Snapchat’s addition of Memories is ushering in a new wave of walled gardens. Now not even our photos are safe. takes control of your photos and tucks them away into Snapchat’s . In order to store the photos from in your phone’s default Photos app you have to go through various menus. It’s fairly well hidden and it breaks the sacred 3 tap rule of UI design. Memories walled garden Snapchat I’m not entirely opposed to walled gardens. I love MacOS and iOS, the features Apple is able to add from their walled garden far outweighs the limits of being in a restrictive ecosystem. Things like the App Store and Handoff add a lot of value. But what value does Memories add? are a unique product, they allow for quick and unobstructive video recording. That’s Snapchat’s main value, they are a , with they’re main value being the frictionless sharing that Snapchat allows. Spectacles further this idea, but how useful is it if the video they record lives entirely in the Snapchat app? The Spectacles “camera company” This new age of walled gardens scares me. What happens if a service goes under? Your data is gone with the wind. Even something as simple as switching to a new service can be tricky. I stopped using Evernote but it’s too much work to get my notes out of there (Evernote uses a proprietary html format) so I keep the app installed for when I need to look at old notes. If everything is in it’s own walled garden, then eventually our data will start to be held hostage by these services. is how hackers start their afternoons. We’re a part of the family. We are now and happy to opportunities. Hacker Noon @AMI accepting submissions discuss advertising &sponsorship To learn more, , , or simply, read our about page like/message us on Facebook tweet/DM @HackerNoon. If you enjoyed this story, we recommend reading our and . Until next time, don’t take the realities of the world for granted! latest tech stories trending tech stories

Apple

Facebook

Techcrunch

The Age of Walled Gardens

At 2a.m. Korea time, GlassHunt.co’s was savagely penetrated on its back-end via a SQL hacker who broke into our database and confiscated nearly $5,000 in bitcoin from active users in the process of their double spend activities on our site. Sorry about that. We publish hackable contracts for Ethereum hackers on our Challenges site, but this one, unlike those, was not anticipated by us. Double Spend Tool At Glass Hunt, we celebrate hackers. So through all the hate mail, the threats, the cries for help, and money we personally lost due to our inability to collect commissions and maintain trust, we say…. we salute you, unknown hacker (You could have at least left us a message… because we are recruiting). As should be the case when anyone gets hacked, small or large, we would like to issue a few statements. The hacker can’t use the same exploit anymore. In short, he/she/it cracked one of our read-only SQL account passwords, and we have since reset them to uber-super-super-amazingly strong passphrases that we personally could never remember. We have added super-duper encryption of private keys, so that even if the hacker returns into the database, the information will be of very little use. We have beefed up our firewalls to ensure that any suspicious activity will be blocked, locked and shut the F* down. As an additional measure, we have added SSL encryption to our site, so that if anyone (including your favorite VPN provider) is snooping on your network connection… well, that activity will now be meaningless. Takeaways: Everything is safe now and you can double spend on our site securely. No, we will not return any lost funds to users. Again, we are hackers ourselves, and we have a belief set that would be completely compromised if we returned funds to people double spending… Essentially, you use our tool at your own peril. We will do the best we can to ensure this doesn’t happen again Almost all accounts (new and old) were drained. Sorry, older account users who left or lost funds in an account. We wish for the hack to remain with everyone involved with us. We are truly happy we got kicked in the balls. Because though that kick hurt us and many others, the only way to be hack-proof is to get hacked. We welcome future attempts. We know it’s the only way to become stronger. And beware, we are on high alert. And we take no prisoners; that is, unless you would like to join the ranks. May the hack be with you. is how hackers start their afternoons. We’re a part of the family. We are now and happy to opportunities. Hacker Noon @AMI accepting submissions discuss advertising &sponsorship To learn more, , , or simply, read our about page like/message us on Facebook tweet/DM @HackerNoon. If you enjoyed this story, we recommend reading our and . Until next time, don’t take the realities of the world for granted! latest tech stories trending tech stories

Super

Uber

Kicked In The Balls, But Back On Our Feet

The Basics: This will be an introduction to hashicorp vault (which from now on for simplicity ( )) I’m gonna start calling Vault Don’t confuse it with Ansible Vault or any other Vault Vault is a application with a interface that you can use to store secrets , very simple . Go Rest/Cli Vault will store this information (256AES on GCM) , but we will talk about this later encrypted Secrets are things that you normally put on . or or , things that you don’t want to commit to source control for obvious reasons. gitignore hiera-pgp Ansible Vault So in the simplest terms you will write stuff to Vault will encrypt it and keep it there for you for retrieval. Who can see my stuff?: Vault uses a to allow you to see info inside it , tokens can be and on demand . Also they can be set to after a given time. token created revoked expire So for example if you need to grant access to some information inside vault for an hour (because there’s something being rolled into prod) you can grant them a token for about an hour (or revoke the token once they confirm the change it’s done) This is a silly diagram of how this could work , but obviously it can be all automated : Token creation and usage Hands On: , i had some issues with 1.6 specially in the terraform part we gonna talk about later You should be on Go 1.7 Ok let’s install vault and have some fun with it , as you know like most Go projects , they ship their precompiled binaries and that’s probably the easiest way to get on with it is download vault from the official website ( ) https://www.vaultproject.io/downloads.html Inside the zip file you will find a binary that does the magic (unfortunately vault doesn’t come with a initd script or anything like that , but I’m sure a little google will fix that) , Vault comes with a dev mode for you to test things which is what we gonna use for now , so let’s start a dev server ./vault server -dev After doing that what’s gonna happen is vault will create an backend ( more on backends later) and it will bound by default , you also gonna get some output, let’s see: in-memory tcp:8200 ==> Vault server configuration: Listener 1: tcp ( , cluster address: "", )Log Level: infoMlock: supported: true, enabled: falseVersion: Vault v0.6.1 Backend: inmem addr: "127.0.0.1:8200" tls: "disabled" ==> WARNING: Dev mode is enabled! In this mode, Vault is completely in-memory and unsealed.Vault is configured to only have a single unseal key. The roottoken has already been authenticated with the CLI, so you canimmediately begin using the Vault CLI. The only step you need to take is to set the followingenvironment variables: export VAULT_ADDR=' http://127.0.0.1:8200' The unseal key and root token are reproduced below in case youwant to seal/unseal the Vault or play with authentication. Unseal Key (hex)   : b03efb974cbb9023213e550dcab35d0bdaa518b0fe412395917ab162df538811Unseal Key (base64): sD77l0y7kCMhPlUNyrNdC9qlGLD+QSOVkXqxYt9TiBE= Root Token: b724183c-15bc-ffd4-1d53-824626348866 Ok that’s a lot of output , and it is all worth explaining a bit , in order of occurrence: Backend (tells you that -dev runs in memory by default) Tells you the address (127.0.0.1) and port it has bound to Tells you that TLS is disabled (for dev mode) Tells you to export , this will be read by vault later on when we read/write data to it. VAULT_ADDR Root Token , remember above we mentioned we need a root token to create other tokens in order to hand off to ops people? Authenticate,Writing, Reading , Status,Token: Vault is now running , it isn’t demonised so it will run on the foreground for you to see all that output. Authenticate with your local Vault: Successfully authenticated! .token: adb1e4e3-e7c0-387b-5ad8-0d92fd282952token_duration: 0token_policies: [root] $ VAULT_ADDR= http://localhost:8200 ./vault auth adb1e4e3-e7c0-387b-5ad8-0d92fd282951 You are now logged in Let’s write something to vault: ./vault secret= VAULT_ADDR= http://localhost:8200 write secret donttellanybody So that was pretty simple , basically i tell it were to write and pass a key value pair so you can look it up later: $ Key                     Value---                     -----refresh_interval        720h0m0smysecret VAULT_ADDR= http://localhost:8200 ./vault read secret donttellanybody And that’s it! we’ve written a key/value pair that is “securely” stored in vault and we were able to retrieve it. So that was the basics , There’s a lot more info about Vault that should be read but i don’t want this to get too boring but i want to run through it: Create a new token: This creates a basic token with no expiration , and no policies , we gonna see more about this later: $ VAULT_ADDR=' ./vault Key             Value---             -----token token_accessor  96891866-e336-c6a6-a0c7-8d38861d5154token_duration  0stoken_renewable falsetoken_policies  [root] http://127.0.0.1:8200' token-create 6d2aed6c-e2e0-733b-3b81-5c0e34eec0cd Backends: Vault has a few backends (aws/ssh/inmem/etc) thing of them as models (in terms of mvc) or some virtual file system that has some logic. For example the AWS backend , will create IAM credentials on demand , something called ) , and revoke them when needed . dynamic secrets ( https://www.vaultproject.io/intro/getting-started/dynamic-secrets.html This is of great use when using automation tools where we don’t want to hardcoded credentials , look at this example scenario: the ops guy will have set of credentials for a given time , dynamically generated for him. Rest Api: Vault would be of little use of it didn’t feature an easy way read/write info to it , fortunately that’s not the case let’s see a little bit of the rest api. It basically works with , and if you ever worked with JWT this will look familiar , the same token that we’ve been talking all along should be passed with the request as a custom header , for example: GET/POST/DELETE The header does the magic for you there. X-Vault-Token Clearly this opens a lot of doors , this means that you can call Vault from ansible or puppet or terraform wherever gives you the option to write a little plugin that does a http/https call. Hooking things together Now that we have definitely running let’s try to mock up how and would connect to this , obviously we will use the rest api to connect to Vault and luckily both ( and ) provide us with a plugin framework where we can do these things. Vault (in -dev mode , don’t forget you can’t go live with this ) Ansible Terraform Terraform Ansible : Terraform Terraform is also written in Go , and ships precompiled , if you don’t know what terraform is you should definitely take a look at their site ( ) , but to make it quick an easy , terraform let’s you deploy virtual infrastructure in public/private clouds. https://www.terraform.io For example you could create 5 tier VPC with an elastic load balancer with a given number of EC2 instances running on it using a specific image , all that from a simple file , pretty neat. So the question would be how can we access Vault stored values from terraform , for example of terraform needs an IAM cred or RDS etc. Well a kind terraform user/dev has already started writing one (“ ”) , Unfortunately for us these hasn’t been included in the latest terraform release so we will need to compile it https://github.com/redredgroovy/terraform-provider-vault (make sure you’re using Go 1.7) $ Cloning into 'terraform-provider-vault'...remote: Counting objects: 64, done.remote: Total 64 (delta 0), reused 0 (delta 0), pack-reused 64Unpacking objects: 100% (64/64), done.Checking connectivity... done. File: '/home/jeronimog/Projects//bin/terraform-provider-vault'Size: 14870377        Blocks: 29048      IO Block: 4096   regular fileDevice: 801h/2049d      Inode: 1968433     Links: 1Access: (0775/-rwxrwxr-x)  Uid: ( 1000/jeronimog)   Gid: ( 1000/jeronimog)Access: 2016-09-28 18:12:58.864000000 +0100Modify: 2016-09-28 18:12:59.780000000 +0100Change: 2016-09-28 18:12:59.800000000 +0100Birth: - This binary is a plugin. These are not meant to be executed directly.Please execute the program that consumes these plugins, which willload any plugins automatically git clone https://github.com/redredgroovy/terraform-provider-vault $ cd terraform-provider-vault/$ go build -o $GOPATH/bin/terraform-provider-vault $ stat $GOPATH/bin/terraform-provider-vault $GOPATH/bin/terraform-provider-vault Steps: Clone the repo and cd into it compile , and set the destination to be $GOPATH/bin (common practice) stat it and check that it executes which it seems to be Terraform plugins are binaries that terraform will execute when needed , so there’s not a lot of hassle when it comes to compiling. So let’s keep moving. Adding the newly compiled module where terraform can see it: We gonna copy that binary to were terraform can see it and configure it. I have everything normally on ~/Projects/vaulttf/ cd ~/Projects/vaulttfcp **$GOPATH/bin/terraform-provider-vault .**$ lssample.tf terraform terraform-provider-vault vault .terraformrc sample.tf is a sample terraform file we gonna use to test this terraform is my terraform binary terraform-provider-vault is the plugin we just compiled .terraformrc is the terraform configuration file First of all we will need to tell terraform where to look for this plugin , this is done in . terraformrc: So we telling it , it is right there in the same path , (keep in mind relative paths when you’re working with this in prod) Now let’s create a sample terraform file that retrieves information from Vault: In short we call the vault provider , pass the toke and address create a resource passing the path where we gonna be looking up and create an output resource just to print out the variable we retrieve from Vault The result should be something like: Console screenshot cause gist gets messed up by the terminal colors gist anyways So there you have it , a password retrieved from Vault through terraform already on a terraform variable to do whatever you want with it . Ansible: Another possibility is to retrieve infromation stored in Vault through Ansible ( ) , if you don’t know what ansible is I’ll use this description that i heard from a colleague: https://www.ansible.com/ “Ansible is nice wrap over a python script that get’s executed over ssh” Ansible uses Playbooks to define actions that will be executed in a give host for example: (This is a very simplistic example just in case you don’t know anything about ansible) And that outputs the action of logging to all servers over ssh and execute echo {{item}} per each element in the list [1,2,3,4,5] Simple stuff really , but you see the possibilities of this. A good example would be imagine that needs to re-deploy a model on a given database , but to do so needs the password , but we can’t hardcoded it into the playbook Ansible Ansible ( there’s other mechanisms to do this like Ansible Vault or others, but we’re focusing on Vault today ) There’s already some plugins written to do this , but i thought it would be a good idea to do mock our own plugin and see how this works. So let’s create Ansible Plugin that retrieves “secret/photodb” from Vault. Step 1 , let’s write that to Vault: So that works , we now have inside mount point. rootpw:qwe123 “secret/photodb” We can check this with curl too: So that’s working now let’s make a little plug-in for ansible that retrieves this key and uses it to log in to mysql for instance. rootpw The easiest way to create a lookup plug-in is just drop it into libraries on the root of your project (or it could be within a role too) cd Projects/myansiblelittleplugin/mkdir library/ And there we gonna create a file called photo.py , with this content: “very basic” in Short: it’s a simple function that accepts a dict as an argument , and creates a get requests against getphotopw Vault the main function defines the plug-in add adds a dict of dicts with all the arguments that i will pass further down in the ansible playbook this is only a mock and needs a lot of work before hitting prod :) Now the playbook looks like this: note how i call the plug-in using a task “photo” pass all the required arguments register the output (Highlighted 1) debug the output which will be the root passw for the photodb and the run a command using it (highlighted 2) The output will look like this: Final Notes: This is only a tiny introduction to Vault , there’s a lot more to explore , but i guess at least it’s clear how to interact with it and do basic operations. Later on it would be nice to use different backends and go a little more in depth about the encryption levels it offers .

Google

A Little Hashicorp Vault introduction:

Twitter

Node.js, TC-39, and Modules

Are we using behavioral design (and ethical manipulation) for good? How do we know? Now that we have the power to profoundly change peoples’ habits through technology, how do change behavior ethically? Manipulation Matrix In this short video, I talk to Amir Shevat, formerly at Google and now at Slack, about a simple test for moral persuasion and ethical manipulation. Let me know what you think in the comments below. Originally published at www.nirandfar.com on September 29, 2016. Moral Manipulation: Using Behavioral Design to Manipulate | NirandFar If you found this post interesting, it would mean a lot to me if you could click on the “claps” icon below to let me know. That would really make my day — thanks! Nir Eyal is the author of Hooked: How to Build Habit-Forming Products and blogs at . For more insights on using psychology to change behavior, join his newsletter and receive Nir’s . NirAndFar.com free list of research-backed tips and tricks to increase your personal productivity

Slack

Is Ethical Manipulation Possible?

Last I checked the average review time for app submission is about 3 days (from ) http://appreviewtimes.com/ TL;DR (because you need to get back to that YC/500 application) 4 Changes to the submit script and process than can save at least a day of the developer’s time Add sanity checks eg. nm check for symbols,functions the app is not allowed to use Check for DOA builds, basically the app crashes on start Streamline the two step submission (1) from xcode and then (2) from itunesconnect Remove the build version restriction which forces one to update the build version every time you submit, even within the same “submit cycle” average review time for app submission is about 3 days (from ) http://appreviewtimes.com/ On face value, this is great. Our app has been in review for 3 weeks at one time. So a lot of credit goes to the review time. They have staffed up and they have servered up (got more machines). The averages used to hover at 8 days for the last couple of years. So you would think 3 days is great right? Not if you are the who has to push the code and wait for all the green. If this was the only thing you were doing, great! Time to go for a quick trip to Hawaii right? But that’s usually not the case. Your “ ” team has 10 experiments lined up that need to be done yesterday. Your bug triage is basically becoming a carnage of broken promised and unfulfilled wishes. And that doesn’t even come close to how your personal life is faring. developer growth hacking A real story So here we are, we submitted the latest version of our . Lots of cool features and more importantly a critical bug were in the mix. We submit Tuesday evening. Come Thu morning(around 7AM Pacific), the app is in review. yay!! After about 3 hours, we get this message on the dashboard. The app has been rejected because of “Performance” reasons (They probably should reword this a bit considering lots of iOS developers are guys with bruised self images). yogatailor app Turns out we are using an API called setCompletionDelegate. A quick check in our code — nope, we don’t use this function. We then looked at all the libraries. Everything was great. And then we finally looked at the Pods and voila, good old Branch API was using this function. A quick chat with the good folks of Branch.io , turns out we were 3 versions behind! After a brief wrestle with “pod update” and “pod install” and “pod unistall” and “pod wtf”, we got everything updated with Branch. So we run QA, archive, submit and…. Waiting for the Sun You see the timestamp there? It says upload date Sep 16, 2016 11:56 AM. Guess what time it was we were looking at it? It was 2pm (all times pacific). A good 2 hrs after we submitted. So finally around 2:30 pm, the build is available to be submitted. We click through all the screens where they ask you about export stuff. Minor thing here, but why can’t these be pre-filled with previous settings? Anyway, a few hrs later, rejected! yet again. This time it was because the app had a missing asset for iphone 4 and was crashing. I mean, this is our bad. But who supports iphone 4 anymore? Granted we didn’t update our QA scripts for iphone 4 in 6 months. But still, come on! We are a tinu, puny startup with super limited resources. Where do we go from here Here are a few things that I think can help expedite the app submission,review process. Feel free to add to this list either by highlighting and commenting right here or adding to the comments at the bottom. Maybe we can send a compiled list to Apple and they always listen to developers. Have the submission script run a few checks on the build, simple “nm” check on functions,symbols that are offlimit would be great Right now, the app submission is broken into two parts. We submit from xcode. we then wait for a hr or two for the build to “process”. And then you go to itunesconnect, select this build and then submit. Why not remove the step. Basically it is one submission and it goes through by default. If the developer thinks something is amiss, she can go interrupt the process. Check for DOA submissions right away. I thought this happened. Apparently not What’s with the annoying “feature” where itunesconnect rejects the build because the version has not been updated. The developer has already upped the build version on itunes. Now , the developer has to up the version within the build every time they archive and submit. How much time do you guys/gals waste because you submitted something, realized you missed something simple, made the fix, archived it and then it gets rejected because itunesconnect wants the buildversion to upped too. I find it annoying. I should really be spending this time on the YCombinator application. Maybe I am using this as an escape from another onerous process. Maybe I am doing this because Apple cares.

HackerNoon Tech Stories Archive September 29th, 2016

The Age of Walled Gardens

@delsig
Matt Del Signore

Kicked In The Balls, But Back On Our Feet

@glasshunt
Glass Hunt

A Little Hashicorp Vault introduction:

@garciaj.uk
Short Tech Stories

Node.js, TC-39, and Modules

@jasnell
James M Snell

Is Ethical Manipulation Possible?

@nireyal
Nir Eyal

How to make the life of an iOS developer suck a little less — 24 hrs at a time — an open letter to…

@rameshdot0
Ramesh Padala

HackerNoon Tech Stories Archive September 29th, 2016

The Age of Walled Gardens

@delsigMatt Del Signore

Kicked In The Balls, But Back On Our Feet

@glasshuntGlass Hunt

A Little Hashicorp Vault introduction:

@garciaj.ukShort Tech Stories

Node.js, TC-39, and Modules

@jasnellJames M Snell

Is Ethical Manipulation Possible?

@nireyalNir Eyal

How to make the life of an iOS developer suck a little less — 24 hrs at a time — an open letter to…

@rameshdot0Ramesh Padala

@delsig
Matt Del Signore

@glasshunt
Glass Hunt

@garciaj.uk
Short Tech Stories

@jasnell
James M Snell

@nireyal
Nir Eyal

@rameshdot0
Ramesh Padala