, would be to make the default value for your enum (the one in position 0) to be the "no value available" option and never use it. That way a client can tell when the property hasn't been set.

Solving the Big Data, Small Returns Problem in 2020

All technicians are humans, but not all humans are technicians. If we are going to build a new world, we should build it from the ground up and from a human-centric angle. We need to flip the model of thinking from data and tech-first to use case first. To make this possible, we finally need to get around to answering three basic, yet wildly complicated questions: What data do we have? Where is it? And how do we get value from it? We’ve learned that having more data doesn’t equate to having better insights. So we need to collect data specific to our questions. We still have to work with legacy architectures and infrastructures that have been cobbled together over time, and data in various forms from different sources that were never designed to work together in harmony. So we need to be meticulous about where we keep our data and how we organize it, so that it’s visible and accessible. And as far as getting value from data, we need to put the human element back into analytics. The analytics will only be as good as the person that asks challenging questions. That person should not have to have a technical background to do so.

Why The Digital Economy Is Set For A Correction

There’s certainly an expectation that one of the consequences of Digital is that things just get cheaper and consequently, we can consume more of them. But how do these things become cheaper and what are the consequences of falling real prices? Two things, above all else, have contributed to the decline in real prices for the digital-meets-physical category: taxation and algorithmically driven labour efficiency. Tax minimisation is facilitated by an international tax regime dating back to the 1920s, when it was reasonable to tax corporations based on physical presence. This doesn’t really work in a world of transfer pricing, where rents can be extracted from subsidiaries in high-tax locations for the use of corporate intangible assets such as brands, patents, and software, thus minimising profits. Taxation will, eventually, get sorted. France and, surprisingly, the UK seem to be leading the way on this. The decline of unit labour inputs is another matter. If we think about the design of, for example, a work management system used in a warehouse, its major purpose is to avoid employee downtime.

The Move to Multiple Public Clouds Creates Security Silos

Often when organizations migrate from on-premise to public cloud environments, security teams want to continue to use the same approach for protecting applications and data. But use of a public cloud, especially multiple public clouds, introduces new attack vectors that require better visibility into what is happening across the entire ecosystem. Security tools offered by public cloud vendors are often a popular choice to fill the gap following migration. The majority of respondents who said that their organizations used public cloud environments indicate that they selected native security tools or a combination of native tools with third-party solutions to secure their public cloud. Possible reasons for organizations adopting a heterogeneous approach to securing public clouds might be because public cloud vendors are not cybersecurity experts and typically provide best-of-breed security tools vs. a 360-degree holistic security solution.

Can an AI be an inventor? Not yet.

For Abbott, the fact that we are not at the point where machines are routinely inventors is part of the point: society, he argues, needs to figure this out early. He acknowledges that AI doesn’t just spring into existence—it must be coded and trained and fed data—but that doesn’t necessarily mean everything an AI creates can or should be traced back to humans. Hundreds or thousands of people might be involved in programming IBM’s supercomputer Watson with general problem-solving capabilities, but “if Watson then applies those capabilities and solves a particular problem in a way that results in a patent, it’s not clear that anything any of those people have done qualifies them to be an inventor,” Abbott says. But if humans can’t be listed as inventors because they weren’t intimately involved, and the AI can’t be listed as an inventor either, then the invention may not be patentable at all. This, Abbott suggests, could be problematic. It could prevent companies from investing money in AI technologies and prevent breakthroughs in important areas like drug discovery.

Why employees can pose the biggest cloud migration challenge

While IT departments can guarantee corporate technology is working as it should, they can’t always control the people using it or what devices they may wish to use. So, steps need to be taken to ensure that whatever the device used by employees, they do not become easy pickings for the cybercriminals who pose a threat to the corporate network. The first step is to educate the workforce on those threats. With people being asked for multiple passwords when accessing online accounts these days, it’s common for employees to choose something that’s easy to remember. But easy to remember also means easy to guess. It’s common to hear of hackers successfully cracking passwords by using personal information they have siphoned from social media – whether that’s your favourite football team or the names of your children. It’s advisable for IT departments to work with HR to alert employees to the dangers of weak passwords – along with other cyber-attack techniques, such as phishing on email.

Google CEO Sundar Pichai: This is why AI must be regulated

Microsoft's recent calls for government regulation have focused on the use of facial-recognition technology in public spaces, arguing that if left unchecked it will increase the risk of biased decisions and outcomes for groups of people already discriminated against. The timing of Pichai's post is unlikely to be a coincidence. Euractiv reporters last week published a leaked European Commission proposal touting a three- to five-year ban on facial-recognition technology by public and private-sector organizations in public spaces until regulators can develop solid methods for assessing the risks of the technology and risk-management approaches. "This would safeguard the rights of individuals, in particular against any possible abuse of the technology. It would be necessary to foresee some exceptions, notably for activities in the context of research and development and for security purposes (subject to a decision issued by a relevant court)," the Commission wrote.

Developers love Rust programming language: Here's why

"The short answer is that Rust solves pain points present in many other languages, providing a solid step forward with a limited number of downsides," explains Jake Goulding on Stack Overflow's blog. Goulding is the co-founder of Rust consultancy Integer 32, so he has a vested interest in Rust's success, but he's also not alone in taking a shine to the young language. Microsoft is experimenting with Rust to reduce memory-related bugs in Windows components. Every single bug costs Microsoft on average $150,000 to patch and in 2018 there were 468 memory issues it needed to resolve. Over the past decade, more than 70% of the security patches it has shipped addressed memory-related bugs. Rust concepts are also being used in Microsoft's recently open-sourced Project Verona, an experimental language for safe infrastructure programming that could help Microsoft securely retain legacy C and C# code.  Mozilla Research describes Rust as a "systems programming language that focuses on speed, memory safety, and parallelism". It's often seen as an alternative to systems programming languages like C and C++ that developers use to create game engines, operating systems, file systems, browser components, and VR simulation engines.

5 IT Operations Cost Traps and How to Avoid Them

On a first look, centralization contradicts the spirit of DevOps and Agile. Agile teams want to be self-sufficient. They want to have all needed skills on their team so they don’t depend on external, centralized help to deliver their sprints. While such self-sufficiency is a guiding principle, DevOps teams always rely on some centralized teams. Hopefully, no DevOps team considers building their own data centers or trying to manage the OS level with all virus scanning and patch management by themselves. So, the real questions are — what must be sourced to a centralized team for cost, compliance, or other reasons? In which areas are project or product teams free to choose to do the work themselves, even if there is a centralized team for this topic? Figure 2 below illustrates this ecosystem of standard services. Ultimately, every company and IT organization has to ensure that teams, Agile or not, perform activities and make decisions in line with overall company goals and the CIO’s strategy for IT. They define the boundaries within which all Agile or non-Agile and DevOps or old-fashioned development and operations teams act.

---

Quote for the day:

"Leave every person you interact with feeling better about themselves; feeling loved & appreciated."  --Wright Thurston

---

Daily Tech Digest - January 19, 2020

Get Your Enterprise Ready for 5G

5G is an opportunity to re-imagine your business and to think about what you could do in your company if you weren't constrained by limited bandwidth and slow data transfer speeds. In healthcare, the elimination of communications constraints could mean a broader ability to deploy telemedicine and telesurgery to remote areas. In manufacturing, unleashing the potential of communications could bring an endless opportunity to manage all types of Internet of Things (IoT) appliances and robotics in factories around the world. In cities, unbridled communications could deliver limitless ways to manage traffic grids and fleets of autonomous vehicles. However, in other business cases, what you're already doing today with 4G, or even with 2G or 0G, might be enough. The discussion about present, short-term future and long-term business directions, and the communications that are needed to support them, should occupy the CIO, other C-level executives, corporate technology experts and boards of directors.

Cyber-Physical Systems – The new and emerging systems of intelligence

With edge devices – pieces of hardware that control data flow at the boundary between two networks – becoming more powerful, miniaturised and inexpensive, there is an opportunity to bring AI, machine learning (ML) and real-time decision making closer to where data is produced. This involves building geo-distributed models that are privacy-aware and adapting decision-making algorithms based on context. Edge computing systems will form the basis for the smooth functioning of CPS, especially in time-sensitive tasks where even milliseconds matter, such as remote robotic surgeries or self-driving cars. They provide the much-needed, real-time insights to these systems so that they can operate and adapt in real-time. The Internet of Things (IoT) and smart devices have become an inseparable part of our everyday lives and many physical devices and everyday objects are now connected. In fact, according to IHS Markit there will be more than 125 billion connected devices globally by 2030.  However, as an increasing number of devices is integrated into enterprise networks, it is important to ensure that the existing systems are ready to yield the expected benefits and minimise risk.

The top 9 big data and data analytics certifications for 2020

Data and big data analytics are the lifeblood of any successful business. Getting the technology right can be challenging but building the right team with the right skills to undertake data initiatives can be even harder — a challenge reflected in the rising demand for big data and analytics skills and certifications. If you're looking to get an edge on a data analytics career, certification is a great option. ... The number of data analytics certs is expanding rapidly. ... The Certification of Professional Achievement in Data Sciences is a non-degree program intended to develop facility with foundational data science skills. The program consists of four courses: Algorithms for Data Science, Probability & Statistics, Machine Learning for Data Science, and Exploratory Data Analysis and Visualization. ... The Certified Analytics Professional (CAP) credential is a general analytics certification that certifies end-to-end understanding of the analytics process, from framing business and analytic problems to acquiring data, methodology, model building, deployment and model lifecycle management. It requires completion of the CAP exam and adherence to the CAP Code of Ethics.

Financial Advisors Hate Bitcoin. Their Reasons Will Drive You Crazy

In the U.S., all financial advisors have fiduciary duty. This means they have to manage your money in a way that benefits you. If they don’t, you can sue them. You can do what you want with your own money. Buy all the bitcoin you want. Cow pies, lawn darts, options, credit default swaps, silver dollars, hammers, whatever you want to buy, no matter how risky or useless, you go for it. When you give money to financial advisors, they have to follow certain rules. They can’t mess around with crazy stock tips or risky off-shore investment schemes. ... In fact, crime is the number one reason 75 percent of all investors say they avoid bitcoin. Most people worry about getting hacked or think somebody will use bitcoin for terrorism or illegal activities. On top of that (and maybe because of it), most advisors don’t know how bitcoin works. Cryptocurrency isn’t covered in their professional certifications. ... Bitcoin has no central issuer, no government, and no business managing its use. Bitcoin transactions are pseudonymous, peer-to-peer, and settled instantly. 

Four priorities for the evolution of IT in 2020

IT efficiency is crucial to the success of digital transformation initiatives, and there is increased pressure on IT departments to deliver more, faster. However, IT can no longer keep up with the demands of the business; little over a third (36 per cent) of IT professionals were actually able to deliver all projects asked of them last year. In order to reduce this growing IT delivery gap, we’ll see IT move away from trying to deliver all IT projects themselves in 2020. The IT team’s role will evolve to changing, operating and securing core IT assets along with building and managing reusable APIs, exposing the functionality within the core IT assets that the rest of the business can consume to create the solutions they need. Essentially, IT begins to create new building blocks (APIs) that can empower both the technical and the broader lines of business users to innovate and build new technology solutions without compromising the core IT estate of the business. With API-led connectivity and organisations educating teams on the power of integration, IT will empower companies to digitally transform and innovate faster than ever before, shifting from being an “all doing” to an “enabling” organisation and avoiding being a constraint to business expansion.

Visa's plan against Magecart attacks: Devalue and disrupt

Visa's plan to devalue payment card data involves the rollout of new technologies like the Visa Token Service and Click To Pay systems. The Visa Token Service is a new payment mechanic through which payment card numbers and details are replaced by a token. This token validates the transaction against Visa's servers, but its useless to attackers as it doesn't contain any data cybercriminals can use to sell or clone cards. This novel tokenization system will be coupled with the new Click To Pay technology that Visa and fellow card providers have been working on for the past few few years, and which they recently began rolling out across the US. With Click To Pay, multiple card providers have banded together to create a common "Click to Pay" button that vendors can add to their online stores. Users only have to enter their card details once, and then click the button to buy products across the internet, without having to re-enter card details on each store. Since users don't have to enter card details on online stores, there's nothing Magecart hackers can steal. Both technologies were created to simplify online shopping, but they both happened to come along at the right time to help fight off Magecart attacks.

Microsoft: Application Inspector is now open source, so use it to test code security

The static source-code analyzer aims to help developers handle potential security issues that arise through code reuse when incorporating open-source components, such as software libraries, into a project. "Reuse has great benefits, including time to market, quality, and interoperability, but sometimes brings the cost of hidden complexity and risk," write Guy Acosta and Michael Scovetta, members of Microsoft's Customer Security and Trust team. "You trust your engineering team, but the code they write often accounts for only a tiny fraction of the entire application. How well do you understand what all those external software components actually do?" As they note, modern web applications often have hundreds of third-party components that contain tens of thousands of lines of code, which were written by thousands of contributors. And typically developers who use those components rely on the author's description, which Microsoft argues is not reliable or enough to meet Microsoft's responsibility for shipping secure code, which includes external components.

Natural disasters are increasing in frequency and ferocity. Here's how AI can come to the rescue

Once an advancing cyclone or hurricane is identified, for example, geo-spatial, weather and previous disaster data could be used to predict how many people will be displaced from their homes and where they will likely move. Such insights could help emergency personnel identify how much aid (water, food, medical care) will be needed and where to send it. AI algorithms could instantaneously assess flooding, building and road damage based on satellite images and weather forecasts, allowing rescuers to distribute emergency aid more effectively and identify those still in danger and isolated from escape routes. McKinsey’s Noble Intelligence is just one example of an initiative trying to harness AI’s potential to support humanitarian causes. For instance, the team is developing an algorithm that will reduce the time it takes to assess damage to buildings such as schools from weeks to minutes, using a combination of satellite, geo-spatial, weather and other data.

Does the World Need a Cryptocurrency Robo Advisor?

Robo Advisors as a service has been used on a global scale. Though, there is definitely a different scene running in different parts of the world, for instance comparing the US market with Europe.  The US retail market has shown much more interest and trust in using these computer programs to manage their money. This has alone made the US the source of innovation for Robo Advisors considering the competition between some heavyweight financial institutions trying to take a bite from the market share such as Vanguard or Charles Schwab and very bright startups such as Betterment, Wealthfront and Acorns. ... One challenge that remains for the market and the ETP providers is to keep liquidity for the indices they launch. Market liquidity across Cryptocurrencies, especially alternative coins (all non-bitcoin coins). There are specialized parties, called market makers using sophisticated tools for providing offers for both sides of order book. The tool, called also market making bot makes sure make sure such coins or indices have sufficient liquidity to attract investors or financial advisors.

Bipartisan group of senators introduces legislation to boost state cybersecurity leadership

In introducing the legislation, Hassan highlighted the ongoing nationwide ransomware attacks on cities and government entities. These types of attacks, which recently crippled the government of New Orleans, involve an individual or group locking up a system and demanding a ransom to give the user access again. “Cyberattacks can be devastating for communities across our country, from ransomware attacks that can block access to school or medical records to cyberattacks that can shut down electrical grids or banking services,” Hassan said in a statement. “The federal government needs to do more to ensure that state and local entities have the resources and training that they need to prevent and respond to cyberattacks.” Hassan added that the new bill “would take a big step forward in improving communication between the federal government, states, and localities, as well as strengthening cybersecurity preparedness in communities across the country.”

---

Quote for the day:

"The led must not be compelled; they must be able to choose their own leader." -- Albert Einstein

---