Some things I learned while building a GPU rig for deep learning During this month’s , Apple said, paraphrasing, that they tried to put a in the 2013 Mac Pro, but it was too hot and caused the CPU to throttle. That was my interpretation at least. briefing on the Mac Pro TITAN X Apple has a tendency to put underpowered GPUs in their desktops, so it’s great to hear they’re seeking to improve this for the next Mac Pro. They’ve gotten plenty of that “pro” users want more powerful GPUs, such as NVIDIA’s or . feedback GTX 1080 1080 Ti by Pascal Eggert — [ ] 2017 Mac Pro concept Source Decades ago, CPUs added units (e.g. Intel’s ) for number crunching. Despite to improve use of the CPU, there’s no denying a recent away from the CPU to the GPU for this kind of computation. SIMD MMX techniques shift GPUs have become so powerful that we’re using them more, leading to a rise in general-purpose on GPUs. It’s a prominent time for GPUs now, AMD will be competing at the high-end again with their series, and NVIDIA is coming soon after that. computing Vega Volta “Most of the software out there that’s been written to target [certain kinds of high-end cinema production tasks] doesn’t know how to balance itself well across multiple GPUs but can scale across a single large GPU.”~ Craig Federighi It’s true don’t take much advantage of multiple GPUs, but the real point is that old weak GPUs won’t compensate for a new powerful one, and we shouldn’t beyond that context. It’s fairly likely that Apple will sell a Mac Pro configuration in 2019 containing two GPUs. some apps generalize So you need a fast computer A few years ago, if you were to buy a new Mac Pro, you could spend as much to upgrade the CPU ($3500) as it cost for the whole machine by itself ($3000). [ ] Source Earlier this month, Apple updated their Mac Pro configurations and pricing to something much more reasonable by today’s standards. A CPU upgrade from 6-core to 12-core is now merely : $2000 [ ] Source That cost matches the difference in Intel’s list price between the 6-core ( ) and 12-core ( ) processors, so Apple is simply passing along Intel’s suggested pricing. $580 $2600 Note that the clock speed of the 6-core unit is 30% faster than the 12-core one, so you’d be upgrading to slower cores. Apps that rely upon single-core performance will actually run slower on the more expensive CPU. Now consider that will buy you an NVIDIA . Last month this was the GPU available to the public. $700 GTX 1080 Ti most powerful For about the same cost as adding 6 CPU cores, you can have 3 of the most powerful consumer GPUs in the world. It’s a shame you won’t be able to plug all three of those monsters into the next Mac Pro. Assuming, that is, Apple designs it with similar expansion constraints as the cheese grater tower, which was the most expandable Mac Pro they’ve ever made. Two mid-range GPUs. Or a single high-end one. Apple supported dual GPUs before the 2013 trash can Mac Pro. In 2012, the cheese grater Mac Pro had a stock configuration that came with two AMD Radeon HD 5770 GPUs. A dual-GPU, modular Mac Pro (mid-2012) — Photo: / Tom Park CC BY-SA As with the GPUs in the subsequent 2013 Mac Pro, these were considered to be mid-range, not high-end. They are rated under 110-watts , so they draw less wattage and generate less heat than high-end GPUs (250 watts TDP is typical nowadays) of the sort that you’d want in a workstation-class tower. TDP “But you could replace those cards with more powerful ones,” one might say. While that’s possible, the box wasn’t designed to allow it. It has a decent power supply, . However, it provides only 150 watts to each video card, or a total of 300 watts. To support a pair of 250-watt GPUs, like the , you’d have to supply at least 200 watts more power somehow, possibly by wiring additional power cables from the drive bay ports or from the remaining two expansion slots. 980 watts GTX 1080 Ti Back in 2009–2012 when this Mac Pro model was being built, high-end GPUs tended to be 180–210 watts each, but even then you’d still be short at least 60 watts. In fact, Apple offered an alternative Mac Pro configuration with a single high-end AMD Radeon HD 5870, rated at - TDP. You couldn’t insert another one without additional custom wiring. The cheese grater case was simply not designed for a pair of high-end GPUs. 228 watts On the other hand, this Mac Pro had a replaceable CPU module that allowed upgrading the system from single to dual CPUs. That’s pretty cool — in most other computers, you’d have to replace the motherboard to upgrade to dual CPUs. But nowadays you’d want this kind of upgradeability with GPUs. OK, so let’s suppose Apple’s next Mac Pro is modular and expandable, like the cheese grater tower, and fitted with the latest tech: PCIe 4.0, Oculink-2, Thunderbolt 3, USB-C 3.1, M.2 NVMe SSDs, and LGA-2066 or possibly LGA-3647 sockets for high-end CPUs with 44 lanes of PCIe connectivity. That sounds promising, but how many GPUs will it support? Maybe two, if you fiddle with it? high-end Pfft, how many GPUs do you really need? This question reminds me of those people who were saying no one legitimately needs more than 16 GB RAM in a Macbook Pro. last year “Own the world’s greatest gaming computer and convince everyone it’s for your research” — http://imgur.com/wiLsGqA Three GPUs in a computer might seem ridiculous. Amongst the of Mac customers who buy a Mac Pro, an even smaller fraction would need more than two GPUs. single digit percentage There’d never be a controversy about Apple supporting only two GPUs. But if one came up, a person might claim that no one legitimately needs more than two GPUs. Then a person would be wrong. Two weeks, two weeks, two weeks If you try to make an AI program to recognize 1000 types of objects in a photo, one of the things you’d find out is that even with multiple GPUs it can take weeks or months to train a neural net. We can train a model from scratch to its best performance on a desktop with 8 NVIDIA Tesla K40s in about 2 weeks.~ Jon Shlens, Google Research The common advice to avoid this delay is to adapt one that’s already been trained, using a technique called “ ”. But depending on what you want to do, you can’t always be using someone else’s pre-trained neural net — at some point you’re stuck in a process where each iteration could take weeks. If at that point you’re using only one GPU, adding a couple more would reduce the turnaround time significantly. transfer learning Suddenly synthesized A common problem with neural nets created by “supervised training” is they need a huge amount of training data or else slight variations in input will fool them. That is, suppose you train a neural net to recognize cats, but your training data consists of photos where all the cats are sitting upright. It might not recognize a cat that’s upside down. Your program will handle these kinds of differences better if you augment the training set by adding rotated and resized copies of the originals. In a notable example, Baidu Research made a breakthrough in speech recognition, aided by layering noise over their initial data set. Baidu gathered about 7,000 hours of data on people speaking conversationally, and then synthesized a total of roughly 100,000 hours by fusing those files with files containing background noise.~ Derrick Harris, GigaOm But then they had 14 times more data, which takes that much longer to process. A few years ago Baidu . More recently they reported working with as many as or GPUs. used 8 GPUs 40 128 Now you have two problems Recently some of the coolest results in AI are based on a technique where two neural nets compete against each other (“ ”) to improve their ability to create and recognize types of data. generative adversarial networks With a larger model and dataset, Ian [Goodfellow] needed to parallelize the model across multiple GPUs. Each job would push multiple machines to 90% CPU and GPU utilization, but even then the model took many days to train.~ OpenAI Blog That means you’re training two neural nets, not just one. Again, you’ll want as much computing power as you can get. Would you pay extra for expansion slots? When I started doing deep learning work, I used GPU spot instances on Amazon cloud. After running up a small bill, I began looking into external GPU boxes, but ended up assembling a PC. The GPUs on AWS are now rather slow (one GTX 1080 is four times faster than a AWS GPU) and prices have shot up dramatically in the last months. It now again seems much more sensible to buy your own GPU.~ Tim Dettmers I bought just one GPU. But knowing that I might need to add more, I made sure that the PC would be able to take up to four. It’d been a long time since I’d built a computer from components, and way back then I wasn’t paying attention to how many GPUs I could put in it. To my surprise, many computers cannot support two GPUs at full bandwidth, and most cannot support more than two. There are only a few expensive motherboards that can support 4 GPUs simultaneously with x16 lanes of PCIe 3.0 connectivity. The ability to add 3 more GPUs cost me about $600. That’s about one-third of what the base system (w/o GPUs) would cost if built with standard components. This amount represents the higher prices for a quad-GPU capable motherboard, a big 1500-watt power supply, and a CPU with 40 PCI lanes (as opposed to 28 lanes). I literally paid extra for expandability itself. Would Apple sell additional expansion as an option? The Mac Pro is positioned as Apple’s most powerful computer, but computing power is coming in various forms. High-speed expansion slots provide the ability to upgrade computing power in whatever form it takes in the future. We’re not just talking about GPUs here — it might be , or like Google’s . Or . FPGAs ASICs TPU fast storage Computer manufacturers generally do not sell a single line of desktop computers with different cases. For example, you don’t usually see something like this: by Scott Richardson —[ ] 2013 Mac Pro concept Source Instead, the models of a computer line are positioned according to CPU speed, storage, and/or screen size. So this is what’s typical: https://www.apple.com/mac-pro/specs/ But doesn’t it make sense to sell optional expandability? It has value. You can put a price on it. C’mon you have to admit it’d be pretty cool 😎 I know what you’re thinking: “There’s no way Apple would do this. It’s not worthwhile because there aren’t enough customers for the bigger Mac Pro.” You’re probably right. And besides, it’ll have Thunderbolt-3, and maybe Oculink-2 which is even faster, so people can connect GPUs if they need them… you know, like this: external Photo: Peter Wiggins — [ ] Source Anyway, I’m looking forward to seeing how Apple rethinks the Mac Pro. When we hit three GPUs, we are technically in a niche category… From talks with ASUS, despite the fact that a product may be geared towards a niche market, that product may sell well to the standard market if it is perceived to be good.~ (review of multi-GPU boards) Ian Cutress, AnandTech Q&A Asking the tough questions. What’s the big deal about multiple GPUs — weren’t bitcoin miners putting 6 or 8 GPUs on a PC in a ? milk crate Yes, but cryptocurrency algorithms can run on a GPU without a lot of data transfer, so miners could use PCI riser cables or a PCI splitter, and connect each GPU using just one PCI lane. That means they didn’t need a 40-lane CPU and a quad-x16 slot motherboard. In bitcoin mining, GPUs were overtaken by ASICs. Won’t that happen in AI too? Probably, at least and are working on that. In the meantime, GPUs have versatility that make them useful for the future. Nervana Groq foreseeable ASICs have lower power requirements than GPUs, so wouldn’t a big power supply be unnecessary for multiple ASICs? Maybe, but then you might just get more ASICs on each expansion card. You mentioned FPGAs and ASICs, but what about quantum processors? Oh yeah, those too I guess. Why do you need 16 lanes per GPU? Games don’t show any difference between GPUs running on x8 vs x16. It’s true that games show no significant difference, but that’s probably because they’re tuned to run well on GPUs at x8. Games don’t saturate a x16 PCIe 3.0 connection, but other apps like deep learning programs can. How does a CPU with only 40 PCI lanes connect to 4 GPUs that each use 16 lanes? Right, 4×16 = 64, which is more than 40. The motherboard has two PCIe switches which each can multiplex 16 lanes of signal from the CPU to 32 lanes for two slots. So the 4 slots use only 32 lanes from the CPU. a similar kind of PCIe switch for the Thunderbolt 2 controllers in the 2013 Mac Pro. Apple used Don’t those PCI switches introduce a lot of latency? Some people say the latency is so bad that it’s better to just use 8 lanes, but that’s a . Apparently this idea spread due to game testing that showed slightly higher frame rates on x8 GPUs than on switched x16 GPUs. But games are not good for this kind of benchmark because they don’t exceed x8 bandwidth — you can get similar results on a unswitched x16 slot. myth I haven’t seen any good tests, but an NVIDIA showed very little latency or loss in bandwidth across a PLX (Avago/Broadcom) switch. benchmark Show us your rig. Pics or it didn’t happen. Here it is next to the cheese grater: An open case rig next to a Mac Pro 5,1 — Photo: / Tom Park CC BY-SA What the… ugly. Why no case? OK, so I have to vent a little about motherboard and case design. Cool desktop computer designs are totally thwarted by the way uATX, mITX, and ATX boards are standardized. This sector has so much room for innovation with non-standard motherboards and backplanes. A lot of people are calling for Apple to just put the next Mac Pro in a big box case, but I think it’d be a shame if that’s exactly what Apple does. They went to extremes with the 2013 Mac Pro but reverting to a standard tower box isn’t so appealing either. I wanted a smallish form factor but the motherboard is so big (extended ATX) that it would have to go in a fairly large case, and I didn’t like anything I saw. So I experimented with MakerBeam rails instead of imitating with a Carbide Air 540 case. It ended up being taller than I intended, but slim in other dimensions. NVIDIA’s DevBox A single-fan liquid cooler has been completely adequate for the CPU. The GPU is connected with a x16 riser cable and can slide all the way over the CPU, since the CPU doesn’t have a huge heat sink on top of it. That means multiple GPUs can be spaced apart with wide air gaps. It’s surprisingly quiet with two 140mm fans, even under sustained heavy load. What did make a huge amount of noise was a 5TB hard drive that was hammering away while feeding images to a convnet. After a couple annoying days of that, I switched to a SSD. It has no drive bays — there’s a M.2 drive and additional SSDs can be velcroed on a side rail.

Adobe

Amazon

AnandTech

Apple

Broadcom

GigaOM

Google

Harris

Intel

MacRumors

NVIDIA

Target

Techcrunch

Tesla

Twitter

The Mac Pro: A Case for Expansion

In 1878, Christopher Sholes was granted the patent on the QWERTY keyboard layout. He’d been granted the patent on the , 10 years earlier. His original typewriter had problems with tangling mechanical keys and the QWERTY keyboard was his solution to broken keyboards and frustrated typists. The QWERTY keyboard favored left-handed typists (at a time when most technology favored right-handed users) and placed less commonly used letters under a typists resting fingers. Sholes, thinking very much like a founder who wanted to sell a lot of product, ensuring salespeople could easily demo the product. That one decision played a big part in the makeup of the typewriter. typewriter in 1868 ensured the word TYPEWRITER was designed into the top row of the keyboard You are probably reading this article on a computer that has the same QWERTY keyboard layout as a typewriter from 1878. You and everyone who owns one of . While there are other layouts, QWERTY has become the default layout. the ~270M computers that were sold last year finally woke up to the problem with accepting defaults when, while using generic facial recognition software on video captured from her webcam, her face could not be detected by the software. The same software detected the faces of her roommate. Joy had experienced this same issue playing peek-a-boo with social robots in her undergraduate days at MIT, but she’d let it slide back then as it was . Joy Buolamwini someone else’s problem to fix On a trip to Singapore, a few years after the undergrad incident, another social robot, this one built by a Singaporean startup, again failed to detect Joy’s face. While detecting the faces of her fellow travelers. Thousands of miles across the world, Joy realized that this Singaporean startup had used the same generic facial recognition software she’d used at MIT to develop their robot. The issue was that no black faces had been included in the data set used to train the machine learning software. Joy had found ‘ ; there was a problem with this code base that was being used to build facial recognition software. Algorithmic Bias’ default , Adam Grant highlights the result of a study by Mike Housman, which showed that customer service & call center employees who changed the default browser (Internet Explorer) on their work computers to Chrome or Firefox performed better than their peers who didn’t. tend to take fewer original steps in their lives. The suggestion is that these people who do not accept the default have the ability to improve things for themselves. Might they be able to improve things for others by not accepting other that we all experience? In Originals The suggestion is that those who keep their default browsers defaults There are defaults all around us, guiding and molding our lives without us realizing. Embedded in these defaults are the biases and quirks of the people who set up these structures. Some of them we are starting to fix (like above) and . We live in a time when we can use the technology available to us to change . some we’ve only just started to question a lot of the defaults that we now take for granted Thankfully, Joy is doing the work of removing the biases inherent in the defaults in machine learning software. She’s launched the (AJL) and we can all sign up to . As facial recognition software becomes a bigger part of , we all need to work with entities like AJL to ensure the defaults do not disenfranchise a swathe of society. Algorithmic Justice League reconfigure the defaults policing and our societal decision-making structures It’s time for us to look around. What have you discovered that need to be changed? defaults Please like, tweet, share and heart the article if you enjoyed reading it. Sign up for my Polymathic Monthly Newsletter here , you’ll love it. Also, check out HarperJacobs for compelling content creation for your company.

Travelers

Tech and The Defaults That Dictate Our Lives.

For 20 years I ran product teams for companies like Intel, Netscape, eBay, and several startups. I now apply that operational experience to transforming our food system through the program which I started in 2015 at Orange Silicon Valley. The program’s mission is to identify opportunities where hardware and software can transform and solve problems in food and its supply chain. Sustainable Food Systems When I started the program, I embarked on a six month ethnographic immersion of food producers. I visited over 20 farms in 6 distinct growing regions to experience first hand the sites, sounds, smells, and practical realities of a modern farm. A scene from my ethnographic immersion with food producers. This one at Dolcini’s Red Hill Ranch, Novato, CA. At the same time, I spent met with entrepreneurs in the tech industry who were creating “AgTech” companies. You see, starting in 2013, venture capital investment in agtech vastly increased. From 2013 to 2016, more than $10 Billion was invested in food and ag startups. Source: Agfunder AgTech Funding Report, Year in Review 2016 One of the areas that showed the most promise for where tech entrepreneurs could solve real problem in agriculture was IoT. What is IoT? With the launch of the Apple iPhone in 2007, the “internet” transformed into the “mobile internet.” Suddenly, accessed information from using a handheld device. Because more than a billion smart phones have been produced to date, there has been a 10x drop in the price of the components. Take, for example, accelerometers. An accelerometer is a microchip that measures change in velocity. As recently as 2000, accelerometers were used in uncommon devices such as $1 Million defense missiles. Because accelerometeres are now common components of smart phones, they can now be found in . people everywhere $50 dog collars At the same time that components prices were falling, their computational power dramatically increased. When I was an undergraduate in 1993, the Cray Supercomputer was the world’s most powerful computer. It contains the computing power of an iPhone 4. With my current iPhone, I have computing power in my pocket than when I was a computer science student at Carnegie Mellon University. more Photo of the Cray Supercomputer couresy of the University of Queensland, . A History of Computing at UQ As a result were are experiencing another transformation of the Internet: the internet-of-things. Now can access information . devices everywhere When we can internet connect otherwise ordinary devices such as farm equipment, animal ear tags, and water valves not only does it mean that digital data collection is possible, it brings some significant advantages: Continuous and automatic data collection. Devices can interact with each other. For example, the measurement of one device can trigger action on another such as temperature sensor automatically turning on fans in the vineyard: a job that requires a worker to monitor temperature and make a vineyard visit to the fans. Network effects when data is collected and shared in the cloud across entire farming regions. Devices updated automatically with fixes and new features Digital data on the farm is now possible. Three Barriers to IoT on the Farm With as much promise as digital data on the farm has, I see three barriers to its use and adoption. Identifying The Right Use Cases While there have been several hundred agtech companies formed in the last several years, too many of the tech entrepreneurs have little to no experience on the farm. The result is a lot of useless products or products that aren’t ruggedized for the extreme conditions of the farm. Where there are valuable, well-designed products, they are point solutions that miss the larger perspective to integrate into overall farm management. A soil moisture sensor that doesn’t provide actionable insights on overall irrigation or crop stress is no help. A hundred point products — even if they are solving the right problems — are not actionable for the farmer. 2. Lack of Connectivity Most farms I visited had slow internet connections limited to main buildings. Almost none had internet access in the fields. There are two problems here: slow internet connectivity where it exists and lack of connectivity where it is needed for devices. There are repeaters, gateways, and other hardware that can extend connectivity to the crops, but the farmer should not be the systems integrator. If city folk were told they needed to buy and install their own gateways and repeaters to extend Netflix to the bedroom from the living room, you know what answer you would get. Why should we expect the technical expertise and expense to be carried by our food producers? We need faster and more widely available internet infrastruture in farming areas. 3. Lack of an IoT Specific Network Even if we extend broadband and cellular infrastructure to the fields, the lack of connectvity problem is more nuanced when we talk about IoT. For IoT devices, we need a network that works over long ranges but also consumes low power. Most IoT devices send small bits of data — a temperature, a CO2 measurement, a volume. If my cellular bill is to be believed, megabytes (and in some months, gigabytes) of data are sent between my smart phone and the network. To send large data sizes, one needs a cellular or wi-fi network both of which are built for large data sets. However, both cellular and wi-fi consume a lot of battery. That’s why you have to charge your smart phone every day. For IoT, we need a network built for small data, and, hence, long battery life. Bluetooth is built for small data, but the range is only a few feet. This range is impractical on a farm that may span hundreds or thousands of acres. Such networks exist: SigFox and LoRa are two examples, but they are new and nascent. Their coverage map is much smaller than cellular is today. Moving to the Future From what I see on a daily basis, I am optimistic that we will overcome these barriers. What’s needed is more collaboration between the technologists and the agriculturalists. I recently gave talk at the World Food Center at the University of California Davis on IoT on the farm. You can watch my talk below and a PDF of my slides as they were not captured in the video. download

Chain

Dropbox

eBay

Funding

Netflix

ORANGE

Velocity

Barriers to Deploying Internet-of-Things (IoT) on the Farm

CodePen

My approach to using z-index

People are bad at knowing what they want in new product. So how, then, do we scale expensive and long-lead hardware solutions for new products in uncertain markets? At Athelas we’re challenging the need to scale manufacturing through layers of process-limitation, choosing instead to focus on user and function. Our iterative methodology is powered by experimentation, consolidation, off-the-shelf integration, and a bit of Voodoo . “If I had asked people what they wanted, they would have said faster horses.” — Henry Ford. Source: Creative Commons Misconceptions Our viewpoint on product is often narrow and iterative: focusing on issues with something that already exists and improving the product concept within that same context. If a new product is to have staying power and isn’t an iterative improvement that ultimately ends in price and feature competition, it needs to change what we want and how we want it. Since you can ask all the market questions you want and still flop like the recent story, what resources do you commit to a product that is almost certainly wrong? How much weight do you put behind what features? And how do you know when it’s good enough? In other words how do you manage massive uncertainty with conventional project management tools: The following is how is finding product-market fit in the diagnostic blood testing space through maximizing the number of product-iterations through driving hardware iteration time into Agile two-week sprints. Juicero juicer scope, budget, and schedule. Athelas One of these costs $600 to purchase. Source: Bloomberg Iteration Limiting Factor: Mechanical Engineering Since users need to see a product to know if it makes sense, a startup optimizes its chance of survival by controlling burn while enabling as many product-iterations as possible. This is done through minimizing iteration time and maximizing learning from each product experiment, the model of . Lean Startup Build, Measure, Learn Custom mechanical components will generally control the length of an iteration loop for hardware products. The time required to design, mock-up, solicit vendors, agree to terms, order material, manufacture, inspect, integrate, test, refine, and repeat, can take months based on complexity. The worst part is that if you have scoped the application or solution wrong, which you most likely have, the subsequent application pivot erases the effort, leaving you with lessons for next time. The time required to design, mock-up, solicit vendors, agree to terms, order material, manufacture, inspect, integrate, test, refine, and repeat, can take months based on complexity. Source: 52weekturnaround.com Playing Catch-Up The way for mechanical engineering to gain ground on electrical and software is to focus on the : cell phone components, actuation systems, and fasteners, and . This product test can run at odds with the engineering tendency to look ahead to material and process informing design or Design for Manufacturing (DFM): optimizing your architecture based on the technical and economic constraints of these two areas. The effort is merited, but I would argue only after product-market fit is confirmed, unless critical to the core value proposition. However, if you’ve optimized a product that isn’t accepted that forethought becomes wasted time and effort. Realizing the product opportunity first, the later optimization effort will be rewarded in its own right with revenue growth and eventually profit. integration of highly-engineered mass manufactured components tie the system together with processes that enable quick-customization The inclination to complete DFM early is that manufacturing cost, which partially summarizes risk and complexity, kills scalability. Athelas: In-Home Blood Testing An Athelas Challenge: Scaling Custom Housings At , a challenge was tabled for our first 10x manufacturing output increase: Athelas Do we really need to plan, design, and execute a solution around the various limitations of traditional manufacturing: subtractive methods including machining, etc? Could we delay or eliminate all together this body of work and move directly to transformative (molding) processes at scale? The driving force of our build project was to broadly distribute product to collect as much feedback as possible and model trends, quickly. The thought of spending multiple-days or weeks on Design for Manufacturing that would likely be obsolete in a month, although accepted practice, seemed redundant. Having done extensive prototyping by this point, our custom housings conformed with standard additive manufacturing terms: a few hundred dollars per part with a two-day turn. At this price, the device would hardly be a consumer play unless we decided to significantly bleed on each sale until we reached scale. Additive manufacturing is the standard quick-customization process for prototyping and low-volume manufacturing, but it is not great at speed, cost, and often resolution. Segment of Voodoo Manufacturing’s Production Floor (used with permission) Enter . Running a hedge on my subtractive path, I explored companies advancing high-speed and high-volume printing techniques. Founded in the ocean between low-volume custom components and high-volume manufacturing, Voodoo is taking a sly approach to making custom products in a scalable, on-demand fashion. After the collapse of additive manufacturing in 2014, and , former MakerBot Product Managers, realized the issue with additive is that $200,000 industrial printers don’t offer much except better reliability when compared with the hobby-market MakerBot at $2,000. Then came the realization that for one $200k industrial printer, you can establish a factory of 100 MakerBots and turn out 100x the product while hedging on reliability by leveraging your excess capacity. Voodoo Manufacturing Jonathan Schwartz Max Friefeld Source: Voodoo Manufacturing’s Project Skywalker (used with permission) Then came the realization that for one $200k industrial printer, you can establish a factory of 100 MakerBots and turn out 100x the product while hedging on reliability by leveraging your excess capacity. Why you Need a Little Voodoo to Hit Scale Voodoo offered Athelas the ability to forget about process optimization so we could prove out our verticals before locking in our designs. Producing our custom enclosures for and the ability to deliver over was a clear 10x, the bar for a win at Athelas. As we scale with Voodoo, we can learn more about what we’ve overlooked in our market, model a solution, print in-house and test same-day, and fulfill a bulk order in two-days for user deployment. This is the first time I am aware of a startup being able to match the fulfillment capacity of a medium-size OEM, but without needing to finance large capital equipment or pay a large margin to a production partner. The ultimate benefit for Athelas is that by hedging on our internal methods, we never need to hedge or compromise on our users from commitments made to process optimization, tooling, and inventory. 80% less than those produced in an industrial printer 100 units in as little as 48 hours instead of 7 days “Run and Gun” on the Athelas Test Bench. Voodoo offered Athelas the ability to forget about process optimization so we could prove out our verticals before locking in our designs. A Final Thought Custom mechanical components will generally define the speed of product iteration. Additive process offerings have struggled as a scalable solution to mechanical design until Voodoo Manufacturing. Leveraging some “Voodoo” in our process allowed Athelas to achieve an 80% cost reduction on custom housings and find a fulfillment capability of 100s of units in as little as 48 hours. The immediate benefit to Athelas is the elimination of Design for Manufacturing activities until product vertical requirements can become well-defined, an advantage for both Agile integration and customer focus. The core advantage, however, is the ability to quickly and broadly deploy product for data collection without cost being a primary factor. The topic for next time? This is my first post in what I plan to be quarterly insight into how we hack scale-up to drive at 10x growth. I’d love to hear your thoughts and make this a conversation. If you made it this far, thanks! About Athelas Athelas (Y-Combinator ’16) is democratizing blood testing for prediction and peace-of-mind, applied at point-of-care and the home. Packaged as an affordable IoT device, the Athelas platform is enabled by a novel fusion of deep learning and advanced optics. Check us out at and be part of the conversation or continue reading: Athelas.com _At Athelas, we use Convolutional Neural Networks(CNNs) for a lot more than just classification! In this post, we’ll see…_blog.athelas.com A Brief History of CNNs in Image Segmentation: From R-CNN to Mask R-CNN About Voodoo Manufacturing Voodoo Manufacturing (Y-Combinator ’16) is a Brooklyn-based startup that’s on a mission to change the way we manufacture. Learn more at or continue reading: voodoomfg.com _A manufacturing startup’s journey to cut costs and take on injection molding. Co-written with Max Friefeld._medium.com How We’re Building a Robotic 3D Printing Factory

Follow Along: Growth Leadership on Demand

Read My Stories

Scaling A.I. Hardware: A Hedge Play

Machine is a hot topic nowadays. It is a kind of a buzz word everyone is trying to use to look smarter. I asked my friend about type of algorithm his company is using for classification and he said: Learning “ To be honest I don’t have ML experience. I’m tech guy. But to sound smart, I would probably said: we are using complex machine learning algorithm based on artificial neural “ network Actually, it sounds quite good :-) To help people fill hunger for machine learning knowledge I will post series about Machine Learning — and predictive analytics in particular. Machine Learning according to : wikipedia is the subfield of that … gives “ .” Evolved from the study of and in , machine learning explores the study and construction of that can learn from and make predictions on ... Machine learning computer science computers the ability to learn without being explicitly programmed pattern recognition computational learning theory artificial intelligence algorithms data To make it simple, machine learning allows you to build an algorithm (recipe) that doesn’t have to be explicitly defined — is it possible? Yes, everything in this algorithm (recipe) is learned from your data — each condition or new step is based on your data. As a result of learning you get an algorithm, but to be more precise, you obtain a . This model has some knowledge about your data and this model can serve responses for you based on input data. model There will be always some kind of response from model, because otherwise it will be useless. Response can be in different formats — it can be numbers, images, audio, or response can be the internal structure of the model which can bring us some insights. Based on the response you can take actions. Usually, there are two stages in machine learning model life: — in this step you need to learn your model, you are showing data to your model and train it. Phase 1: Learning — it is a ‘production’ phase, in this phase new data is presented to your model, and it serves responses — based on its previous knowledge (from phase 1). Phase 2: Prediction You cannot omit learning step for your model, because otherwise it will produce some random responses. However, sometimes you can buy access to already learned model, which you can use for predictions (for example , ). clarifai algorithmia There are many ways you can categorize machine learning algorithms, one of them depends on data available for learning: — training with a teacher (supervisor), your data should contain information that will be used to guide model about response values, you know what values are desired as the response, and you will teach your model to return them. Some examples: SPAM classification in emails, objects recognition in images, credit risk assessment, churn prediction, prices prediction on stock market. supervised learning — there is no information available to guide model about desired response value, model need to figure out it by itself — it won’t be supervised. Some examples: user segmentation, complex data visualization. unsupervised learning — during learning phase your model interacts with dynamic environment in which it has a certain goal, can make actions and is obtaining a feedback (rewards and punishments) from environment. Some examples: self-driving cars or playing game against opponent. reinforced learning In my opinion , so right now after some theory we will jump into classification task (which is part of ). OK, let’s learn our model! the best way to learn humans is by doing supervised learning I’ve prepared several data sets that are good (easy) for start. They are available on . We will use Adult data set: my github Link for data: here original data source: here In this task, we are training a model to predict whether person’s income exceeds $50k per year based on census data. Let’s look into our : dataset Few top rows from Adult dataset. There are 15 columns in our dataset and 32,562 rows. The first row it is a header and it describes meaning of each column. One row describes one person. Each person is described with: age (continuous attribute) workclass (categorical attribute) fnlwgt (continuous attribute) — it is some index that describes person education (categorical attribute) education-num (continuous attribute) marital-status (categorical attribute) occupation (categorical attribute) relationship (categorical attribute) race (categorical attribute) sex (categorical attribute) capital-gain (continuous attribute) capital-loss (continuous attribute) hours-per-week (continuous attribute) native-country (categorical attribute) income (categorical attribute) Continuous attribute means that values in that column are numbers, for example “age” — in this column we will see only numbers. Categorical attribute means that in this column there will be strings, for example “sex”, there are values “male” or “female”. String values will be transformed into numbers (we will not go into preprocessing details right now, it will be covered in next lessons). For building classifier we will use , which has easy web-based UI — you can set up account there and receive free credits for start (enough to run experiments from MLJAR Academy lessons). We start analysis with creation of new project. MLJAR After project creation please go to and add new data source. Sources After adding new dataset, please go to and let’s check data, column types and distribution. Preview Before training, we need to select which attributes will be used as input for a model (‘Use it’ columns) and which column is a ‘Target’ column. The target column will be used in model training to , I will sometimes call column as column, because model will learn to give reposnses (output) similar to target value. After selecting column usage we need to ‘Accept Attributes Usage’ at the top of . Now, we are ready to start our first Machine Learning experiment! Let’s go to and add new experiment. supervise target output Preview Experiments Wow! This dialog has a lot of features — don’t worry, many of them are set to smart defaults! In this dialog we will set three things: Input dataset: it will be our data source Learning Algorithm: we will select Random Forest Metric to be optimized: we will set Area Under ROC Curve That’s all! We click ‘Create & Start’ and the model training will be started (in background we launch AWS instances for you that will do the job). Please don’t worry about other experiment’s parameters, for example: preprocessing. We will go into details in next lessons. After experiment creation you will be redirected to view. Results OK, what’s going on? There are several rows in the results table and each represents one model. You can click on row in the table to see model parameters. When you train machine learning algorithm it usually has many parameters that control the learning process — their values need to be carefully selected and MLJAR do this for you. That’s all for good start! You made a great progress today: you know what is Machine Learning you know what are types of learning you trained your first classifier with Random Forest algorithm In next lessons we will cover more details: hyper-paremeters tuning data preprocessing model validation and many more! so please subscribe at mljar.com to not miss next posts I’m really interested on your feedback on MLJAR platform! Disclaimer: some of the definitions were simplified to make it easier to explain and understand.

MLJAR Academy: Start with Machine Learning

I want to discuss different ways of collecting metrics from distributed (microservice) systems. The two most common ways I’ve seen are structured logging and metric emitting. Let’s dig in. Structured logging The idea of structured logging is to produce log messages that have a predefined format, e.g. JSON, and to put some semantics (structure) in the JSON fields of each message. {"name":"ServiceA","hostname":"5a28d77e1096","pid":1,"level":"info","user":"ivan","msg":"Something is happening.","time":"2017-04-21T07:57:44.712Z"} Having structured logging in place enables constructing log-based metrics. Log-based metrics allow you to count the number of log entries that match given user defined filters. Example would be all logs that have field with value. And with systems like or this is very easy. In fact it is so easy, that people abuse it. Why? Here are several reasons. level error ELK Stackdriver Writing tons of data to stdout/stderr has a performance impact on your application. For small amount of data it may be negligible, but as the data volume increases so does the performance penalty. Also be aware that some log collecting agents might make use of throttling, which can slow down your application even more. Just for reference, haproxy does not support logging to stdin/stderr or to a log file and I’m pretty sure this is one of the reasons for the decision. If you still decide to do it, make sure it is not in the thread handling the hot path of your application. Writing tons of logs could impact the performance of your logging stack. Let’s consider the ELK stack. In most cases I’ve seen, ELK has a hidden Q in it. The Q stands for a queue which buffers messages if sudden spikes in traffic arise or the parsing or the storage layers are experiencing turbulence. And it is not uncommon for the last to happen. After all, this is another distributed system. But for you as a end users, this means that your view for the state of the system is lagging behind. And if there is problem with your services and they produce even more log messages in order to signal for the problem — it’s getting even worse. Writing tons of logs could impact the underlying system’s network Transporting a log message requires much more bandwidth than transporting a single metric value. I’ve seen a situation where a performance test for the logging subsystem of a PaaS solution almost bring down whole network segment of the underlying IaaS provider. Not to mention that some of the will accumulate all value changes locally, and only periodically send the delta, which will reduce both the consumed network bandwidth the performance penalty even more. This technique is used for tracing as well [2]. monitoring tools Worse development experience Not so technical, but very important thing. Having a local development environment that consist of 5+ services, each going crazy on logging is a terrible experience. Even more, you may benefit from the log-based metrics in your staging and/or production environments, but bringing them to development is a hard task. Emitting metrics for things you care solves both problems — you’re able to focus on the important log messages and still, observe the behavior of the system. Some systems might drop log messages If you rely on log-based metrics to capture all of those important events, and they become more and more, you might loose some without even getting notified (e.g. Cloud Foundry, [1]). So one more time — log only important and actionable events and use metrics for the other things. Emitting metrics Things are more diverse here in terms of technologies, but conceptually you’re capturing your application state and emitting it to a 3rd party system at some point. Following are some points for emitting metrics. Accumulate changes locally Since at the end metrics are just numbers, it is possible to accumulate them locally and emit them once in a while. It is possible to lose the accumulated information in case of crash, but this greatly reduces the consumed network bandwidth. It is also possible to do it the other way around — the application exposes the current values and whoever is interested can read them. (This is basically push vs. pull models) Intensions are explicit in the source code Collecting metrics requires instrumenting your code. It is a bit of work, but it makes your intention clear, which is not the case with log messages. If someone accidentally changes the format of log message you’re relying on for your log-based metrics, you’ll notice just after all of your running service instances are updated. Having separate code in place for collecting and emitting metric greatly reduces the chance somebody deletes it by accident. Tracing Tracing is a hot topic (at least for me) recently, and it surely has a place in making your system more observable. The idea is to trace a request across service boundaries. It is particularly useful when the request is interacting with multiple services. I will not cover any more, but just wanted to mention it. For more details, you can start with [2]. No silver bullet Both logging and metric emitting have their place. Just make sure next time you go for a particular option you understand the pros and cons and are aware of all alternatives. [1] https://docs.cloudfoundry.org/devguide/deploy-apps/streaming-logs.html [2] https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/36356.pdf

Trace

Caveats in metric collection

React VR framework to create web based virtual reality apps — what a staggering initiative! In December last year Oculus announced the pre-release profiting from React Native technology. It means new and simpler opportunities both in making and viewing VR experiences. Hence the next question emerges: how much does it cost to create VR web apps and how to do a sample React VR app. In this article our dev team is going to showcase the possibilities of React VR Oculus. We’ll make a simple , a 360-degree virtual reality tour to view in a web browser. With this technology you can even try out virtual reality without a VR headset, which is awesome. React VR example But first things first. What is React VR? What is React VR? React VR is a JavaScript library (framework) that has been developed by Oculus with the aim of creating . It is a part of bigger React entity. is a JavaScript library (framework) by Facebook for building interactive UIs for web and mobile environments. is used to build mobile apps on JS, specifically. web-based virtual reality applications React React Native According to Oculus, React JS VR projects are going to run on the VR web browser under the name . The pre-packed release of is available for download with the source code on Github for preview so that anyone could give feedback. Carmel React VR app Thus, it is a great tool for any web developer and/or VR developer. Why? Because of ability to start making VR web apps even without a VR headset in possession. What is WebVR + QUIZ on Virtual Reality , the experimental API that makes it easier to create VR experiences for web. Some call it a — in a way that anyone could try virtual reality directly in a browser. And yet, no need for VR devices like Google Cardboard, Oculus Rift or HTC Vive. WebVR VR web browser It is similar to 360-videos like you’ve seen on YouTube. But most noteworthy you can navigate through it in as well. WebVR also works in pairing with React VR library and Carmel VR browser. Now, to spice things up a little bit, we’ve prepared a little for you to determine how well you are familiar with VR technology. Answer 10 basic questions and press Submit for results. quiz Our demo project Here we will be creating a small VR web application — of virtual reality tours in 360-degree view and navigation. We’ll use of panoramic images by Oculus, which would look something like this in your browser: a React VR example React VR sample There will be few locations, like restaurants and coffee shops for users to see in all-round view. We will also add rotation and buttons (arrows) to point out possible directions to enter other locations. As a result, it is going to serve as short and plain demonstration of how React VR works and its possibilities. We’ll go in step by step mode, showing code samples of our React VR project. In the end you’ll also find our team’s estimate for how much does it cost to create VR web apps with React VR. The final version of our VR tour for web browsers will consist of 5 locations, much as these: Technical requirements To create a React VR app one has to have installed first of all. This JavaScript environment powers code compiling and running a local server. One most probably also needs , a package manager by Node.js with lots of libraries and reusable code. Same, as possible additional 3D library. Node.js NPM Three.js With and APIs we can already render 3D imagery within a web browser. Since you do not need any special VR devices or headsets to build a React VR app, just basic stuff is enough. What you actually do need along React VR for making web apps is: WebVR WebGL A PC/laptop on Windows A compatible browser A latest Node.js version A VR headset (optional) What are the compatible VR web browsers? React VR framework is usually layered this way: . OVRUI by the way, is a library helping with geometrical types and objects to build user interfaces for VR web apps. React VR > React runtime > OVRUI > Three.js > WebVR and browser React VR project setup To make VR web apps as our React VR example first we have to do a short setup with tools provided by Oculus. To start, we install the React VR using NPM: CLI tool npm install -g react-vr-cli With it we create a new directory for web application and name it for our React VR app project: TMExample react-vr init TMExample This may take some time, so do not worry. Then we place into our directory: cd cd TMExample To check if it’s working, we test a local server with: npm start After all of this is done, open the following URL in your web browser: Clearly, give it few moments to initialize the application, and you should see the animated VR environment like this: . http://localhost:8081/vr Now you good to go with building your own web based virtual reality apps with React VR. Let’s explain how we built our simple VR tour app. Creating a VR tour for web The structure of our app’s directory is as follows: +-node_modules 
+-static_assets 
+-vr 
-.gitignore 
-.watchmanconfig 
-index.vr.js 
-package.json 
-postinstall.js 
-rn-cli-config.js The code of a web app would be in the file, while the directory hosts external resources (images, 3D models). In addition, you can learn more on how to get started with . index.vr.js static_assets React VR project VR components in use We use React Native packager for code pre-processing, compilation, bundling and asset loading. In render function there are . Each of these React VR components comes with a style attribute to help control the layout. view, pano and text components To wrap it up finally, check that the root component gets registered with It bundles the application and also readies it to run. Next step to highlight in our React VR app project is compiling 2 main files. AppRegistry.registerComponent. Index.vr.js file In constructor we’ve indicated the data for VR tour app. These are scene images, buttons to switch between scenes with X-Y-Z coordinates, values for animations. All the images we contain in folder. static_assets constructor (props) {
     super(props);
    this.state =  {
      scenes: [{scene_image: 'initial.jpg', step: 1, navigations: [{step:2, translate: [0.73,-0.15,0.66], rotation: [0,36,0] }] },
               {scene_image: 'step1.jpg', step: 2, navigations: [{step:3, translate: [-0.43,-0.01,0.9], rotation: [0,140,0] }]},
               {scene_image: 'step2.jpg', step: 3, navigations: [{step:4, translate: [-0.4,0.05,-0.9], rotation: [0,0,0] }]},
               {scene_image: 'step3.jpg', step: 4, navigations: [{step:5, translate: [-0.55,-0.03,-0.8], rotation: [0,32,0] }]},
               {scene_image: 'step4.jpg', step: 5, navigations: [{step:1, translate: [0.2,-0.03,-1], rotation: [0,20,0] }]}],
      current_scene:{},
      animationWidth: 0.05,
      animationRadius: 50
      };
} Then we’ve changed the output of images linking them to , previously indicated in constructor. state Navigational buttons In each scene we’ve placed transition buttons for navigation within a tour, taking data from . Subscribing to event to convey switching between scenes, binding to it as well. state onInput this onNavigationClick(item,e){
     if(e.nativeEvent.inputEvent.eventType === "mousedown" && e.nativeEvent.inputEvent.button === 0){
          var new_scene = this.state.scenes.find(i => i['step'] === item.step);
          this.setState({current_scene: new_scene});
          postMessage({ type: "sceneChanged"})
     }
}
sceneOnLoad(){
    postMessage({ type: "sceneLoadStart"})
  }

  sceneOnLoadEnd(){
    postMessage({ type: "sceneLoadEnd"})
  }
this.sceneOnLoad = this.sceneOnLoad.bind(this);
this.sceneOnLoadEnd = this.sceneOnLoadEnd.bind(this);
this.onNavigationClick = this.onNavigationClick.bind(this); Button animation Below, we’ll display the code for navigation button animations. We’ve built animations on button increase principle, applying conventional . requestAnimationFrame this.animatePointer = this.animatePointer.bind(this);
animatePointer(){
    var delta = this.state.animationWidth + 0.002;
    var radius = this.state.animationRadius + 10;
    if(delta >= 0.13){
        delta = 0.05;
        radius = 50;
    }
    this.setState({animationWidth: delta, animationRadius: radius})
    this.frameHandle = requestAnimationFrame(this.animatePointer);
}

componentDidMount(){
    this.animatePointer();
}

componentWillUnmount(){
    if (this.frameHandle) {
        cancelAnimationFrame(this.frameHandle);
        this.frameHandle = null;
    }
} In function we’ve indicated the current scene. Then we’ve also subscribed to event for data exchange with the main thread. We do it this way due to a need to work out a React VR component in a separate thread. componentWillMount message In function we only process one message with key. We’ll elaborate later why we do so. Similarly, we’ve subscribed to event to convey arrow turns. onMainWindowMessage newCoordinates onInput componentWillMount(){
     window.addEventListener('message', this.onMainWindowMessage);
     this.setState({current_scene: this.state.scenes[0]})
}
onMainWindowMessage(e){
     switch (e.data.type) {
          case 'newCoordinates':
               var scene_navigation = this.state.current_scene.navigations[0];
               this.state.current_scene.navigations[0]['translate'] = [e.data.coordinates.x,e.data.coordinates.y,e.data.coordinates.z]
               this.forceUpdate();
          break;
     default:
          return;
     }
}

rotatePointer(nativeEvent){
     switch (nativeEvent.keyCode) {
           case 38:
                 this.state.current_scene.navigations[0]['rotation'][1] += 4;
           break;
           case 39:
                 this.state.current_scene.navigations[0]['rotation'][0] += 4;
           break;
           case 40:
                 this.state.current_scene.navigations[0]['rotation'][2] += 4;
           break;
           default:
                 return;
     }
     this.forceUpdate();
} Arrow turns are done with ↑→↓ alt keys, for Y-X-Z axes respectively. Furthermore, see and download the whole file as part of our . index.vr.js React VR example Client.js file Moving further into our React VR example of virtual reality web applications, we’ve added the code below into function. The goal is processing of , and events, where the latter is in rendering thread for message exchanges. Also, we’ve kept a link to and objects. init ondblclick onmousewheel message vr vr.player._camera window.playerCamera = vr.player._camera;
window.vr = vr;
window.ondblclick= onRendererDoubleClick;
window.onmousewheel = onRendererMouseWheel;
vr.rootView.context.worker.addEventListener('message', onVRMessage); We’ve introduced the function for zoom returning to default when scenes change. Also, we have added the loader when scene change occurs. onVRMessage function onVRMessage(e) {
     switch (e.data.type) {
          case 'sceneChanged':
               if (window.playerCamera.zoom != 1) {
                    window.playerCamera.zoom = 1;
                    window.playerCamera.updateProjectionMatrix();
               }
          break;
          case 'sceneLoadStart':
             document.getElementById('loader').style.display = 'block';
          break;
          case 'sceneLoadEnd':
             document.getElementById('loader').style.display = 'none';
          break;
          default:
               return;
     }
} function for 3D-coordinates calculation and sending messages to vr component to change arrow coordinates. The get3DPoint function is custom to our web VR application and looks like this: onRendererDoubleClick function onRendererDoubleClick(){
    var x  = 2 * (event.x / window.innerWidth) - 1;
    var y = 1 - 2 * ( event.y / window.innerHeight );
    var coordinates = get3DPoint(window.playerCamera, x, y);
    vr.rootView.context.worker.postMessage({ type: "newCoordinates", coordinates: coordinates });
} Switch to mouse wheel We’ve used the function for switching zoom to a mouse wheel. onRendererMouseWheel function onRendererMouseWheel(){
     if (event.deltaY > 0 ){
          if(window.playerCamera.zoom  > 1) {
               window.playerCamera.zoom -= 0.1;
               window.playerCamera.updateProjectionMatrix();
          }
     }
     else {
          if(window.playerCamera.zoom < 3) {
               window.playerCamera.zoom += 0.1;
               window.playerCamera.updateProjectionMatrix();
          }
     }
} Exporting coordinates Then we’ve utilized to work with 3D-graphics. In this file we’ve rather conveyed one function to export screen coordinated to world coordinates. Three.js import * as THREE from 'three';
export function get3DPoint(camera,x,y){
    var mousePosition = new THREE.Vector3(x, y, 0.5);
    mousePosition.unproject(camera);
    var dir = mousePosition.sub(camera.position).normalize();
    return dir;
} Check and download the whole file on . There’s probably no need to explain how the file works, as it is plain simple, and you can download it as our as well. client.js Github demo cameraHelper.js ReactVR demo And this is it, this is how we’ve created our short VR tour using React VR framework. The source code of this whole project is available for download at our demo . React VR GitHub Also, bear in mind, that this was the demonstration of general possibilities of React VR. It has already made VR web apps possible thanks to Facebook efforts, and with official full release of React VR there will be more. The cost of making a React VR app Obviously, calculating the cost to make web-based virtual reality applications using React VR can not be precise. It totally depends on the skill-level of chosen . It is a grey(ish) area at this point in time. This React VR framework by Oculus is still pending for official release and is expected to be enhanced considerably yet. And yet, as we’ve shown in our VR tour demo, making VR web apps is already possible. ReactJS developers And we’ve only used official free samples from React VR library. To build your own project you would have to install a local server and CMS, as well as create 360-degree images and three-dimensional objects. The cost estimate for such here at we imply a hourly rate. VR web app ThinkMobiles $40 In conclusion Note, that cost of any custom React VR app for web would depend on the amount of 3D-imagery and backend buildup. On our side, 1 developer was engaged in this task. And yet, it took about one week to create this VR tour from zero. The principal challenge of our React VR app was data exchange between the main and virtual reality component thread. We’ve actually put together 5 locations to view and switch between for this short web VR tour. Finally, you can view our in full, and read more of our related articles about: VR tour Hire VR/AR developers VR app development How much does it cost to make an app? Thank you for reading. If you like it leave some 👏. Originally published at thinkmobiles.com

Facebook

Super

YouTube

How much does it cost to create sample React VR app?

On April 12, 2017 turned five years old. We grew big, real big. Five thousand new companies signing up with your service each and every day all over the world is nothing to sneeze at. There are now over 200 ‘bitrixoids’ spread out in six different offices. There are markets, like Eastern Europe, where we are the dominant player, bigger than Salesforce, Slack, Sharepoint or Asana in each respective niche. There are markets where our market share is still 1% and many businesses don’t know how to spell our name. We’ll get there. For me personally, the five year figure is just an excuse to write another strategy post, because we use the 5–3 method over here and I think many of you fellow ‘saasters’ may find some of our approaches insightful. Bitrix24 SaaS The 5–3 method is simple. When launching a product or a service, one single strategic decision has to be made — what is the BIGGEST change that will happen to your industry in 5 years that most of your competitors are blissfully unaware of? That’s where five years come from and it’s the only BIG strategic decision you need to make. The three year part is pretty straightforward as well. Which technological changes are so obvious, everyone will do it in three years. For example, the ‘mobility’ trend is an obvious one. So a decision to make the best mobile , because many sales agent will access CRM via smartphone, would be a tactical one. CRM Many mistakenly confuse these two parts. They think that mobility trend is ‘strategic’, but it’s not (at least not in this model). Yes, you absolutely do have to have very capable mobile app for your service. But the point is that ALL OF YOUR COMPETITORS will have those in three years. You WILL suffer, if you don’t, but without other strategic bets that decision alone won’t give you much of an advantage. So let me spell our past strategic and tactical decisions that we made years ago, reasons they were made and the effect they had on our service and competition. 1. Strategy behind Bitrix24 service. In 2012, we thought that the most important strategic bet to make is that by 2017 people will start to realize that integrated business tools have a tremendous advantage over standalone ones. It’s clear that Microsoft holds the very same position — they’ve added MS Dynamics option to Office 365 suite, purchased Yammer, launched Teams, all in addition to email and document management tools they’ve had for a long time. But, though not as bad as Zoho, these MS tools still aren’t as integrated with each other as in Bitrix24. Salesforce is only testing waters with Quip purchase. It’s clear that they want to go beyond the sales department, but they don’t seem to have the strategy how to get the entire company. Surprisingly, Google did nothing of substance with their enterprise tools over the five-year period, other than renaming Google Apps a couple of times. With Gmail, Google.Drive, Google Docs and Google Calendar being clearly superior products, Sergei and Larry don’t seem to show interest in offering businesses sales management tools or collaboration ones, other than for documents. None of the other possible scenarios that we envisioned, like IBM buying Box and other players in order to have SMB suite comparable to Microsoft, or Dropbox growing into a full blown collaboration platform that goes beyond documents, have materialized. Facebook at Work seems to make the very same mistakes Yammer made and there’s no talk of buying Asana ‘back’ to give FB business users at least task management. This strategy gave us both advantages and disadvantages. Clearly, there’s still aversion to Bitrix24 being too complex and powerful. At the same time, it made Bitrix24 so different, it instantly put us on the map and helped us grow at a tremendous pace without any outside financing (the total costs for launching the platform were about one million dollars). Personally, I am watching closely Slack, Asana and few other tools (mostly CRM) that have exploded over the same time period, have excellent products and a very loyal fan base. If our assumptions were correct, they are about to pay dearly for the decision they made five years ago to stick to their core competence. (I know I sound like a megalomaniac, but I prefer putting things in writing for historical reasons. After all, not very many people read this blog and if I am wrong, I just sound like an amateur. But if I am right, all of a sudden Bitrix is full of superintelligent people who foresee the future for years ahead). Enough with the five year strategy. Let’s talk smaller things, like pricing. 2. Bitrix24 pricing. I’ve written before about our and advantages it offers. Quick entry, easy calculations, comfort of knowing your costs aren’t going up as your team grows. But let me explain another important consideration that went into making this decision. Before I do, again, a couple of thoughts about the SaaS market to help you understand logic behind why we did what we did. freemium strategy You’ve heard the term ‘market consolidation’ and know what it means. If you are older, you remember Lycos, AltaVista, Excite or WebCrawler names from the 90s, but it’s all Google now. I am writing about this, because you can probably easily name a dozen project management tools or CRM solutions just as easily as you could search engines in the 90s. There are actually more than a hundred of active companies in each niche. Some believe that this situation, when there are more than a dozen popular CRM or PM platforms around, each able to find own customers, will last forever. But we think that it’s not only possible, but actually likely that situation can turn as quickly as it did with the search engines. If you look at this as a very real possibility, you sure better plan for the upcoming ‘ ’. We do. saasicide Now let’s talk about SaaS pricing and why almost everyone charges per user. CACs (Customer Acquisition Costs) are substantial for most SaaS. This is what makes or breaks a service. And when you pay $30 to Google to get someone to try your CRM, you have no idea if it’s a solo entrepreneur or a large company that is going to buy dozens of licenses and bring tens of thousands of dollars in revenue. This has two outcomes for most SaaS companies. First, a small section of large clients brings most profits. Second, acquiring small clients is oftentimes a money losing proposition. The end effect is this — if you starve an average SaaS of clients that purchase multiple licenses, they are toast. If you are an IT pro with a Russian passport, you know that several Russian based Bitrix24 competitors threw in white flags, despite having a substantial head start. This is a direct result of our pricing strategy that in effect severely limited their ability to acquire and keep customers. We expect similar effect in other markets, once our marketshare passes a magic number there. For those in the west, let me give you an example you can easily understand — dramatic Basecamp decline after Trello and Asana were launched. (Statistically, average project management account has seven to ten paid seats and free Trello and Asana plans are quite accommodating. I’ve written about ). When asked for a project management recommendation in 2017, you are much more likely to hear Trello or Asana, not Basecamp. Basecamp is done, since their product is now both inferior technologically and priced less attractively. It has no future. Basecamp’s and Jason Fried mistakes before Anyway, when thinking whether we’d like to be on the giving or the receiving end of the upcoming pain, we’ve made a decision that our pricing strategy isn’t going to be about profit maximizing, but rather increasing our chances of surviving and disrupting markets in our favor. This is a much more important decision than deciding whether your prices should end in 9 or 7 — yet this what what many SaaS founders bicker about . 3. Worldwide expansion. Many European startups target US as their primary ‘foreign’ market. The prevailing view over here is that it’s better to hold 2% market share in US, than 20% in Bangladesh (more money). We think differently. Even though our #1 market is US and #2 is Germany, Mexico or India generate same volume of sales for us as does UK. Our sales in Vietnam, Indonesia and Philippines are higher than in Australia. Sure, targeting ‘the developed world’ gives you money, but that’s about it. You won’t be able to beat Salesforce or Microsoft at their own game on their own turf. It’s just not going to happen. Plus, contrary to what you might expect, the developing world is oftentimes more receptive to new ideas. We have partners who’ve worked with the city of New York and the city of Ho Chi Minh. One municipality runs on modern social intranet and another uses a mish mash of antiquated legacy solutions that would make you believe the 90s have never ended. Try guessing which one is which. Here are some other ‘contrarian’ thoughts that I think are worth sharing as well. First, it’s easier to protect you home turf, if you expand to other countries. If you stay local, you are dead in five years. Second, stop giving Silicon Valley too much credit and underestimating yourself. Zoho creates more troubles for Salesforce in US than Salesforce does for Zoho in India. If you aren’t using this as an advantage — it’s your own fault. Third, you need to create a product that the ENTIRE world will use. This doesn’t just mean localization and languages, it also means pricing, partners and other considerations. Suppose 20 years ago you had a choice, you could invest $1 million in Japan, an incredibly wealthy country, or China, which was and still is considerably more poor. Which country would you pick back then, knowing what you know now? The answer is obvious. This is why I am surprised that most SaaS vendors are flocking to US or UK, even though it’s clear that it’s countries like Nigeria where the market will grow tenfold in the coming years. Closing thoughts I have no idea if the 5–3 method is our invention or not. I wouldn’t be surprised to learn that other companies use similar methodology, calling it by a different name. Very few things are original in this world. Personally, I was very skeptical in 2012, when I met our CEO for the first time in person and he was talking about what collaboration inside companies would look like in five years. I’ve never seen product committees that spent so little time analyzing competitors and so much time arguing about which features will be so popular in three years, we need to add them to our product as soon as possible. This was all very different from what I read in TechCrunch or ProductHunt, where the overwhelming emphasis still is on design, user interface and ‘do one thing, but do it better than anyone else’. (Oh, and by the way, I am still pissed at TechCrunch in general, and Mike and Ingrid personally, that they’ve never wrote about Bitrix24 in those five years. Really, guys?) Now that the five years have passed and we’ve made another set of strategic and tactical bets about markets, pricing, competitors and features, I feel like I have to share some of our past ideas and approaches. They’ve worked for us and they probably will for you as well. It’s important to think big. It’s important to think ahead of the market. It’s important to think beyond your VC presentation and the next round. It’s important to thing beyond ‘let’s make it pretty’. A single big idea is more important than a hundred of small ones. Don’t reduce yourself to ‘Uber of this’ or ‘just like Slack, but…’ I hope you find these ideas insightful. But than again, I am just an amateur. P.S. If you speak Russian, here’s yesterday’s and the five year anniversary celebration. Bitrix24 presentation is how hackers start their afternoons. We’re a part of the family. We are now and happy to opportunities. Hacker Noon @AMI accepting submissions discuss advertising & sponsorship To learn more, , , or simply, read our about page like/message us on Facebook tweet/DM @HackerNoon. If you enjoyed this story, we recommend reading our and . Until next time, don’t take the realities of the world for granted! latest tech stories trending tech stories

Asana

Basecamp

Instantly

Microsoft

Salesforce

Slack

Trello

Uber

The 5–3 Method Behind Strategic Planning At Bitrix24.

A week or so ago, I updated the Facebook app on my phone. The very next day, it was back with a new update. I updated that too without comment. Around a week later, a new update weighing in at 240MB popped up. As I was about to hit the update button again, I paused. What is it with these guys at Facebook? Do they think I am made of data? Unlimited broadband plans (wifi) do exist in India. In reality, it gets throttled once you reach a certain limit. My previous plan with BSNL used to be 30GB a month, and once I crossed it, my 4mbps connection would be throttled to a snail-like speed of 256kps. Last year, I switched to ACT who gives 75GB a month at around 8mbps, and a post 75Gb speed of 512kpbs. But old habits die hard, and I still don’t like the idea of data hungry apps and app updates. It’s not like other apps don’t have heavy updates. In fact, Apple’s own apps like Pages, come with much heavier updates. But it happens infrequently, maybe a couple of times a year, and is usually tied to major iOS updates. So what’s going on? I don’t know much about app updates. But I guess it works a lot like iOS updates. Small updates to patch bugs. Big ones for a complete app overhaul. That would be why many apps tend to have smaller updates. So what makes apps like facebook have complete overhauls of their app all the time? Facebook claims every update improves speed and reliability. It could be true but it shows a lack of sensitivity to its users. It’s not like Facebook doesn’t know that data is an issue in India. In fact, they launched a special light version of Facebook for Android phones, called Facebook Lite just for India that’s only 1.8MB on my Android (Mi4i). Why not a Facebook Lite app for iOS too? Do they believe iPhone users are less worried about data? Is Facebook just being lazy? Or is it being arrogant and assuming that users love Facebook so much that they won’t mind downloading it millions of times? Or maybe it’s just good business. Making small updates may be more time consuming than just releasing the whole app. And as we all know, time is money, and Facebook wants to be the world’s first trillion dollar company. In short, Facebook is not concerned about wasting my data, probably because I’m the one paying for it. At this point, it struck me that maybe Facebook is right. Maybe the typical Facebook user is not the type who worries about a couple of a piddly hundred megabytes every week or two. This guy has bigger worries, and this newspaper clipping sent by a friend, gives a better idea of what they are. It also perfectly captures why I’m not much of a Facebooker, and have yet to post a personal photo in my ten plus years on it. In fact, my Facebook profile pix is ten years old, and my phone number on Facebook is an old one. Not that I was actually fooling Facebook. The sneaky guys had secretly linked up my Facebook account with my WhatsApp account, and pulled all the contacts from my phone onto Facebook, all the while pretending to be unaware of my current phone number. So why am I on Facebook at all? Partly for Facebook Groups which are pretty useful in organising crusades against organisations who believe in the principle of divide and rule, and partly to check out stuff that goes viral. That’s when my tubelight finally came on. It struck me that since I’m not a typical heavy Facebook user, I don’t really need the app. I can always check Facebook on my browser if need be, which is like once a week. The app could go. No sooner said than done. Sayonara, Facebook. Your 244MB updates will not be missed. Update : Stéphane Tsacas pointed out that the actual download size of an update may be a lot less than what is listed. The explanation is here . To confirm, I downloaded the Facebook app and tracked the size of the download. The listed download size was 230MB while the actual download was 138 MB. (See below). It’s quite likely a similar result may appear for updates too. Assumption is indeed the mother of all… I apologise for misleading my readers.

Why I kicked Facebook off my phone

Ball

Bitcoin Oburoni

The three aspects of resilience (persistence, adaptive capacity and transformability) describe important capacities of living systems: to resist collapse and maintain vital functions, to adapt to changing conditions (learn and self-organize) and in the case of Socio-Ecological Systems to apply foresight and anticipation to ‘design for positive emergence’ — to transform the system towards increased health and an improved capacity to respond wisely and creatively to disruptions and change. The theory of complex dynamic systems describes the periodic, rhythmic dance between order and chaos, between stability and transformation as a fundamental pattern of self-organization in complex (living) systems. As any system begins to mature, there is an accompanying increase in fixed and ordered patterns of interactions and resource flows. The system becomes over-connected, or better, the existing qualities and quantities of connections are such that they inhibit the formation of new pathways needed for the system’s overall adaptation to outside changes and its continued evolution. Eventually this leads to rigidity within the system, and it becomes brittle, less resilient, and more susceptible to disturbances from the outside. At this point, the effects of detrimental run-away feedback loops inside the system can further challenge viability. The often resulting gradual or sudden breakdown of the old order and structures moves the system closer to ‘the edge of chaos’ — the edge of its current stability (dynamic equilibrium) domain. The reorganization of resource flows and changes in the quality and quantity of interconnections within the system at this point create a crisis that can be turned into an opportunity for transformation and innovation. [This is an excerpt of a subchapter from , published by Triarchy Press, 2016.] Designing Regenerative Cultures At the edge of chaos, complex dynamic systems are at their most creative (Kauffman, 1995). Ervin László argues in Th_e Chaos Point th_at the world and humanity is currently at a crossroads between breakdown and breakthrough. If we take appropriate actions, the chaos point could be an opportunity to “leap to a new civilization” (László, 2006: 109). Understanding the overall dynamics of change we are in the midst of is important. We need to learn to rather than these cyclical patterns of creative innovation, consolidation, ossification and eventual dissolution to make room for transformative innovation and renewed creativity. work with fight against The adaptive cycle is a model of natural patterns of change in ecosystems and eco-social systems. It consists of four distinct phases: ‘growth or exploitation’ (r); ‘conservation’ (K) of established patterns and resource distribution; ‘collapse or release’ (Ω); and reorganization (α). The adaptive cycle (see Figure 8) is often drawn like an infinity symbol or Möbius loop that joins these four phases. The journey from exploitation (growth in the diagram above) to conservation is referred to as the ‘fore-loop’ (blue and green part of the loop). It describes the slow and often longer phase of growth and accumulation of resources in the system. Eventually, too much rigid structure, fixed connections and accumulation of resources in the system make it brittle and poised for release or collapse. The transition from release to reorganization is referred to as the ‘back-loop’ of the adaptive cycle (red and orange part of the loop). This phase is often fast moving and relatively short. In this phase the opportunity for redesign, reorganization and renewal is high, due to the release of rigid structures, established patterns and the redistribution of resources throughout the system. In the adaptive cycle, the creative ‘edge of chaos’ is reached during the beginning of the ‘release’ phase and left at the end of the ‘reorganization’ phase. During the α-phase the opportunities for and likelihood of creative change is highest. In the r-phase these opportunities for change are tested against each other and one or a few innovations begin to define the characteristics of the transformed system. This structure is conserved and then begins itself to rigidify during the K-phase, until the often rapid and sometimes catastrophic release (collapse) in the Ω-phase takes us back to the creative ‘edge of chaos’ conditions. This offers renewed opportunities for reorganization in a new α-phase and a new adaptive cycle. The potential for regime shift or transformational change that moves the system into a new way of functioning (which may offer increased resilience and health) is highest during the α-phase. Transformative innovations introduced during this stage have the potential to lift the system into a new stability domain. Design interventions aiming to increase the resilience capacity of a system should use foresight and explore future scenarios to evaluate the potential effects of the intervention or redesign they propose. In trying to navigate these natural change dynamics at different scales simultaneously, we have to remember that all three aspects of resilience are important. Finding a balance between persistence, adaptive capacity and transformative resilience will determine — to a certain extent — how turbulent, rapid and profound the transition will be. Since there is a scale-linking connection between systems at different spatial scale and the adaptive cycles of bigger systems tend to move more slowly while the adaptive cycles of smaller systems tend to move faster, we also have to pay attention to what aspect of resilience we are nurturing at what scale and how the different scales influence each other. [This is an excerpt of a subchapter from , published by Triarchy Press, 2016.] Designing Regenerative Cultures

The adaptive cycle as a dynamic map for resilience thinking

This image is public domain. Hooray for public domain! Last fall, I interviewed six women and non-males who have exciting careers in . Those articles were all published in . cybersecurity Tripwire’s State of Security blog Ideally, all people in our field, regardless of gender, race, ethnicity, age, nationality, and sexual orientation, would simply be regarded as “people who work in information .” Unfortunately, we work in a male dominated field, and sometimes dealing with sexism affects our careers. security I think it’s especially important to encourage more women and transgender people to consider careers in cybersecurity. So my interview series shines a spotlight on some of the brightest minds in our field — who just so happen to not be male. My series was very well received. So, as spring arrived I decided to continue it. The first new interview for 2017 is now on Tripwire’s State of Security blog. . Check out my new interview with Dr. Jessica Barker here I’ve decided to republish here. Please enjoy them! my interview series from last fall And if you can spare a few bucks, please consider contributing to . I don’t get paid for my Medium published articles, and the trickle of money here and there that I receive from helps keep me going. Thank you! my Patreon my generous patrons There’s also a way you can help me that won’t cost you any money at all. Click on the little green heart if you like my article, it’ll help with my visibility. Most appreciated! Women in information security are a fascinating group of people. I should know, being one myself. But being female in a quickly growing male-dominated industry poses its own challenges. And those of us who pursue security and IT in spite of gender stereotypes have unique strengths and insight. I first interviewed , a Scottish security analyst who’s working in the United States. Then, I spoke to , otherwise known as on Twitter. After years of working in different fields, including as a legal librarian, she found infosec and her own business. Then I spoke to , who’s a penetration tester for a defense contractor. For my fourth interview, I spoke to . Web development got her to explore IT and eventually led to her infosec career. Tiberius Hefflin Tracy Maleeff @InfoSecSherpa Isly Kat Sweet For my next interview, I spoke with Jess Dodson, a sysadmin from Australia who is very much infosec-minded. As difficult as it was to navigate the time zone differences between Toronto, Canada, and the “Land Down Under,” we managed to have a fascinating discussion. How would you describe your job and title? Kim Crawley: System Administrator. I’m operational staff. I look after servers and keep systems running. My primary focus is our active directory domains and domain controllers, which is how I stepped over into the infosec side of things. I’ve started taking more of an interest in the security side of managing our domains. Jess Dodson: That’s really cool. How did you get into sysadmining in the first place? KC: Slightly long story. My dad’s a systems engineer (though he hates the term engineer), and so I’ve always had computers around for as far back as I can remember. Probably when I was thirteen or so I started taking more of an interest in IT. I bombed high school a bit, ( .) so I studied at TAFE (a trade college). Then, I was lucky enough to have a friend from TAFE say there was a job opening at the university she worked at. I went for an informal interview, was hired on the spot and started four days later. That was nearly twelve years ago. JD: Thank you, Diablo II I started as a helpdesk lackey three days a week. I then went to five days. Then I got a permanent position as an “IT Officer.” I stayed in that job for just under seven years before I jumped ship for an official system administrator position for state government. Did you have any credentials before you became helpdesk? KC: I had a Diploma of Information Technology and a Certificate IV in Information Technology. That took eighteen moths of study altogether. JD: When you were helpdesk, did your employer help to pay for any certifications? KC: Not certs, but further study, definitely. Working for a university, they want you to have a university degree. So while working, I was studying part time for my Bachelor of Information Technology, which my work did pay for in a matter of speaking. If I passed each semester, they refunded me my course fees. That continued up until the time I resigned and left the university in 2012. I continued to pay for my study after that until I graduated in 2014. JD: How long have you been sysadmining? KC: My “IT Officer” role was technically a sysadmin role, just on a smaller scale. So I’ve been doing system administration for about nine or ten years now. JD: What started your interest in infosec? KC: I’m honestly not sure. I don’t think it was ever a conscious decision. It just stemmed naturally from the work I was doing within our identity space. Because of the work I was doing to look after our Active Directory, the security of it (and our servers) sort of came naturally. I started looking into it more because it interested me. And also because I really didn’t want to see a news story written about a lack of security for servers that _I_was in charge of. So there was probably a bit of pride thrown in there. JD: I have a theory about infosec people. We have to have a knack for imagining everything that can go wrong. Does that apply to you? KC: Yes. Yes. 100% yes. Maybe we’re permanent pessimists. JD: Do you think you’ve faced any hurdles being female in IT? KC: Starting out, I was often treated as the secretary. I heard things like “I’d like to speak to one of the guys” more times than I could count. I had university professors and lecturers be incredibly sexist and make very inappropriate remarks about my looks and my clothing. But I was very lucky because my manager was a woman, and she taught me not to take sh*t from anyone. I loved what I did, and my gender had nothing to do with it. JD: I still encounter sexism, but I think it is getting better. There’s a hell of a lot more we need to be doing, but that’s a whole different story. Do you think the relative lack of women in infosec is a weakness for the field? KC: Yes, because we think differently. We might say that men and women are completely equal, but there are definitely differences between us, but those differences are strengths. The fact that we’re different, that we think differently, see things from different perspectives, look at problems in a different light… we’re missing that in infosec because almost all of the leaders in the field are men. We need the differences if the field is to grow. JD: Yeah, I agree. What do you think we could do to attract more women into infosec? KC: It’s about balance, and it’s the same for all male-dominated fields. For women who are currently in the field or wanting to be in the field, it’s about flexible work arrangements, paid maternity and carer leave, and management that’s understanding. Because while it sounds so very “old school,” women are still the primary carers in families. Also, they’re the ones who have to carry around a baby for ten months and need time to recuperate after all that! JD: But I think it starts much earlier than that. I think we need to get into schools. We need to teach young girls that computers and math and science aren’t just for boys. They’re for girls. They’re fun and cool, and if that’s what they like to do, then they should do it. I’m trying to find a way to become a mentor or a spokesperson locally for young girls (I’m speaking with the women who run the Tech Girls Are Superheroes movement.) to show them that you can be a girl and be good at computers. Now that technology is so pervasive in our lives, I think it makes it more likely that we’ll see more women in IT from the generations following ours. I agree completely. I like what the Scandinavian countries do. Mandated paid time off for parents regardless of gender, for example. KC: For women already in the industry, our issue is trying to keep them here. The “death by a thousand papercuts” thing is very real. They may be small events. A guy making a sexist joke. A woman being passed over for a promotion for her less qualified male counterpart. A colleague calling her “emotional.” And these small things tip women over the edge and push them out of the industry. JD: We need to be getting people to say, “Stop, this is not cool, this is not funny, this is not on.” Because if we do that, we might actually maintain the women who we already have working in these positions. A large number of women drop out of information technology in their mid-thirties because of the “death by a thousand papercuts.” Are there areas of IT that are more welcoming to women than others? KC: I really don’t know. I’ve only got experience in the areas I’ve been in. From women I’ve spoken with, I think the non-technical side of IT seems to be. That’s probably not a good thing because it means that we’re taken more seriously when we’re not in technical roles. JD: What’s the non-technical side of IT? KC: Procurement, contract negotiation, business analysis, project management. The women I’ve seen in those positions seem to be much happier and are more equal with their colleagues and are treated better. Though that could just be rose-tinted glasses and grass-is-greener. JD: What do you think is the biggest problem in infosec right now? KC: It’s a double-edged sword. Management either caring too much about security and sticking their noses where it’s really not needed, (I hate micromanagement.) or pretending that security isn’t an issue, not giving any money to it, and blaming everyone but themselves when something happens. There doesn’t seem to be a happy middle ground for infosec in organizations, at least from what I’ve seen. JD: Yeah, the sociology of infosec is terribly overlooked. So, what would you say to a young girl who is curious about an infosec career? KC: If you enjoy it, do it! Don’t let anyone tell you that you can’t do what you want to do. Don’t take crap from anyone. I struggle to find things to say to young girls about it because they see what we do as so very uncool. JD: Fair enough. Before I go, do you have any last words about women and infosec? KC: We’re an amazing bunch of women. We need to do more to support each other rather than tear each other down. And I think you writing this piece and speaking to other women is amazing. JD: If you enjoyed my article, there are two ways that you can help me. First, you can click on the little green heart to recommend my article. Secondly, you can make a small donation to . Thank you! my Patreon

BUNCH

fees

Women in Information Security: Jess Dodson

The Software as a Service model, or SaaS, has been dramatically changing day-to-day operations for businesses for years now. In some cases, it has transformed entire industries that previously relied on clunky, outdated legacy software. SaaS has become a lucrative business model, because rather than using the old software model of buying the software and using it until the next update, SaaS offers companies software on a subscription basis. By subscribing to SaaS: Companies can get the software they need with smaller, incremental payments instead of a large initial payment, which can be cost prohibitive for smaller companies Those companies generally get updates and maintenance included, which is more cost efficient usually and gives them one less thing to worry about The developers get a steady cash flow from customers’ subscription payments rather than large chunks of money once a year. The SaaS business model is attractive. However, only businesses that can in a way that is will truly succeed in the SaaS market. deliver real solutions to business problems easy to learn and easy to integrate with other programs and processes There’s a lot more to developing enterprise software than there is to developing consumer-facing software. Beyond the price point, you have: Multiple types of users and logins to consider Demand for constant availability (online and offline) The expectation of upgrades and new features The kind of security that’s needed when managing that much data Beyond these standard user expectations, what are the 6 secrets to developing a successful SaaS platform? Validate your most important feature Enterprise clients expect a robust array of features and updates for their money. But just like any other software development, you need validation that the service is something businesses will use and pay for before you sink money into development. Identify what the core function of your SaaS is and the specific problem you are solving. Then validate whether your solution is something a business would pay for. If your most important feature cannot be validated, then you need to go back to the drawing board before you waste a lot of time and money developing the wrong service. You don’t have to reinvent the wheel It’s not uncommon for developers and designers to borrow ideas from other apps, websites and software. Good SaaS is good for a reason. Figuring out how to make your SaaS solution something users will love does not mean reinventing the wheel to develop something 100% unique. Do some research on other SaaS frameworks that have been successful or that you love using. What aspects of the software do users love? What features or UI/UX aspects make it so successful? Identifying why other solutions have been successful is the first step to developing your own solution that users will love. Then, simply try to improve on that service. Perform user interviews Spend your time in alpha and beta wisely by performing user interviews. Interviewing users is important, because it gives you their unique perspectives. You can speculate all day long on how users will interact with your software. However, the reality is you’ve been building the product from the ground up and have seen it through every step. That means you already have a base knowledge of the product and can’t possibly see it with fresh eyes. Surveys are great, but actually talking to users can give you way more insight into how real people will use your service. Interviews allow you to talk through issues or frustrations, ask questions about their experiences, and gain insight into features they wish they had. When it comes to choosing users to interview, choose wisely. Create use cases and user profiles, and interview users who fit those “ideal user” characteristics. BONUS TIP: Also choose users who have influence. Spending time with influencers and turning them into raving fans will benefit you in the long run. Onboarding is important You can test UI/UX aspects of your software all day long, but chances are a percentage of your users are going to be overwhelmed and/or confused the minute they start using your software. Software is complicated — especially enterprise software that has multiple functions, features, and customization options. Take a cue from other successful SaaS companies and take the time to onboard new clients properly. Your client is spending good money for your service, so offer them a thorough onboarding experience. Train them how to implement and use your software properly. Not taking the time to onboard could mean that users give up, cancel their service, and tell others in the industry that your software is too complicated. The risk is too high to skip the onboarding process. Look for ways to constantly educate your users It doesn’t end with onboarding. You want to keep educating your users to ensure they succeed using your software. There’s a reason why Salesforce developed , its own free learning platform. Or why for its users. It’s not just about selling software. It’s about providing a service in which customers can be a success story because they used your solution. Trailhead Hubspot offers a number of certificate programs Education can be delivered in a variety of ways: a full on platform like Trailhead, a program like , a robust help section, or an automated email system that keeps users engaged by suggesting specific features, tips and tricks. Be creative and engaging, and create a plan for user education. Hootsuite University Develop, test, and automate lead generation Getting new customers is the lifeblood of your business. Every successful SaaS company has a strong lead generation system. It’s an ongoing process that involves lots of testing to learn what converts and what doesn’t. Spend the time and money to develop and test lead generation strategies. Then work smarter by automating the processes you’ve developed. Ironically, there are lots of great SaaS systems out there that help with lead generation. Developing a SaaS solution is no easy task, but these six secrets will keep you on the right track. If you’re currently developing a SaaS platform or are still in idea phase, ! We love tackling new SaaS projects! give us a shout at RTS Labs

Flow

salesforce.com

6 Secrets to Developing a Successful SaaS Solution

”But are those eggs free-range?” What if we spent as much time examining the impact our own professional environments had on our health and well-being as we do that of the (delicious) chickens that fill our bellies? One of the pillars of the organic-foods movement is not just better treatment of animals but also in showing how the environment selected to grow and raise our food directly impacts the quality of the end product: whether plant or animal. The food in Sevilla, Spain is a perfect example of this. Every. Single. Restaurant has the best food I’ve ever tasted. From fish to chicken, from Italian to Spanish. It’s exquisite cuisine. Why? Everything is local and fresh. They don’t have the big corporate food manufacturing we have in the States. The result is that ingredients taste as they should: fresh, flavorful, pristine. Now, apply this thinking to the professional world. The corporate approach produces a corporate product: sterile, manufactured, mass-produced. The 9–5 churn. The same office space. The endless meetings. The “brainstorming” whiteboard sessions. > “Work is an activity, not a place” What would happen if professional work became free-range? Forget offices. Forget set schedules. Heck, forget time zones and locales altogether. No cages. No boundaries. Work is an activity, not a place. “The smartest people in the world don’t commute.” Well, we already know what would happen: innovation. Many startups are already doing this. And succeeding. Companies like Automattic (creators of Wordpress) and Buffer understand that the smartest people in the world don’t commute. Why? Because authentic, innovative work happens when the environment supports it rather than oppresses it. And that’s different for every company, team, and individual. The landscape changes, just like with organic farming. It’s not a one-size-fits-all method; it’s a mentality that allows the nature of the product to define the environment needed, not vice-versa. That’s why I moved to Puerto Rico (well, one of the reasons). I can’t work in an office. I don’t want to commute. My range is a coffee shop that changes throughout the day. My schedule is typically 7am — 2pm, gym from 2pm — 4pm, and then more work until I’m ready to eat dinner. My locale doesn’t matter: it’s the mindset and the work that determines where I go. Don’t settle for a caged professional life when your chicken breast dinner is free-range. I think the chicken is getting the better deal.

Zones

Making the world's first all-natural smart clothing!

The free-range professional

Rich Typescript Logger Decorators for Easy Coding

Reporting on Google’s future with today’s facts Illustration: Mandela Smith Google made almost all its money from ads. It was a booming business—until it wasn’t. Here’s how things looked right before the most spectacular crash the technology industry had ever seen. The crumbling of Google’s cornerstone Back when Google was still just an idea, its founders that “advertising funded search engines [would] be inherently biased towards the advertisers and away from the needs of the consumers.” thought They changed their minds. With that change, Google became one of the wealthiest, most powerful companies in history. Search was Google’s golden goose, as well as its only unambiguous win. So when Amazon as the top product search destination in 2017, Google’s foundations began to falter. rapidly surpassed Google Amazon was fighting Google on its home turf, and it was winning. Even worse, the people turning to Amazon over Google for their shopping searches were from the most important group for advertisers and the future: . Advertisers followed them, and Amazon began to that once went to Google search ads. Google’s mighty engine had started to sputter. young people siphon away ad dollars Google realized that it was hard to convince people who were used to getting something for free that they should now pay for it. A shift from also started to take shape in the late 2010s: When shoppers weren’t searching for things directly on Amazon, things were finding them. Advertisers realized that money previously spent on Google’s search ads was better spent either on Amazon ads or , like Instagram and Facebook. Google had no engaging content feeds, so it completely missed the wave, just like it had with and . search to discovery native ads in content feeds social media instant messaging Seeing the signs on the horizon, Google tried unsuccessfully to find revenue in areas other than advertising. Google to make money with its hardware, cloud services, and wildly ambitious “Other Bets” categories. struggled For all its efforts, the money Google earned from its nonadvertising ventures only ever accounted for a mere 15% of their revenue. And revenue from Google’s moonshot “Other Bets” a small fraction of the the company started to receive from looming regulators. didn’t even cover increasingly massive fines The war on ads In late 2015, Apple—Google’s main competitor in the mobile space— to their devices that allowed users to block ads. added a feature Devices running iOS were responsible for as much as from mobile search ads, which is probably why Google was paying Apple every year to remain the default search engine on Apple devices. By making this move, Apple was simultaneously weighing in decisively on the great ad blocking debate of the 2010s and dealing a substantial blow to the . 75% of Google’s revenue billions of dollars future of online advertising This move from Apple reflected the of ad blocking software happening at the time. Having one of the biggest technology companies on the planet standing behind consumers only emboldened the movement. unprecedented mainstream adoption of desktop and laptop users in the United States were blocking ads by the year 2018. Those users would soon block ads , too, as mobile ad block usage eclipsed desktop usage in 2017 and rose even faster. Well over a quarter on their mobile devices Source: 2017 Adblock Report/PageFair Mobile ads were one of Google’s during its final years of domination, but people started to block mobile ads en masse once they realized that ads and tracking scripts were costing them as much as in bandwidth and using up a significant portion of their . biggest areas of growth $23 per month battery life Research showed that reported a lack of trust as their reason for not clicking banner ads, and 33% found them completely . The average banner ad was clicked on by a dismal , and of those clicks, over . 54% of users intolerable 0.06% of viewers 60% were accidental Even those who weren’t blocking ads had trained themselves to ignore them entirely. Researchers dubbed this phenomenon “ .” banner blindness The people most likely to block ads were also the most valuable to advertisers: . Young users are a strong indicator for future trends, and they were of ad blocking software. Internet users had spoken, and they hated Google’s ads. millennials and high earners heavy users The ad blocking epidemic presented significant threats to Google’s business: People were getting used to using the internet without seeing ads, and Google was losing money every time their ads were blocked. In early 2017, Google made the desperate, confusing, and decision to add its own form of ad blocker to Chrome, but it did nothing except attract more antitrust regulation. It would quickly become clear to Google that even though ads were getting slightly better, ad blocking numbers would . legally questionable continue to rise Source: 2017 Adblock Report/PageFair Later, in 2019, Google for users to block ads in its then-dominant Chrome browser. All while Google was paying to let its ads through the most popular ad blocking software. tried to make it harder huge sums of money Google wasn’t willing to acknowledge the problems people had with the system they helped create, and it was clear that the company had no idea what to do when people started rejecting it. Too many people had become accustomed to a web without invasive banner ads following them around and slowing down every site they visited. Internet users had waged a war on ads, and Google was losing. An unprofitable behemoth A key platform where Google served ads was YouTube, which it bought in 2006 and quickly turned into one of its biggest entities. But even with a visiting this video-sharing behemoth every month, YouTube . sixth of the world never became profitable While attempting to coax big brands and advertisers onto the platform in the hopes of finally turning a profit, YouTube misunderstood, alienated, and downright angered the creators and communities that had turned the platform into a global phenomenon. In an attempt to combat the effect of ad blockers, Google launched an ad-free subscription model in late 2015, but the subscription numbers were , and eventually, Google realized that to convince people who were used to getting something for free that they should now pay for it. underwhelming it was hard YouTube ads were , and the video-sharing site never proved to be as effective for brand awareness advertising . Global ad spend from traditional media, but it wasn’t going to Google’s platforms. interruptive and annoying to users as Google needed it to be continued to move online The turning tides Google’s products were free, innovative, and used by billions of people. In order to get access to these free products, people had to give up their personal data and their valuable attention. Google’s ads weren’t something its users wanted—they were simply a tax for accessing the Google ecosystem. Google was enticing people into trading their privacy, data, and attention for the convenience of its amazing free products and services, some of which had no good alternatives. However, proved that the trade might not be worth it, and people started to question what they were giving up by clicking “I agree.” scandal after scandal after scandal Every word uttered to Google Assistant, every action in any of Google’s numerous apps, and every data point about every one of their billions of users was stored and analyzed in the name of more accurate advertising. And it wasn’t just Google’s users questioning the trade-off. Regulators and decision makers also to how free internet products and services made money, and the companies behind them soon faced . finally started understand a long-awaited reckoning With its golden goose getting old, ad blocking rising, public opinion shifting, regulation closing in, and all of its ambitious bets on the future failing to make money, a lot was riding on Google’s next moves. It made the wrong ones. How Google missed the chance to pivot If losing a major portion of their audience and annoying the rest wasn’t bad enough, Google also failed to get ahead of one of the biggest shifts in the internet’s history. Google’s strategy since day one could be summed up as “aggregate and advertise,” as George Gilder put it in . Every word uttered to Google Assistant, every action in any of Google’s numerous apps, and every data point about every one of their billions of users was stored and analyzed in the name of more accurate advertising. Life After Google Google’s business model was built on the foundational belief that in order to serve ads accurately, it had to collect and analyze as much data as possible from as many people as possible. This belief led the entire advertising industry to turn the web into a monstrosity of tracking and surveillance. The holy grail of accurate advertising is perfect targeting and perfect attribution: getting an ad in front of the right people, knowing exactly when and where someone saw an ad, and being able to prove where credit is due when they make a purchase. The entire industry was spinning its wheels chasing this vision, but eventually realized that its approach to the problem was completely backward. A vast, seedy, unfathomable of tracking tendrils spanning the entire web would only ever overcomplicate things, ruin the user experience, and enable a . landscape staggering amount of ad fraud True attribution and accurate targeting used to be rocket science, black magic, and nearly impossible. The breakthrough was this: If everything from interest matching to ad placement happened inside the user’s device, it would be possible to show the user ads they would actually find relevant and understand exactly which ads they interacted with and how, all without the user’s private data ever leaving the device. It turned out that ads didn’t need to broadcast a in order to be accurate, nor did they need to and cost the user their bandwidth and battery life in order to fund good content. user’s private data into the ether slow down websites Treating people as people turned out to be a winning strategy — not just for advertising or the bottom line, but for society. As Google’s revenue grew, so too did consumer awareness of how Google was profiting from our data and attention. We became increasingly unwilling to exchange privacy for convenience. We stopped clicking “I agree,” a trend that only accelerated when the company was forced by regulators to be about its business model. A perfect storm was brewing. more transparent Early signs of Google’s demise became clear toward the end of the 2010s, as its and hardly anyone even noticed as the company’s foundational principle by the creator of JavaScript (ironically, one of the very tools that had been weaponized by the dark side of online advertising). revenue growth began to slow was quietly proven false Brendan Eich while he was working at Netscape. After Internet Explorer , he co-founded Mozilla and to take down Internet Explorer with Firefox. Several years later, when Google dominated the web with Chrome, Eich created to fundamentally change . created JavaScript killed Netscape restarted the browser wars Brave the economics of the internet The companies that thrived were the ones that understood that people are not pawns in a game of corporate chess, bids in an infinite automated auction, data points in a sea of categories, or correlations in obscenely large data sets. People are people. And treating people as people turned out to be a winning strategy—not just for advertising or the bottom line, but for society. Google wasn’t forever At its peak, Google had a massive and loyal user-base across a staggering number of products, but advertising revenue was the glue that held everything together. As the numbers waned and the competitors circled, Google’s core began to buckle under the weight of its vast empire. Google had been a driving force in the technology industry ever since its disruptive entry in 1998. But in a world where people grew to resent being tracked and profiled, Google’s business model was not innovation-friendly, and it missed several opportunities to pivot, ultimately rendering its numerous grand and ambitious projects unsustainable. Innovation costs money, and Google’s main stream of revenue had started to dry up. In a few short years, Google had gone from a fun, commonplace verb to a reminder of how quickly a giant can fall. Life After Google Hacker Noon Disclaimers: The author owns a small number of Basic Attention Tokens (the utility token that makes Brave’s model possible). This article was updated on May 5, 2019. The original version as mentioned in was originally in the publication and can be found here .

Alphabet

Digiday

Discovery

Engadget

Glue

Instagram

Mashable

Mozilla

Check out my work

This Is How Google Will Collapse

So this story stems from the fact that I’ve plopped myself into the InfoSec world from App Development and from my Sec work I’ve really seen and understood that there is a need for a greater security understanding amongst devs, and the planet in general. However, it’s been a niggling problem in my head that while I love looking at vulnerabilities and designing secure systems, my network penetration skills aren’t as good as they could be. And so, when I open my Twitter feed and see a tweet from one of my InfoSec Idols, my heart skips a beat: Oh crap… my weakness… Magikarp is an expert at Layer 2. It’s in his name. The thread that follows is a list of security experts listing basic network skills that InfoSec people seem to be lacking in the industry. They’re not wrong. Many industries don’t care about lower level networking protocols Now, I’ve worked hard to try to get up to speed with many of these concepts, but if someone has the development background that I have, everything is abstracted away and you’re taught not to care because it doesn’t matter. How I used to feel about things in this article… But in the InfoSec world, it matters. A lot. What?! With humour, memes and humility, here are the top 10 things we’ll be addressing today:1. OSI Model2. Hub/Switch/Router3. Frames / Packets4. Faking MAC/IP addresses5. TCP Handshake6. IPv67. InfoSec Community10. Don’t assume base 10. 1. InfoSec talk in Ogres, I mean Onions, I mean, Layers …and it’s an instant red flag if you get it wrong… I have a Computer Science Degree. I know my OSI Model. I’ve referenced it while teaching — and cleverly used “ ” as the best way to remember “Physical/Data Link/Network/Transport/Session/Presentation/Application.” Please Do Not Teach Students Pointless Acronyms Taste the rainbow But as a developer I never referenced the OSI model. I never needed to. I’m sure this applies to plenty of other technical roles too. The more I live in the InfoSec world, the more the OSI model is used quite frequently to help describe different tools, attack vectors, and defence mechanisms. I assume EE is Electrical Engineer and not Easter Expert So here’s an less abstracted view of OSI containing the you need to know basics Don’t feel bad if you don’t know all of this, when I started I assumed SMTP was lower down just because it was older. Yes, I am an idiot Any diagram of OSI in textbooks or lecture notes is generally just a tower without context. I like this one, and would love to see an interactive version of it (or better). Why does this matter in InfoSec? Other than being a great way to classify concepts, OSI helps dictate what information you can use, the tools that are appropriate and what information can be manipulated as a hacker. Look at all those tasty tasty headers leaking useful information or waiting to be edited If you’re getting into InfoSec. Know your OSI. We’ll be covering some of the common misconceptions within many of those layers later on. 2. Hubs, switches and routers are very very different. If you’re not from a networking world, or your view of networking is setting up two wireless routers in your home — you may have used Hubs / Switch / Router as the same word. There’s a good chance that you have a box that does all three and you don’t care about the difference. InfoSec cares. Imagine this song confused switch, hub and router. Actually, it might have made more sense depending on your pronunciation of router and whether you use Australian Slang. Hubs Hubs live at Layer 1 (Physical). They literally carry electricity. Electricity goes in one port, and it traverses to other ports as electricity. If you’re on a hub network and you want to send a message to another computer: you send that message as electricity, it goes into a hub, and it sends it to connected on that hub as electricity. all everyone It’s up to that 1 computer to recognise the message is for them. Hubs are dumb. They are simple. They are basic. And it’s almost not worth mentioning how easy it is to sniff information off them, because it is literally sending everyone’s information to everyone. Switch A switch, like a hub, also carries electricity from port to port. But with one very key difference. A Switch keeps a record of MAC addresses of all the devices attached to it. Since we’re using MAC Addresses, we’re in Layer 2. Apple call it an iMac Address. (FYI: They don’t) Every computer has a MAC address. If you have ethernet, bluetooth and WiFi — you’ll have at least 3 MAC addresses. One for each network interface. You may have more if you use Thunderbolt, USB Network etc. Quantity doesn’t matter, if you are on a network, you have a MAC address and a Switch knows about it. Since the switch knows about MAC address and the MAC address of your — instead of sending electricity to every port like a hub — it will only send it to the port containing the destination MAC address. your destination If you’ve read everything so far, and not just looked at the pictures, you may be asking Why use a hub? The answer: You really shouldn’t. But… You can make a switch act like a hub And that is an important point. You can fill up the memory of a Switch (Google: CAM Table) to force it to act like a hub, you can flood, you can spoof, you can utilise/create a mirror-port to receive all traffic, you can utilise broadcast frames (FF:FF:FF:FF:FF:FF) to reach every computer on a LAN segment. Lots of ways of tricking a switch to do the wrong thing and to send data to you, including turning it into a hub. Networks can be misconfigured, outdated, too trusting and weak in so many ways. If you’re relying on tools only — you will not penetrate the same amount of networks a skilled InfoSec individual will. One day maybe… but not today. **So then… what’s a router? What makes a router a router?**Really simplistically? A router sends data to other routers. That’s it. No jokes. One router to another. 1 IP address to 1 IP address. We’re up to Layer 3. You place a router on a , the place where two or more networks connect. In the home case, your ISPs network and your network. You have a public IP address given to you by your ISP and an internal one created by your NAT. gateway NAT? What’s NAT used for? NAT (Network Address Translation) allows for a single device (at home, it’s usually your router) to act as an agent between the Internet (your 1 public IP address) and your local network (Generally 254 IP addresses, but can be very very large). This is NAT what I asked for Your home is probably on a 10.X.Y.Z, or a 192.168.X.Y network, but your public IP address will be whatever your ISP gives you ( ). http://whatismyipaddress.com If 6 people live at your house, then 6 people are coming from the same public IP address. It is the responsibility of a NAT to differentiate and manipulate packets so that they are delivered to the right person. This can get complex very quickly, but suffice to say it’s worked very well for the world so far. The original NAT. Actually.. whoever takes it out of the letterbox and distributes it would be the NAT. So when your home router says it’s actually a hub / switch / router — it really is a hub/switch/router. Your router connects your LAN (Local Area Network), WAN (Wide Area Network) and/or ISP Network. It has a Switch for communicating between devices on the same network, and if you’re super unlucky, it’s not acting like a Switch, but like a Hub and all data is being transmitted across every port and your network is super slow whenever there are more people on the network. 3. How does everything talk to each other? So far we’ve just touched on the different hardware types and where they live on the OSI stack. How do they move between stacks? How is information sent? Holy smokes Batman!! We’ve been Framed! If you are sending information from one computer to another on the same network, you are doing it via an Without getting too nerdy, an Ethernet Frame has a Source MAC address, a Destination MAC address and a Payload. “Ethernet Frame”. If you are communicating to another computer on the same network, the destination MAC address will be the other computer. Since it’s a frame sent on the same network, there’s no need for a router to send information to another router. Same reason you don’t put country on an envelope if you live in the same country I will send my payload addressed to your MAC Address. The IP address may be used to calculate if they’re on the same network, depending on the situation and there is still an IP destination since a MAC address might have multiple IP addresses, but it does not need to go to a router. That involves talking about Subnet Masks and this post is long enough as it is… How does your computer know a destination MAC Address? That is when we need ARP. ARP is MAGIK. Oh wait.. I already made that joke… ARP. Address Resolution Protocol. Matches IP addresses and corresponding MAC Addresses. Go to a terminal. Type . Windows. macOS. Linux. Don’t care. Go. arp -a sleep(20); You’ll get something that looks like this: IP Address. Mac Address. Done. Mapped. Your computer knows. Your computer is keeping records of all systems it has communicated with on the network, and since we’re on modern systems — they are very chatty so this is likely* all of them. *Likely. Not guaranteed. Unlike your computer, a switch knows of them since that’s its all main job. So, what does an Ethernet frame look like? Well sure.. if you want to be boring about it… Source. Destination. Data goes into Payload. In this case, the data is a IPv4 Packet.What an excellent time for a Segue. We love you Woz Holy smokes Batman!! We’ve been Packet..ed If you need to send data on another network then we’re working with IP addresses. Now that we’re dealing with IP addresses — we’re in Level 3. Information sent at this layer is called a “packet”. Batman cares deeply for the proper usage of frames and packets A packet consists of two things. A and a .The most common forms of packets in this layer are: header payload IPv4 Packets (most packets) IPv6 Packets (future packets. some current packets) ICMP Packets (ping) The most common misconception is that TCP and UDP packets are network level and are at the same level of ICMP. They’re not. Misconception over. Get to the Transport Layer The Header consists of a source IP and a destination IP and a bunch of other nerdy stuff. This nerdy stuff is the play thing of InfoSec professionals. This is just the header. What fun can we have with a IP Header? We can set source and destination IP addresses. We can craft packets with specific TTL (Firewalking). We can.. do all sorts of things. Packet crafting is the bread and butter for breaking through a Firewall and IDS. Sure, you can get a tool to go in for you, but it’s good to know what the tool is doing. This design of “Header & Payload” kind of keeps going up the OSI model. In the Transport Layer, there’s a TCP or UDP Header which you can craft packets for. The session you’re working with has a header. The presentation layer will have a header. The application will have a header. There could be a weakness that could be exploited at any layer, and it’ll be your job to attack / defend that weakness. 4. MAC address and IP addresses are separate, important and fake-able. Very fake-able. I think we’ve covered ‘separate’ and ‘important’ in a lot of detail, so let’s go back to why this post exists in the first place. My InfoSec Idol: MAC addresses are not arbitrary Lets talk about this directly. MAC (Media Access Control) Address is a unique* address for a network interface. Ha! Wikipedia made the same Apple joke I did. Now it “should” be unique, but experience of twitter tells me there are bugs where it may not be. But I digress. They ‘should’ be unique. So what makes a MAC Address? It’s a physical address on the hardware: Found in the form XX:XX:XX:YY:YY:YY. In Hexadecimal Or to use words… Using our MAC Address example of XX:XX:XX:YY:YY:YY. The XX:XX:XX is the OUI (Organisationally Unique Identifier), so Hewlett Packard have (as well as a few others), so if you see a MAC Address :12:34:56, there’s a good chance it’s from a HP. 3C:D9:2B 3C:D9:2B Can these be faked? By gosh, they can. If I’m trying to get onto your network, I will try to be you. I will try to spoof your MAC address and have the switch confuse you for me. If a DHCP server is using MAC addresses to help distribute IPs, I will use be your MAC address to get an IP address. If I’m operating at Layer 2, I’m operating with MAC addresses. If I’m operating at Layer 3, I’m operating with IP address. Can IP addresses be faked? By gosh, they can! We can craft packets, therefore we can craft IP addresses. We can trick switches, routers and servers, we can map ourselves to IP. There are many ways and reasons for this. There’s more to be said here, but I will leave you with this tweet and move on 5. Three-way handshake? Sorry, I’m married. Wait, you’re still here? Congratulations! We’re at TCP/IP. This is part of the Transport layer (Layer 4). Most important thing here. Repeat after me. SYN. SYN-ACK. ACK. No no. She responds with SYN-ACK. You respond with ACK. And then you have a conversation involving SYNs and ACKs. Or Acts of Sin depending where this conversation is being held. Maybe you should just FIN because she wants to RST. You initiate a TCP connection with a server via a or . This handshake allows for sequence numbers and acknowledgement numbers to be exchanged. That way, if a packet is dropped or appears out of order, it can be resent safely. three-way handshake TCP handshake Here is that exchange in picture form x and y start off random, tools will show they start at 0, but this is a lie. As data is sent, sequence & acknowledgement numbers increase until a FIN is sent. If sending is going well, the window size can increase. If something goes wrong, a RST is sent (or received upon trying a closed connection) cancelling a connection and a brand new connection will need to be established. This is how TCP stays accurate. From a good tutorial found here: http://packetlife.net/blog/2010/jun/7/understanding-tcp-sequence-acknowledgment-numbers/ Notice that both sides FIN and ACK the FIN Why is this important? Because we can craft these packets and be malicious with them. (I feel like I could make this article “All Layers can be Crafted and Malicious” and BAM, whole article done). We can do SYN flooding, we can detect using FIN, scan with XMAS scanning — there are lots of things that stem from this. However, knowing how TCP connects and operates is very important in InfoSec. Maybe they cover it in the last week of term as they finally allow students to use the internet? Edit: Did this topic wet your appetite for more? I heavily recommend the post below by Gary Bernhardt (Twitter garybernhardt) “Network Protocols for anyone who knows a programming language” _The network stack does several seemingly-impossible things. It does reliable transmission over our unreliable networks…_www.destroyallsoftware.com Network Protocols - Programmer's Compendium 6. IPv6? No one uses it, why should I know it? Because something might be weak to it. People who setup networks may ignore / misconfigure IPv6 and may not be watching IPv6 because they’re too busy watching IPv4. History may repeat itself with IPv6. Knowing fundamentals is a great way to help avoid this There are tools for helping people penetrate, fingerprint and craft packets with IPv6 and ICMP6. There are defence mechanisms in routers, firewalls and IPS/IDS. So yes, you gotta learn IPv6 networking. Even if you think it’s only 1% of servers that support it, or that you don’t think anyone uses it. They do. And you need to prepare your attack / defence to use it. 7. Stay engaged with the InfoSec community This one could not be any more true. While the fundamentals have existed for a long time, there are new exploits, vulnerabilities and things to learn every day (or at least it seems like it) and Twitter and RSS helps me do it. Twitter is such an excellent platform for the InfoSec community and I heavily recommend you follow top people in the field you care about. I believe Dan put it in better words: People ask me quite reguarly how I do this, so in the link below is a list of all RSS feeds (shared through feedly so you can easily subscribe to those resources) and my top twitter infosec people (that you can easily subscribe to): _As a super enthusiastic security person, I get this question… a lot. 😅_medium.com You ‘do’ InfoSec right? What do you read? Who do you listen to? 10. Did you get my joke? I said 10 things, but that’s 10 in base 8! What a great way to be lazy :) And that’s it. My joke regarding not having two additional points completes our journey. But seriously, you should be comfortable with Base 2, Base 8, Base 10 and Base 16 If you’ve made it to the end, I hope you’ve enjoyed a brief knowledge transfer of important networking concepts. If you are one of the people I tweeted — thank you for being part of the twitter community I love to read with. There were a few other tweets that caught my eye in terms of things that people should know. Other than that — peace out Actually, it’s probably because we’re doomed to repeat the mistakes of history. Just on new platforms. Hello IoT!! FIN. ACK.

Stacks

I share cool things on twitter

10 things InfoSec professionals need to know about networking

10 things InfoSec Professionals Need to Know About Networking

HackerNoon Tech Stories Archive April 14th, 2017

@tomparkTom Park

@seyi_fabSeyi Fabode

@micseibelMicki Seibel

@david.gilbertsonDavid Gilbertson

@stevemoffattSteve Moffatt

@MLJARofficialPiotr Płoński (MLJAR)

@Bo0merIvan Borshukov

@thinkmobilesThinkMobiles.com

@did_78238Dmitry Davydov

@babulousbabulous

@beautyon_Beautyon

@designforsustainabilityDaniel Christian Wahl

@kim_crawleyKim Crawley

@rtslabsRTS Labs

@senorcodecatCory Decker

@dormosheDor Moshe

@dacojaDaniel Colin James

@dacojaDaniel Colin James

@proxyblueLouis Cremen

@proxyblueLouis Cremen

@tompark
Tom Park

@seyi_fab
Seyi Fabode

@micseibel
Micki Seibel

@david.gilbertson
David Gilbertson

@stevemoffatt
Steve Moffatt

@MLJARofficial
Piotr Płoński (MLJAR)

@Bo0mer
Ivan Borshukov

@thinkmobiles
ThinkMobiles.com

@did_78238
Dmitry Davydov

@babulous
babulous

@beautyon_
Beautyon

@designforsustainability
Daniel Christian Wahl

@kim_crawley
Kim Crawley

@rtslabs
RTS Labs

@senorcodecat
Cory Decker

@dormoshe
Dor Moshe

@dacoja
Daniel Colin James

@dacoja
Daniel Colin James

@proxyblue
Louis Cremen

@proxyblue
Louis Cremen