As SEC breaks the silence about its outlook on Initial Coin Offerings (token sales), understanding of a token role in blockchain projects is more relevant than ever. Not all tokens are born equal. Tokens backed by are different from tokens issued by a or tokens . The ability of tokens to be a tool for non-dilutive fundraising is making the headlines. Attract millions of dollars without giving away any equity with a 30 page text document and a few lines of code — who does not want that? However, it is the token’s functional (utility) role in a project’s ecosystem that largely determines the viability of that project as a decentralized distributed entity. chicken and geese VC fund investing in blockchain startups compensating participants for a network maintenance This dual role (fundraising and utility) of a token causes a weird twist in relationships between the token holders. As described it well , the “investors” in tokens wish for the token price to go up, while the network users wish for it to stay stable. The former simply want to get some capital gains, while the latter need a token to transact on the platform. They would prefer it to cost the same today as it did yesterday. Marcin Rudolf in his article Entangled nature of token economics may lead to contradicting interests of token holders Now the utility function of a token can take two different faces. Some tokens are A token holder would use them in a specific transaction (think of it as a movie ticket) or over the course of time (like a gym membership fee). Other tokens are like an . Simply holding a token entitles a holder to certain rights. It may or may not require depositing, or locking in, of a token. In the latter case, the amount of token you lock in would determine the amount of rights you will get an access to. And when you are done, you get your tokens back. spendable . access card As mentioned before, tokens incentivize the participants of the project’s ecosystem to transact so that the ecosystem evolves and does not need a centralized authority. In order for the tokens to do that, they need to power the processes integral to what a platform does. In his article , laid out the roles, purposes and functions of tokens in blockchain projects. Tokenomics — A Business Guide to Token Usage, Utility and Value William Mougayar These functions generally fall within three incentive groups, important to a blockchain project: 1) incentives to enter the platform ( ); 2) incentives to use the platform ( ); 3) incentives to stay long-term ( ). Enter Stay and Play Captivate As an incentive to the platform, tokens may grant the right to access a product or a network, to attain a specific role, or to get in a position to benefit from token trading. Enter Incentives to on the platform may include various fees for transacting with other users or with the platform itself. Stay and Play Incentives that users for a long-term may involve giving users the rights to influence the platform’s evolution, to earn a valuable status, or to benefit from the distribution of the value created by the platform. Captivate Variety of token rights are based on the type of incentive they provide in a blockchain project Tokens usually carry a combination of rights. But for them to be relevant in the first place, these tokens need to be in hands of users who will actually utilize these rights. As the results of many ICOs showed, however, a big portion of tokens ends up in hands of large purchasers, mainly interested in capital gains. Moreover, for an organization to truly live up to the decentralized nature, it needs not thousands or even hundreds of thousands of token holders, but millions. No token sale has yet achieved that (feel free to correct if you know of one!). Can the secondary market be a good mechanism to provide a true distribution of tokens among a sufficient number of users that would lead to the network effect? This is a whole different story. But for now, the points to remember: Though fascinating as a new fundraising instrument, tokens need to carry utility rights integral to the platform they power, first and foremost. Duality of the token role (fundraising and utility) may lead to misalignment of interests of token holders. In their utility role, tokens can be spendable in transactions or over time or represent entitlement to rights from a simple fact of holding a token. In general, as an incentive mechanism, token need to compel a user to enter the platform, to use the platform, and to stay there long-term. Despite the variety of token rights, to be relevant, tokens need to be in hands of people who are interested in such rights. And finally, the number of live projects powered by tokens is still small (does anyone know of a good source for the stat, aside from here: ?). For better or worse, the reality often plays itself out differently than the theory. What happens when things get real, we are yet to see! https://dapps.ethercasts.com/ Storifier team, Oxana & Lena Follow this blog for more blockchain project overviews, analyses, and observations. We explain complex blockchain stuff in simple language.

fees

What are you token about? Blockchain token economics and rights.

A couple years ago, a young boy who just had entered his teen years took on the challenge of taking a course on HTML & CSS. Little did he know that his passion for , sparked with the first sight of an iPod Touch at age 8, would be ever-present in his life to this day. codeacademy technology That naive 13 year old was me. And, I can say with confidence that although I have matured in my skills, I am still . In fact, we all are learning. learning That’s why I created — A place for us to contribute our knowledge in the form of projects. Whether you’re a beginner or an expert, both sides of the table benefit with the beginner educating themselves and the expert sharing what truly is priceless, knowledge. Enlight Enlight is a little side project of mine which is intended to be a hub for all projects development related. Built a cool image classifier in Python? Or a sick iOS game? Awesome! Write a tutorial and share it with the world :) This site isn’t supposed to be a course. It is supposed to be a compilation of tutorials to guide you to making real apps. Sure, you can know every single object or function property, but can you use them? Enlight tutorials reference the topic while implementing it in the project itself, so that you understand every part of the process. Knowledge is of no value unless it is put into practice — Anton Chekhov With this being said, I urge you to check out and give it a try! And if you’ve built something that you think we can all benefit from, feel free to submit a and have it featured on the site. Enlight pull request Happy coding!

Introducing Enlight: Open-source programming tutorials

A big thanks to engineering specifically and for letting me share this code and all of their help and support while building the user tutorial feature on our . Dexter Daniel Ilkovich David Hu site While React has ways to break the hatch and directly manipulate the DOM there are very few reasons to do this. We shouldn’t directly manipulate the DOM unless we have a really good reason to. When we need to we should use the property. Only as a last resort should we manipulate the DOM directly as well as change state during a render. ref The Problem The grid snaps at 1024px from a fixed to a fluid grid. We wanted our tutorial tips to be 20px away from their parent element and there wasn’t a way to do this with just css. If the tip was positioned correctly in the fixed grid it would be off when the grid snapped to a fluid view. The tutorial metadata is applied directly in inline styles of the component which has the highest css specificity. This meant that media queries couldn’t solve this problem because media queries would be overridden by css with higher specificity. The Solution The solution needed to be a single set of metadata and a component that knew where it was so it could change its positioning on the fly. Here’s a video of the final component styles changing. and the component moving with the viewport resize. Element.getClientRects() First things first, we need to know where the parent element is on the page before we can do anything with it. The does just that. If you query an element on the DOM and call it’ll return an object of values with the position, height and width of that element in relation to the viewport of the browser. Give it a try on your end. .getClientRects() method .getClientRects() querying an element on NYTimes.com Using a Stateful Component to store positioning We need the component to know where it is at all times. Thinking about that requirement we need a component that can hold its own state, not a stateless functional component. This is because the user can shrink or expand their viewport past or less than the 1024px threshold which changes our grid to fluid or fixed position. The component needs to be aware of viewport size so it can hold on to its dynamically generated positioning any time the screen size changes. class Getters and Setters The component has two core functions around dynamic positioning. Setting styles dynamically in relation to where the parent element is on the screen and getting those set styles to render the position of the tip. We’ve named these function methods and . getStyles setStyles In this particular use cases we load in JSON data for each tutorial tip and accordingly for each tip positioning type. This isn’t a requirement for a self positioning component itself. Just information for the tutorial. Examples are instruction text and offset positioning so the tip is 20px away from it’s parent element and centered. tutorialMeta setState Note: Now, it’s time to take this functionality and hook it into React’s lifecycle methods so the component know’s when to update its own positioning. Connecting to React’s Life Cycle Methods Let’s hook up our getters and setters so our component knows when to fire them and update its props and state. Initialization and Destruction: On component load we need to since we currently don’t have any styles to get! Remember, the component is going to call which is going to dynamically set positioning values. Additionally, we don’t want to query the DOM every time we resize the viewport. setStyles .getClientRect() We check if our props or state has changed. 's default is to return true if any state changed per React’s . Since we’re also getting data from our container component as props we also need to check for props updates. There is global dispatch and data for the entire tutorial like and this isn’t a requirement for every use case, just the one that we we’re solving for. shouldComponentUpdate docs Note: nextStep currentStep Next up is fired before a mounted component receives new props ( ). Using rather than blows away state and sets the component to not show. This is also for a very specific and deliberate for our use case, the flickering problem. componentWillRecieveProps docs replaceState setState There was a flickering problem The dreaded flicker! It was ever so subtle, but it made our team twitch. There was a flash on initial load and when transitioning the tutorial tip it would hangout just one render step before where it was supposed to be. That’s where the position came in. If there’s no positioning to give our component just make sure it’s off the page entirely. The Flash Flicker: -9999 Every time we get new props the component sets our display to false removing the component from the DOM entirely during transitions. If you look in , and you’ll see reference to how the component is removed and added with set to false or true. The Hanging Flicker: componentWillRecieveProps setStyles getStyles display The Render This is the function that’s going to get our dynamically generated styles which is called in the styles . is our own custom function that’ll create a string which we can add to a component class styles. We’re not going to dig into this function because it’s out of scope of the post. But, if you’re interested please leave a comment on the bottom of the post and I’ll try and answer your questions. props Note: _.getClassNameFromObject Here’s a diagram of our component lifecycle, getters, setters and render methods. The Entire Component But wait there’s more! We also came up with an interesting solution to avoid adding components all over our application. This is useful if you need to add a series of components to your application like a tutorial. In we query the DOM for a specific step rather than include the component multiple times. The container component renders the component once, then on each step change we look for a different step class to render the tutorial component. setStyles That’s all folks Hopefully this helps anyone how might need this type of dynamic positioning functionality in their React application.

Facebook

Mozilla

Self Positioning React Components

Do you ever think — “How to explain to the one, who never faced it before”. programming Original articles was created long time ago, in another galaxy. This is a just a translation trial, and it did not contain as much jokes, as it can. So, lets imagine — you have a friend, who is not by computer science, never try to automate something, never play , never write a single line of code. soiled factorio So, lets imagine a normal human being. And lets call him Bill. He is not very good in Math, even just “not good”, ! but he loves candies Your task is to Bill some IT , you do every day. The simplest ones. Encipher the secret knowledge. teach magic things What shall you do? Feed him! Long story short, but one day asking Bill: Andrey Alexandrescu — Andrey: Hi Bill, do you want a candy? — Bill: Yep, sure! Then Bill will get the candy, unwrap it from Candy and eat the . wrapper payload Simple? And we have used 2 magic words! — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — Just few day later asking Bill: Wirth — Wirth: Hi Bill, do you want a candy? — Bill: Yep! SURE! — Wirth: Hey, I`v got another one, do you want it do? — Bill: Yep! SURE! It was a , or a condition-controlled loop cycle. — Wirth: Hey, I`v got another one, do you want it do? — Bill: Yep! SURE! But there was no candy, and Bill got a common . null pointer exception — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — Beware — if will suddenly returns and continues to feed Bill with candies — a will occur. At long Bill will always accept a new candy. Alexandrescu buffer overflow Buffer overflow — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — Next day Wirth was prepared. He has got a big bag of candies. — Wirth: Ok, let me check bag of mine…. — Wirth: I still have a candy. Bill, do you want a candy? — Bill: Yep! SURE! In this case Wirth will provide a candy only if he has one. Here we hot a . cycle with precondition — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — But one day Bill come to Wirth`s house, and house: — Bill: GIVE ME A CANDY! — Wirth: Nothing lasts forever! You have eaten everything! — Bill: But I will take it IN ANY CASE!!! — Bill: DO YOU HAVE A CANDY??? It was a . Sad story. Thanks god police were nearby. Be careful next time, and do not feed wild birds. cycle with postcondition — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — Decades later Dan Abramov come to Bill and put all his candies on the table: — Dan: speechless gazing at Bill. — Bill: speechless gazing at a first candy — Dan: Bill, do you want one on these candies? — Bill: Yes, sure. It was a . collection-controlled loop — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — Just after it, Dan got another bag, put all candies on the table, count them, and put back to the bag. — Dan: Bill, look like I still have a candy. Do you want a candy? — Bill: Yes, sure. It was a . count-controlled loop — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — Sooner or later, but come to feed Bill. Bjarne_Stroustrup — Bjarne: Bill, do you have a candy. — Bill: Yep, sure. — Bjarne: Bill, do you want a candy. — Bill: — — — Bill was munching a candy. He was busy and nothing can disturb him. He raise a , thread got locked and time stops… mutex Thread lock. — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — Bjarne was a very clever one, and he found a solution: — Bjarne: Bill, do you want a candy. — Bill: — — — — Bjarne: Ok, I`ll wait until for finish munching… Here we got a . thread synchronization — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — Ok, this time we will call for . Peter_Norton — Peter: Bill, do you want a candy. — Bill: Yep! Sure! — Peter: I`ll provide a whole pack. Munch it by youself. Next Bill will get candies, one by one, from a bag, and eat them, one by one. This is called — last it, last out. As long the candy from the bottom of the pack will be eaten last. LIFO In the same time Bill`s digestion is a — first in, first out. FIFO You had to know it before. — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — also joined the feeding team. But one day he got tired of buying new candies for Bill and he asks a catering company to do it. Donald_Knuth — Donald: Hey, my friend, can you buy best candies in the nearest shop and present them to Bill? Here is Bill`s address and money… Since that time Bill always has new candies from Donald. In this case catering company is a , and address and money are . And a candy is a . function arguments return value If for the same address and the same amount of money Bill will always get the same candies — it will be called . pure function But only in case the company will only transfer candies from point A to point B, and shop will always be non-pure function, as long it loses candies. But was even clever! Dennis_Ritchie — Dennis: Hi Bill, do you want a candy? — Bill: You know it! — Dennis: So here is an address. You will found your so desired candy there. It was a . pointer But, then Bill reaches that address he found there a military object. Any way — he got an address, and tries to reach his target at all costs, but security is security. . Access violation A few months later, after escaping from a jail, he tried to repeat, but yet again cant reach “the target”. Something stopping him at the distance — invisible, and indestructible walls of . bounds checking — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — But one day…. Even, to say the truth — night — comes to Bill`s house and shout: Cyberdemon :DO YOU WANT A CANDY? — Cyberdemon — Bill: YES! AT THE DAY TIME, AND THEN THE STARS SHINE! ALWAYS! So, Bill has got his candies yet again. But this is a bit sad story, as long he forget to check type of payload or perform any other . ☠️ data validation — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — After that Bill woke up in a void, and hear: — Cosmos: Bill! Do you want a candy? — Bill: Yes! — Cosmos: Bill! Do you want a candy? — Bill: Yes! — Cosmos: Bill! Do you want a candy? — Bill: Yes! This how works. ping In the disturbed systems with non-zero this might look so: latency — Cosmos: Bill! Do you want a candy? — Cosmos: Bill! Do you want a candy? — Cosmos: Bill! Do you want a candy? — Bill: Yes! — Bill: Yes! — Bill: Yes! But this case valid only for TCP/ . In case of TCP/ it might change UDP IP — Cosmos: Bill! Do you want a candy? Bill! Do you want a candy? — Cosmos: Bill! Do you want a candy? — Bill: Yes! Yes! Yes! As long sibling packets will be joined by time or size factor( ). MTU The End I have a lot of untold stories, like a Bill and , or candy. Gang-of-Four non-crossbrowser But let me told the last one, about The Indivisible Candy: Bill eats it hundreds of times, but it zap back to his hand, unmunched and even still sweet! So Indivisible candy may be a or a as long garbage collector cant digest it. singleton memory leak, Have a good time, Bill. Original article “The Val`s Candies” was released 7 years ago, and since that time it got a lot of new examples as user comments — recursion, delegation, interfaces, stack overflow, procedures vs functions, classes, B-trees, and so on. So, From abstract computer world using a candy, a cake or something else…. can you describe something from IT? Bill is still very hungry, he is starving. You have to feed him.

Cosmos

Target

The Cake is a Lie!

I am extremely excited to announce that my course “Mastering for ” is now available on Udemy. This course covers everything you need to know about building amazing ARKit applications. ARKit iOS Check out the course promo below: I am sure you are as excited about ARKit as I am. Don’t wait a moment and use the link below to enroll in “Mastering ARKit for iOS” course. _Build Amazing Augmented Reality Apps for iOS_www.udemy.com Mastering ARKit for iOS - Udemy I am also writing a book called “ ”. Each week I release one chapter of the book. . ARKit for iOS Developers Get the book

Mastering ARKit for iOS

Update 18 August 2017 We have a lot more effects available on Facebook now. Take a look here: http://www.maskup.me/fbeffects.html Ever since , we have been eagerly waiting to create Augmented Reality Selfie Effects on Facebook’s Camera platform. So, a couple of weeks back, we got the invite to the Beta program and we have had the chance to create Selfie experiences using AR Studio. Facebook announced AR Studio We have created two camera effects, Mighty Tiger and Turban Mania, using Facebook’s AR Studio (Beta), and we are working on a lot more. Here’s how you can get them: Like our page https://www.facebook.com/maskupme Open FB Camera (Tap the camera icon at the top left on your FB feed) Tap on the Mask icon on the bottom navigation bar, and our two masks, Mighty Tiger and Turban Mania, should show up for you there. Needless to say, the AR Studio platform is incredibly powerful, and we have just started working with it. We will be constantly developing new effects that use many of the features available on AR Studio. Mighty Tiger Mighty Tiger Icon This effect is an experiential single person effect that is a tribute to India’s national animal, Tiger. The effect starts off with a spectacled, loveable, yet realistic version of the Tiger, and on opening your mouth, we reveal a luminescent, slightly scary version of the Tiger (with an amazing smoke effect from the Tiger’s mouth). Try it! Turban Mania Turban Mania Icon Social, fun, dance, music! This effect has all these ingredients to make it fun to get some cool selfies with friends. We support up to 4 faces, each face getting a different Turban. To go with the effect, we have an upbeat Bhangra beat ( ). This is bound to be fun and entertaining! https://en.wikipedia.org/wiki/Bhangra_(music) Like our Facebook page https://www.facebook.com/maskupme MaskUp: http://www.maskup.me

Launching MaskUp on Facebook’s Camera using AR Studio (Beta)

Adobe just announced the end-of-life plans for Flash. For many of us it is a day that brings with it a sense of nostalgia, yearning and loss. To many people late to the web, and a new, younger generation of creators it means very little — possibly a “good riddance”. But, to the web’s first generation of trailblazers it’s an important, possibly sad, day. It is, for me, anyways. Flash changed the Internet. I’d dare say it set the tone for what it could and should be. Before Flash there was next to nothing you could inherently do, ubiquitously, on the web. Sure there was some bastard child version of Javascript, Shockwave and emerging attempts with Dynamic HTML — but until Flash the web was a very still place — and for me especially — rather quiet. Most of what people take for granted as experiences and interfaces on the web today were born through Flash. Developed by a generation of young, curious, creative, inspired people. Artists, film-makers, musicians and poets. Many, if not most, non-coders. A tool was made available and there was a global platform to express ourselves. We took advantage of that and carved our ideas into the digital zeitgeist. From bouncing gradient balls (aka Matinee and Gabocorp) to full fledged rich applications — with a side of Strong Bad — Flash was our paintbrush and the web our canvas. Flash was the future. It allowed me to create the Internet’s first website with a drag-n-drop interface. Create , the web’s first virtual music studio Track on his solo-expedition to the North Pole via an iPaq and satellite phone. Accept a Flashforward award remotely via video before there was Skype. Make music controllers from remote control cars. Play with computer vision, physical computing, real time collaboration, accelerometers, data visualization, Internet of things, voice navigation and so much more well before it was common place. Looplabs ( Ironically, Steve Jobs, who played a key role in killing Flash used Looplabs during his keynote when launching Safari to show how powerful it was ). Ben Saunders Flash was our interactive swiss-army knife. For me, like many others, Flash provided a platform to explore new interactive concepts, explorations, experiments and prototypes of the future. We were an open community. We shared our ideas. Our code. Non-stop. When I think of all the people I met simply because of Flash and where they are now — and what they are doing — it puts a smile on my face. Remember RunDMC at Flashforward NYC? Parliament Funkadelic in SanFran? OFFF? NMUF? Osmosis? The spirit of punk and DIY and the Unconference concept itself were part of the DNA of the Flash Community. Flash was responsible for me becoming an author, traveling the world speaking and sharing ideas and helping to build and shape community through events like Flux and Osmosis and establishing FITC as Canada’s design and technology voice. I’ve seen the world. Met incredible people and touched millions of people, from across the world, through a plug-in. I owe a lot to Flash. Gonna miss you buddy. P.S. Would love to capture thoughts in the comments and keep a conversation going. Hit the heart, share with a Flash nerd and s hare how Flash changed your life below.

Adobe

YouTube

Flash was the future.

After upgrading to 4, I discovered that my old Varnish 3 top and log commands no longer worked and found it difficult to find a list of Varnish 4 top and examples. Varnish log Below are some Varnish 4 top and log commands that I use often and have found useful. View the top requested backend URLs sudo varnishtop -i BereqURL View the top IP addresses sudo varnishtop -i ReqStart View the top X-Forwarded-For IP addresses sudo varnishtop -C -I ReqHeader:X-Forwarded-For View the top User Agents sudo varnishtop -C -I ReqHeader:User-Agent View requests for a particular host varnishlog -q “BereqHeader ~ ‘^Host: example.com’” View requests for a specific URL varnishlog -q “ReqURL ~ ‘/my/path/’”

Handy Varnish 4 top and log commands

Everything you wanted to understand about potential August 1 fork but were afraid to ask. T about what will happen on August 1. Will the cryptocurrency split into two new ones? Will it not? What is BIP 91? What is BIP 148? What is SegWit? here’s a lot of fuss in the bitcoin community The incredibly significant date is just around the corner but there are still so many unanswered questions! By the way, I am curator of a weekly newsletter, , which delivers one idea from the future to your inboxes. Unmade I have put together this guide to walk you through the whole situation to keep you informed about the developments. As of this writing, it seems like, bitcoin will avoid the chain split — . However, even though it seems like the opposing parties have reached a joint conclusion, there’s still a lot that needs to happen to avert the split. for now To understand what’s actually happening and why the bitcoin community has split into two, it’s best to take a look at one of the fundamental issues of cryptocurrency — or to be more exact — how people disagree about how to fix that issue. On one side, there are the people who manage the open sourced software for bitcoin. They are like the organisation/community that keeps the development on the bitcoin protocol running. On the other side are the miners, who deploy computers to run the bitcoin network (blockchain). Both sides are crucial to keep the bitcoin running — one side can’t do it without the other. And to fully understand the issue, you need to understand the mechanics of bitcoin, and that’s why I’ve tried to explain the complete deal with bitcoin chain split in this guide. What is the problem with bitcoin? “Death is the solution to all problems. No man — no problem.” — Joseph Stalin that you can use to buy and sell things online. That’s technically correct, but that’s not bitcoin’s real value. Most people think of bitcoin as a digital currency Bitcoins aren’t really feasible for everyday transactions, and we’re nowhere near being able to walk into a Starbucks and pay for our coffee in bitcoins. But why is that? Wouldn’t make sense for the makers of bitcoin to implement it as an real alternative to other currency, and thereby increase the value of bitcoin? Well, the reason that hasn’t happened is that the bitcoin blockchain is slow and expensive. It’s nowhere close to meeting the standards for payment technology as the bitcoin network can process up to six transactions per second, while the VISA network can process over 1600 transactions per second. The only way the general public will adopt to the decentralized network is if it will be as fast and convenient as existing payment networks. Unless that happens, bitcoin will be used mostly as an instrument to store value. Why is the network so slow? “The horse I bet on was so slow, the jockey kept a diary of the trip.” — Henny Youngman of a blockchain. If you haven’t yet read the , think of blockchain as a register containing several pages (blocks) where each page contains several transactions. As soon as a page has been filled with transactions, it needs to be added to the register before starting to record transactions on the next page. Bitcoin’s network is built on top ultimate guide to understanding blockchain Before a page (block) can be added to the register (chain), there’s some processing that needs to be done to ensure that everyone agrees with the contents it contains. The process approximately takes 10 minutes for each block. Imagine, you are sending 1 BTC to your friend, Joe. The transaction will look something like this. information about the sender, the recipient, the amount and the transaction fee. Among other things, a transaction contains Wait a minute, transaction fee? Yes, there’s an additional fee that you can pay to incentivize miners to include your transaction in a block as soon as possible. There’s no set price and it’s entirely up to you how much you are willing to pay to speed up the process. At any given moment, there are several transactions available to be recorded on the current page. If you look for number of unconfirmed (pending) transactions any time through the day, the number will always be . That’s when the 99 percent of the world is yet to come to cryptocurrencies. The number then can easily be north of several millions. close to ten thousand The miners (computers working in the blockchain network) have to decide which of the available transactions to include in the current block. To help them decide, they look at which transactions yield the most rewards — meaning that the transactions with the highest transaction fee will be included first. If there are enough transactions with higher transaction fee than yours to fill up the block, your transaction will have to wait in queue. The wait can last from a few minutes to a few hours. And sometimes, even days. The more you pay in transaction fee, the quicker your transaction is processed. slow and expensive. Not exactly what the ‘money of the internet’ should be like. For the users, using Bitcoin has become However, this has prompted smart people to ask an important question: “How can we scale the capacity of the bitcoin blockchain?” The funny thing is that there were too many smart people asking that question. The people who are running Bitcoin (the people who are maintaining the open sourced code that runs on people’s computers) believe in one solution, while the miners (the people who run the code on their own computers) believe in another. The solution proposed by the people running Bitcoin favors the users, while the solution proposed by the miners favors themselves (what a surprise!). It’s this disagreement that’s led to the confusion around August 1 and the potential split of the Bitcoin blockchain. We’ll come back on this topic later in the post; let’s understand the solutions first. The solution that favors the users “When money is seen as a solution for every problem, money itself becomes the problem.” — Richard J. Needham with originated in how we store a transaction in a block. The solution was originally to remove the malleability of blocks, but it had a positive side effect: it increased the capacity of the blockchain too. To understand it better, we’ll need to understand how blocks look like. What the people running Bitcoin came up The solution is known by several names on the internet, such as SegWit, BIP 148 and UASF (User Activated Soft Fork). What does a block look like? In the most simple view, a block in the chain has two kinds of data in it — header and transactions. Header contains meta data of the block, but that’s not relevant to the August 1 fork. The header is tiny and only takes up about a percent of the block’s data. The other 99 percent of the block’s data is made up of transactions that are included in the block. A block on bitcoin blockchain If we dig deeper to see what makes up a single transaction, we’ll find that besides the obvious things — like sender, recipients, amount and transaction fee — it also contains something called a ‘Signature’ or ‘Witness’. The Signature verifies that the sender has enough balance to send the said amount of bitcoins in the transactions. This particular data is only used once at the beginning, but it makes up almost 65 percent of the data in a transaction. The total allowed size of a block is 1MB, and most of it is filled with data that isn’t critical to the block. The idea is to move the Signature/Witness data towards the end of the block in a separate structure. This separate structure isn’t required to be included in the blockchain. If a node (individual participating computer in the network) can, it’s great. If it cannot, no big deal. Because of this property, it is called a Soft Fork. Some nodes will update their software and begin working on the new block structure, while the nodes that decide to stay on the legacy software will simply ignore the Witness portion. This optimization in the structure allows more transactions to be included in a block. This solution is technically called SegWit because of Segregating (separating) Witness from the block structure. And it favors the users. How does SegWit favor the users? The new structure can hold a lot more transactions than the current structure can. It causes the competition among unconfirmed transactions to be included in the block goes down. And with it, the transaction fee goes down. Transaction fees are a part of the reward that the miners get. With lower fee, the reward for mining the block will go down too. Not just that, this new structure also something that is called Lightning Network that allows micro payments (you paying for coffee at Starbucks) to be processed instantaneously without any fee. The leading argument against this solution is that it’s a temporary fix and that a ‘Hard Fork’ will eventually be implemented down the road. And the Hard Fork is the miners’ proposition. The solution that favors the miners “The government solution to a problem is usually as bad as the problem.” — Milton Friedman will scale the network for a longer term. Their proposition is to implement SegWit (Soft Fork) like the users propose, and in addition to that, they also want to increase the size of the block from current 1MB to 2MB. Thus, the name — SegWit 2x. The miners propose a solution that Besides being known as SegWit 2x, the miners’ solution is also called MASF (Miner Activated Soft Fork) and BIP 91. At first glance, this solution looks way better. I can almost hear you shouting, “The network will be even faster. Yay!” However, the devil lies in the details. If this solution is implemented, every miner in the network will have to upgrade their hardware and software. There is no concept of backward compatibility included in this solution. Those who won’t upgrade will be orphaned by the network. That’s why it is called a Hard Fork. Let’s take a closer look. Imagine there are ten miners in the network, and that six of them decide to upgrade to larger sized blocks. These six will continue working on making the longest chain even longer, but their mined blocks will be discarded by the rest four who still consider old block size to be true. How does SegWit 2x favor miners? What do miners like? Higher rewards. What do miners like even more? Less competition. Due to the fact that not everyone will have enough money to upgrade their computation power to mine larger blocks profitably, smaller miners will vanish away from the network. This will leave larger and fewer miners in the network — which dramatically reduces the competition. When Satoshi Nakamoto the glorious idea of building a decentralized future, he didn’t mean it just in theory, but he meant it in practice. Putting power in the hands of few large miners goes against the foundational idea of bitcoin’s existence. presented If you’d ask miners they’d probably say something like “We are running the network. We must have a say how we want to run it. If we shut our computers and go away, there’ll be no bitcoin.” And if they did, they’d be right. But they’re also wrong. there’ll be no bitcoin if they go away, yet they’re wrong because when they say only they are running the network, they’re saying it with the same intentions as that of people running regular banks and governments. They are right when they say Blockchain is not just a software protocol that allows financial transactions. It is the protocol that changes the fundamental beliefs of our species. With this protocol, there is no place for the sense of ownership. Everybody owns the network and nobody owns the network. The sooner we accept it, the sooner we’ll be able to make real progress. What exactly is the split that everybody is talking about? “It is double pleasure to deceive the deceiver.” — Niccolo Machiavelli our miners were discarded by the rest four? Let’s see what the blockchain looks like for them. The four miners who are working on the smaller block size, will continue mining their own set of blocks and will be making their own version of the longest chain. Remember when the blocks mined by six of When that happens, the blockchain will split in two blockchains. Some nodes will be working on one version and some on the other. Let’s label the resulting blockchain like so: The ‘Bitcoin Common’ part of the chain is the part before the split. Miners with the upgraded computers will work on the ‘Bitcoin Current’ branch of the chain while the miners who are still on the old block size will form the ‘Bitcoin Classic’ branch of the chain. Bitcoin, the currency, will therefore effectively be split into two. Coins that were collected by users during the Bitcoin Common can be spent on both Bitcoin Classic and Bitcoin Current. However, the coins that will be traded on Bitcoin Classic will be different from those traded on Bitcoin Current. They will be different in quantity, different in value and different in adoption. They will be as different as any two pre-existing cryptocurrencies can be. What will happen to the bitcoins you own? It depends where you’ve kept your bitcoins. If they are on your own computer, you can spend them twice — once on each blockchain. But if they are stored in an online wallet, the fate of your coins is in their hands. Every online wallet will have their own take how they want to proceed with this blockchain split. They might either migrate your coins to one version of the blockchain or allow you to spend on both. It depends. What I’d advise you to do is not make any transactions a few days before and after August 1, 2017. Because of the fork, you might lose your bitcoins into the thin air. After all, bitcoins are nothing but records of transactions. If you transaction doesn’t get recorded by either of the chains, they will be gone forever. Poof. “All a poet can do today is warn.” — Wilfred Owen There’s a lot of turmoil around what might happen on August 1. Over last couple of weeks, markets have been more volatile than ever. As of this writing on July 24, 2017, almost all the miners are signaling BIP 91 (the miner’s proposition). With this, it seems like bitcoin will avoid the split on August 1, but it is not a guarantee still. Miners saying that they will implement BIP 91 doesn’t mean necessarily mean that they will. This is just a statement of intent from the miners. To really implement BIP 91, majority of the miners will have to upgrade the software on all of their computer before August 1. Miners running the updated software is still under 50 percent. If the miners stick to their intent over next week too, the SegWit part of SegWit 2x will be activated, and the 2x part (increasing the block size from 1MB to 2MB) will be on its way later this year, which will be a hard fork. What might happen during the hard fork? I’ll bring another guide then to keep you informed on the matter. If there’s still something bugging your head, let’s talk in the comments below. — About the author Mohit Mamoria is the curator of a weekly newsletter, Unmade , which delivers one idea from the future to your inboxes. The story first appeared on The Next Web . Have feedback? I am available on Twitter . Also read WTF is Blockchain? The ultimate 3500-word guide in plain English to understand Blockchain. If you enjoyed this story, please 💚 recommend and share to help others find it! Feel free to leave a comment below!

Starbucks

Twitter

Visa

Checkout my blog?

Read My Stories

Why the heck Bitcoin ‘might’ split in two? (explained in plain English)

In this article I will describe how the ES2017 functions are essentially a play between two older features: and , both of which were added earlier to the language in the ES2016 specification. async JavaScript generators promises Before you start reading .. This article is an introduction to , or functions. not promises generators async The goal of this article is to describe how functions can be realised using and . only async promises generators It does offer any opinion whether functions are better or worse than the other approach. not async The code examples used in this article are ingeniously contrived for easier explanation. They are meant for any serious use. not But why .. ? Since functions are now natively supported, what is the need to understand how they work? async Well, apart from the obvious reason of , an important reason is supporting older platforms. If you want your code using these newer features to run on older browser versions or older Node.js versions, you would be required to use like to transform these newer features into older features. curiosity tools Babel Therefore, a solid understanding of how functions get decomposed into and can come in handy when reading/debugging your transformed code. For example, here is a simple example of an function : async generators promises async This function gets transformed by Babel into the following ES2016 code (don’t worry about understanding it right now, we will cover it later) : Babel output for the previous async function (ES2016) They look really different! However, if you understand how functions actually work, then this transformation is fairly obvious. async Another fun fact, browsers also implement functions in a similar fashion i.e. they the code to use and quite similar to Babel. async transform async generators promises Okay, so how does it happen ? Sometimes in order to understand how something works, the best way is to build it yourself. So let’s flip the question: Imagine we are given a piece of code that uses functions, how can we rewrite it using only and functions? async promises generator Here’s an function : async It performs three asynchronous tasks, one after the other where each task depends on the completion of the previous task. Finally, it returns the result of the last task. How can we write it using generators ? Let’s quickly recap how they work. Here’s a simple generator function : Generators are functions which can be exited and later re-entered. This generator-function has some interesting aspects (lifted from the docs) : gen MDN When a generator function is called, its body is not executed right away. Instead it returns an iterator-object which adheres to the i.e. it has a method. iterator protocol next The only way to execute the body of is by calling the method on its iterator-object. Every time the method is called, its body is executed until the next expression. The value of this expression is returned from the iterator. gen next next [yield](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/yield) This method also accepts an argument. Calling it with an argument replaces the current expression with the argument and resumes the execution till the next expression. next yield yield To elucidate (very, very crudely) .. A generator-function gets executed (i.e. one yield-expression at a time), by its iterator (the method). yield-by-yield next Every has a → → behaviour, so to say. yield give halt take It out the value of the current yield-expression, to the iterator. gives It then at this point, until the iterator’s method is called again. halts next When the method is called again, it the argument from it and replaces the currently halted yield-expression with it. It then moves to the next . next takes yield You may want to read the above summary again or refer to the amazing MDN docs ! But how does this help us ? By now you would be wondering, how do the generator functions help our situation? We need to model an asynchronous flow where we have to wait for certain tasks to finish before proceeding ahead. But so far in our discussion everything has been synchronous. How can we do that? Well, the most important insight here is that the generator-functions can yield too. promises A function can a (for example an async task), and its iterator can be controlled to for this to resolve (or reject), and then proceed with the resolved (or rejected) value. This pattern of weaving a an iterator with yielded allows us to model our requirement like this : generator yield promise halt promise promises (Notice how this generator function resembles our _async_ function!) But this is only half the story. Now we need a way to execute its body. We need a function that can control the iterator of this function to every time a is yielded and proceeds once it resolves (or rejects). It sounds complicated, but is very simple to implement, as shown below : generator halt promise A function that executes a generator function. (Only for explanation, ) do not use it ! Now we can execute our function using this function as shown below: generator init runner Use `runner` to execute the body of `init`. And that’s it! This combination of a function and our function achieves a similar outcome as the original function. runner generator async Please note that this runner function is only for demonstrating the concept. It is not suitable for any serious use. If you are looking for a proper implementation, you can find it here . To summarise We started with an function and then we wrote an identical implementation using and . That is, the following two pieces of code will have a similar effect : async generators promises Further exercises In the beginning of this article, we looked at how Babel transforms code to ES2016 code using and . You can now revisit that transformed code and compare how our function is similar to the function. In fact, that function is the foolproof version of our extremely simple function. async generators promises runner _asyncToGenerator _asyncToGenerator runner If you are still interested, you can go another step forward i.e. transform functions to ES2015 code i.e. without . For this you would have to emulate themselves (using a stateful busy loop with cases for e.g. see the ). async generators generators switch regenerator project I hope this explanation clears up the mystery behind functions. They offer a simpler syntax and therefore less code noise. The proposal for functions states that : async async The introduction of Promises and Generators in ECMAScript presents an opportunity to dramatically improve the language-level model for writing asynchronous code in ECMAScript. Thanks to , & for providing their feedback to improve this article. Akos Alisa Kristian

Flow

Async-Await ≈ Generators + Promises

Software as a service is a software licensing and delivery model in which software is licensed on a subscription basis and is centrally hosted. Users can access it with the help of web browsers. SaaS is a common delivery model for many business applications, including office and messaging software, management software,virtualization etc. It is part of the nomenclature of cloud computing, along with infrastructure as a service(IaaS), platform as a service(PaaS), desktop as a service(DaaS). It is associated with the application service providers (ASPs) which provides “shrink-wrap” applications to business users over the Internet. Early Internet-delivered software had features similar to on-premise applications compared to SaaS applications. Because these were originally built as single-tenant applications, their ability to share data was limited. SaaS applications are single-instance, multi-tenant architecture that provide a feature-rich experience competitive with on-premise applications. Aggregator bundles SaaS offerings from different vendors and offers them as part of a unified application platform. The SaaS provider hosts the application and data centrally — deploying patches . They upgrade to the application transparently, delivering access to end users over the Internet. Many vendors provide API’s that developers use for creating composite applications. It contains various security mechanisms for Data security during transmission and storage. SAAS Architecture: With this model, a single version of the application, with a single configuration is used for all customers. The application is installed on multiple machines to support scalability (called horizontal scaling). In some cases, a second version of the application is set up to offer a select group of customers with access to pre-release versions of the applications for testing purposes. In this traditional model, each version of the application is based on a unique code. Although an exception , some SaaS solutions do not use multitenancy, to cost-effectively manage a large number of customers in place. Whether multitenancy is a necessary component for software-as-a-service is a topic of controversy. There are two main varieties of SaaS: Vertical SaaS A Software which answers the needs of a specific industry (e.g., software for the healthcare, agriculture, real estate, finance industries) Horizontal SaaS The products which focus on a software category (marketing, sales, developer tools, HR) but are industry agnostic. Benefit of SAAS: It offers substantial opportunities for organizations of all sizes to shift the risks of software acquisition, and to move IT from a reactive cost center to being a proactive, value-producing part of the enterprise. Traditionally, deploying large-scale software systems has been a major undertaking. Deploying these systems across a large enterprise costs more. The time, staff, and budget requirements of a deployment of this magnitude represent a significant risk for an organization of any size, and often puts such software out of the reach of smaller organizations that would otherwise be able to derive from it a great deal of utility. The on-demand delivery model changes some of this. SaaS applications don’t require the deployment of a large infrastructure at the client’s location . This eliminates or drastically reduces the upfront commitment of resources. Integration can be planned and executed with minimal effort, creating one of the shortest time-to-value intervals possible for a major IT investment. This has also made it possible for a number of SaaS vendors to offer risk-free (and often free) “test drives” of their software for a limited period, such as 30 days. Giving customers a chance to try the software before they buy it helps eliminate much of the risk surrounding software purchase. literally How SaaS Affects IT ? After you’ve made the decision to pursue SaaS, the next is to prepare for the transition by assessing how the deployment will affect existing IT assets. Performing due diligence is a routine part of any successful IT infrastructure deployment project. Some areas to address in due-diligence checklist include,Data security standards : Moving critical business data “outside the walls” introduces a risk of data loss or inadvertent exposure of sensitive information. Assess your data-security needs, and ensure that the provider has measures in place to meet the standards you set. Reporting services : Because SaaS involves giving up direct control of some of your data, accurate and useful reporting is especially important. Determine what reporting services the provider offers, and whether they are compatible with your business-intelligence requirements. Impact on IT Roles and Responsibilities Adding SaaS can cause a fundamental shift in the IT department’s role as a provider of information services. In the past, the nature of software deployment has put chief information officers in the role of gatekeepers . They could exercise a veto by declaring that they would not host it in the data center. With SaaS , control of the data center does not necessarily equal control over the entire enterprise-computing environment. This can cause the gatekeepers to fear a loss of control. Conclusion Enterprises would do well to consider the flexibility and risk-management implications of adding SaaS to their portfolios of IT services. Integration and composition are critical components in your architecture strategies to incorporate SaaS successfully as a fully participating member of your service-centric IT infrastructure. We believe that the future of enterprise computing is not going to be purely on-premise. Instead, they will exist in symbiotic harmony. References : 1. https://en.wikipedia.org/wiki/Software_as_a_service 2. https://msdn.microsoft.com/en-us/library/aa905332.aspx I work as a Software Engineer Intern at . It is one of the coolest places to be!! If you are looking forward to build a SAAS application, please feel free to write to us at contactus@ontoborn.com. We engineer high quality scalable SAAS apps at a very affordable cost. Ontoborn

Microsoft

Routine

Contact us

SAAS (Software as a Service) Platform Architecture

$14,768 !! — Just kidding :P Well anybody would just expect a number! The correct answer is “it depends”.. on a number of factors… I work at Ontoborn where our primary focus is engineering high quality web apps. http://www.ontoborn.com/ It has come to a point where web applications have become an essential component of business in the IT market. They help businesses develop and achieve its objectives much faster. They greatly help to target numerous clientele and customers at a time. Organisations are embracing these aspects of creating web applications to meet their business demands. Web apps are prime factors of any business for a multiple reasons. 1. : It is no longer possible for any business to visualize a growth in their market shares unless they are supported with a proper web application. The main aim is to reach new customers and let know know about the organisation and its services. They also play a crucial role in the branding process. With their help, it is easier to maintain a proper communication channel between potential customers and the business organization. Opportunities of selling the services or products are increased as well. With the help of e-commerce developers, the business can get a whole new market to make sales. Marketing your business and building a brand 2. Web applications provide options for an enhanced customer support. Good applications can become the first line of contact between potential customers and the business. The beauty of such applications is that they can be accessed at any time. Even location is no longer a limitation with their help. Customer Support: 3. The current scenario in the world of business has become so intensely competitive that it has become more important to have web applications devoted to the cause of the organisation. These applications can become essential tool for garnering customers. Competitors : Factors influencing the cost of building an effective web application Fundamentally, the cost of creating a web app is composed of the amount of work hours put into it, multiplied by the hourly rate of your web development team.The amount of work hours that your team will need to develop your software will mostly depend on its complexity. By complexity, we mainly mean the number of custom features you want and how your app will be used. There are three core factors that govern the cost of developing web applications. Complexity Hourly rates Post-release expenses. The simplest version of an application is a website where only one person manages content, no online payments are conducted and no integrations are needed. For example, an informational website about a company and its services.The complexity of a custom web application will increase as soon as you’ll want to: Complexity : allow all users to register and add their own content sell online allow others to buy and sell on your website (C2C) integrate your app with other apps localize your website for multiple geographic locations. So the cost of your app will depend on some features you would incorporate intended for development. Here is a list of the most common features, all of which can influence the complexity of your web application. In a nutshell, the more custom features you’d like to add, the more complex it becomes. Ecommerce features : Payment, Payout/withdrawal (when users can sell on your website),Online bidding. Social Networking features : Interaction between registered users (liking, sharing, commenting, messaging),Scoring system. Management and Operational Tools : Admin panel, Multiple user roles with various access levels, Dashboard, Statistics and analytics. The global market of web development services is very diverse and therefore hard to navigate. Just to give you an idea of the market prices, we are sharing a breakdown. web app developers are divided according to their business type and given price ranges associated with each vendor type. Hourly Rates: Enterprise vendors: 500–2,000 employees, work only with budgets starting at six figures, the development period starts at six months. Upstart shops: Rising stars, new in business, can be quite professional. Bottom feeders: Low-quality companies and freelancers. Typically this hourly rate will be distributed among several specialists, who will develop your application. Therefore, the amount you pay for the development of your app will be allocated between: Project Manager Developers Quality Assurance Engineer. It is a common misconception to think that the more people you have on the team, the faster they will build a web application. This isn’t always the case, as oftentimes the development process should be done in a strict order and you cannot do most of the tasks simultaneously. Don’t fall into this trap even if you are really in a hurry, as you might end up spending your budget faster than your app is finished. Post-release expenses typically include Bug fixing and Infrastructure. Post-Release Expenses: Unfortunately, post-release bugs can happen even if the most brilliant developers are developing your app. During the testing stage we often will test an app under the conditions and use scenarios that we previously agreed upon with our client. This means that before getting to testing, we will discuss with our client all possible devices an app will be used on, as well as ways this app can be used by different user groups. Then we will develop a testing plan according to these conditions and use scenarios. It would be wise to preserve a part of your budget for the unforeseen bugs that can show up after launch. Usually post-release bug fixing requires 10–25% of the app development budget. As for the infrastructure costs, they usually involve Domain name registration from and Hosting web app — ranging from , depending on the storage space and features. $5 to $50 $4 to $500 The phases of Web Application Development The Web application development process has 4 phases: Envisioning the nature and direction of the project : The management and developers assigned to the project come together and establish the goals that the solution must achieve. This includes recognizing the limitations that are placed on the project, scheduling, and versioning of the application. By the end of this phase, there should be clear documentation on what the application will achieve. Devising the plan : In this phase, you must determine the “how’s” of the application. What scripting language is most appropriate, which features must be included, and how long will it take? These are some of the questions that must be answered through this planning phase. The main tangents at this point are the project plan and functional specification. The project plan determines a timeframe of events and tasks, while the functional specification outlines in detail how the application will function and flow. Development : Once the project plan and functional specification are ready, a baseline is set for the development work to begin. The programmer/s or Web developer/s begin coding, testing and publishing data. This phase establishes the data variables, entities and coding procedures that will be used throughout the remainder of the project. A milestone document is prepared by the development team, which is then handed to management for review. Testing,support and stability : The stability phase of the application project mainly focuses on testing and the removal of bugs, discrepancies and network issues that may otherwise cause the application to fail. It is here that policies and procedures are established for a successful support system. How much does it Cost ? The oversimplified estimations of the three types of projects based on their complexity is given below . This is compiled to give you an idea of how development costs vary depending on project complexity. Pages with static information and it can cost about $3K. Basic : Pages with static information, few functional units and API ,third-party integration.It can cost from $10K. Medium Complexity: All from ‘Medium’,Multiple user roles,High user load and Custom statistics.It may cost about $25K. Complex : The list of factors that we’ve covered is not exhaustive, as each project is unique. Nonetheless, we consider these factors to play a major role in determining the cost of Web app. If you are a prospective client interested in getting a free quote please send an email to Moving on, first let’s take a look at the substances of web application for any business. contactus@ontoborn.com

How much does it cost to develop an Web Application?

New rumors surface around There is no real information about the product yet, just a lot of speculation, but reading I could not help but hear a lot of echoes (pun intended) of topics I have been covering recently: product launches in the smart speaker/intelligent assistant space, this time coming from Facebook. the TechCrunch article about this Amazon Echo’s communications service Apple’s HomePod iMessage support , *another* communication service by Amazon ( ) Rumors about “Amazon Anytime” or maybe not? Let’s look at the aspects from the TechCrunch article that I see related to those. Communications in a new device “It would also be sensible for Facebook to allow messaging from the speaker, via voice-dictated text messages, VoIP audio calls or video calling.” This is fundamentally what . But instead of creating a new service, could leverage their own strength in Social Communications. This concept of extending mobile-centric communication services to new devices is part of what I call the . I believe this trend is mostly industry driven, as consumer electronics and telecommunication providers want to create a new demand cycle. What we have not seen yet is significant consumer adoption — specially when compared with the smartphone growth model — , and that is why players are trying to tie these new devices with pieces of their existing ecosystems. Amazon offers with Alexa Calling and Messaging Facebook “disintegration of the smartphone” For Amazon Echo, the ecosystem is Amazon’s shopping experience and other services like Amazon Music. But . that has left communications as a weak link Apple is initially focusing on their Apple Music experience, . I believe the other ecosystem to use would be the iOS community, but I will get back to that later. but they also have iMessage to leverage there development , which in turn benefits from the knowledge of the user they get from Google Services and Android devices. Google is using their Google Assistant for that Facebook has their social communications market leadership as the ecosystem to leverage. What about WhatsApp? “As of February, 400 million of Facebook Messenger’s 1.2 billion users communicate via Facebook audio and video calling every month.” The strength of Facebook Messenger as a communication tool is clear. But what about WhatsApp? US-centric media tend to ignore WhatsApp because it is not that relevant in the US market, but and leads many important markets in Europe and Latin America. The problem here is that the current , specially for voice and video communications. WhatsApp also has over 1.2 billion monthly users WhatsApp solution does not support several devices Facebook, which owns WhatsApp, pushing for multi-device communications can generate an additional “incentive” for WhatsApp also moving into multi-device. Social Graph is key “Amazon is already trying to barge into the home communications market with its new Amazon Echo Show version of its smart speaker, which lets people video call each other over its screen. Google has its own Google Home speaker and Apple is preparing to launch the HomePod. But none of them have a ubiquitous cross-device instant messaging platform with a comprehensive social graph the way Facebook does.” This element is right on point. All players in the smart-speaker space are looking at communications on their devices, but for this, the key elements are: The social graph. An existing social graph is a huge advantage over having to create it from scratch. . That is the main problem I saw with the rumors around Amazon Anytime Cross-device support. Which Facebook Messenger supports, . but WhatsApp doesn’t So Facebook is in the best position here. That does not mean they have a winning play. But, are communications the killer app? The question here is whether a communication service is the center for a new device like a smart speaker. As I discussed when talking about Amazon Echo, , but the Echo existed before having that, and was valuable for a number of uses: shopping, smart home, information, entertainment… communications was something the device needed What can Facebook offer in this space? It is yet to be seen, but while Facebook can leverage their positioning in communications, I am skeptic around a new device that would only (or mainly) do that. They could offer some information/entertainment elements too, just as , but the are also to be considered here. Apple is positioning their own device around music issues with Facebook’s content No, the platform is the killer app In the end I believe the success of the smart speaker space will be defined by the support of developers. They are the ones that will create new uses for these devices, making them more relevant as they did in the smartphone market. And that requires that Amazon, Google, Apple and now Facebook will . open up their platforms and create incentives for developers as a key strategic point Initially this will create a fragmentation of operating systems that will be stressful for developers. For instance, in the past WhatsApp had to develop versions of their app for Nokia, BlackBerry or Windows Phone devices. Since developers will not have resources or the right RoI to target all four (or more) platforms, they will have to bet on some, and eventually there will be consolidation around one or two (the new “iOS” and/or “Android”) of those platforms. But maybe that will not be a problem for Facebook. They have built their success on mobile on top of Apple’s and Google’s platforms (the Facebook, WhatsApp and Instagram apps for iOS and Android), so they may do the same on the smart speaker market. Even if they end up not being a relevant player in the hardware and operating system part of these devices, they may still be the winners in the user engagement fight. And this may be the main reason behind the Facebook speaker: the goal is not to have a successful device in the market — something Facebook has no experience in — but a tool to force the other players to open up their platforms and then become the main developer there, same as they did in the smartphone market.

Amazon

Apple

Google

Instagram

Techcrunch

The Facebook smart speaker — Communications full circle

It is incredible how far we’ve come in the coverage of events. In the past, I recorded my own talks as audio as not many conferences offered video recordings (and in the ). These days I find myself having not having to do this as most conferences and even meetups record talks. Faster upload speeds and simple, free hosting on and others made that possible. wrote about this as a good idea developer evangelism handbook YouTube And yet it is expensive and a lot of work to record and publish videos of your . And if you don’t make any money with them it is a bit of advertising for your event with a lot of overhead. That’s why it is a shame to see just how low the viewing numbers of some great conference videos are. When talking to conference organisers, I heard some astonishingly low numbers. The only thing to boost them seems to be to deliver them one after the other with dedicated social media promotion. Which, again, is a lot of extra effort. conference In order to see what would make people watch more conference talks, I took a quick Twitter poll: Here are the quick results of 344 votes: 29% chose shorter videos without Q&A 37% would like transcripts with timestamps 22% would like to have videos offline 12% wanted captions. I watch them offline, on an iPod in the gym or on planes and trains. Basically when I am not able to do anything else, they are a great way to spend your time and learn something. There are a few things to consider to make this worth my while though: I love watching conference talk videos. The talk needs to make sense to watch on a small screen. Lots of live code in a terminal with a 12px font isn’t. That is not to say these aren’t good talks. They are just not working as a video. The talk needs to be available offline (I use to download YouTube videos, some publishers on Vimeo offer downloads, Channel 9 always has the videos to download) YouTube DL The talk needs to be contained in itself — it is frustrating to hear references to things I should know or bits that happened at the same event I wasn’t part of. It is even more annoying to see a Q&A session where you wait for the mic to arrive for ages or the presenter answering without me knowing what the question is. I’ve written about the and I strongly believe that cutting a standard Q&A will result in more viewers and happier presenters. For starters, the videos will be shorter and it feels like less of an effort to watch the talk when it is 25 minutes instead of 45–50. Q&A part of videos in detail before At technical events I am OK with some of these annoyances. After all, it is more important to entertain the audience at the event. And it is amazing when presenters take the time and effort to see other talks and reference them. However, there is a lot of benefit to consider the quality and consumption of a recording, too. Having recordings of conference talks is an amazing gift to the community. People who can’t afford to go to events or even can’t afford to travel can still stay up-to-date and learn about topics to deep dive into by watching videos. Easy to consume, short and to the point videos can be a great way to increase the diversity of our market. “You are here to talk to the online audience” When I spoke at some TEDx events, this was the advice of the speaking coaches and organisers. TED is a known brand to have high quality online content. And it is almost unaffordable to go to the main TED events. Which makes this advice kind of odd, but their success online shows that there are on to something. TED talks are much shorter than the average conference talk. They are more performance than presentation. And they come with transcripts and are downloadable. Now, we can’t have only these kind of talks at events. But maybe it is a good plan to do some editing on the recordings and turn them into more of an experience than a record of what happened on stage that gets delivered as soon as possible. This means extra work and is some overhead, for sure. But I wonder how much of it could be automated already. In addition to the poll results there were some other good points in the comments on Twitter and . Facebook Less of the speaker upper body and more of the slides. Or slides to download. Also, speakers who pace themselves to sound good at 1.5x speed. It seems to be pretty common by people who spend time watching talks to speed them up. This is an interesting concept. Good editing between slides and presenter was a wish a lot of people had. It shouldn’t be hard to publish the slides along with the video, and something presenters should consider doing more. Not on the list but “editing” plus a solid couple of paragraphs of what the talk covers and why I should or shouldn’t watch it. This is another easy thing for presenters to do. We’re always asked to offer a description and title of the talk that should zing and get people excited. Providing a second one that is more descriptive to use with the video isn’t that much overhead. For English spokers, most of the conferences, no problem. But for non English spokers, massive failure. Reading is really more easy trying to listen and understand. Some guys speaks really fast. So I can’t understand talks. This is a common problem and a presenter skill to work on. Being understandable by non-native speakers is a huge opportunity. So, some pacing and avoiding slang references are always a good idea. The possibility to download the videos on tablets, smartphones and laptops so I can see them during commuting time Offering videos to download should be not too hard. If you’re not planning to sell them anyways, why not? Also offline availabilty with chapter marks/timestamps. I’ll vote for transcripts for skim reading to get to the gold nuggets. But sometimes a good speaker is an enjoyable 50min experience. I’d rather read transcripts. I never get blocks of quiet. Links to slides to follow along, or (even better) closed captions so I can play them muted If they were shorter and had a PowerPoint with main points to download after This, of course, is the big one. A lot of people asked for transcripts, chapters and time stamps. Either for accessibility reasons or just because it is easier to skim and jump to what is important to you. This costs time and effort. And here we have a Catch-22: if not many people watch the recordings of an event, conference organisers and companies don’t want to spend that time and effort. Manual transcription, editing and captioning isn’t cheap. The good news is that automated transcription has gone leaps and bounds in the last years. With the need to have voice commands on mobiles and home appliances a lot of companies concentrated on getting this much better than it used to be. YouTube has for free. Most cloud providers offer video insights. automated captions with editing functionality One service that blew me away is . VideoIndexer (Yes, this is by the company I work for, but it came as a surprise to me that this offer brings together many machine learning APIs in a simple interface.) Using VideoIndexer, you not only generate an editable time-stamped transcript, but you also get emotion recognition, image to text conversion of video content, speaker recognition and keyword extraction. That way you to offer an interface that allows people to jump where they want to without having to scrub through the video. I’d love to see more offers like these and I am sure there are quite a few out there already in use by big TV companies and sports broadcasters. If you know of any good ones, please comment here. Summary All in all I am grateful to have the opportunity to watch talks of events I couldn’t be at and I’m making an effort to be a better online citizen by providing better descriptions and be more aware of how what I am saying can be consumed as a video afterwards. My favourite quote in the comments was from Tessa Mero: Would be fun watching it with someone so we can discuss the content during/after the video. Need social engagement to make learning more fun. Videos of talks are a great opportunity to learn something and have fun with your colleagues in the office. Pick a room, set up a machine connected to the beamer, get some snacks in, watch the talk and discuss how it applies to your work afterwards. Conference organisers spend a lot of effort to record talks, presenters put a lot in to make the talk exciting and educational. And you can benefit from all of that for free. Permalink: https://christianheilmann.com/2017/07/26/how-can-we-make-…onference-videos/ ‎

How can we make more people watch conference videos?

Digiday

Funding

Mashable

Netflix

Nike

Salesforce

How a startup is writing the playbook for content subscription businesses

Digital assets are an enduring force of great value. They are the fuel of the new economy as organizations strive to be increasingly digitally driven. The way ocean of digital assets is rising, it is essential more than ever to optimally manage every type of digital content. Organizations today put so much effort to deliver responsive, personalized and engaging experiences. Digital content has a very important role to play here. And, are becoming a strategic priority for organizations to manage rising volume of content, streamline and automate processes for efficiency and quality. digital asset management (DAM) solutions Digital asset supports solutions (web content management, eCommerce, and campaign management) by managing omnichannel brand and rich media content across all channels. management It also helps store, access, distribute, re-purpose, and monetize digital content. In fact, a good DAM contributes directly to the bottom line. Organizations recognize this fact. And they are looking to transform their digital asset management solutions to improve and sales performance for higher ROI. marketing But, it depends on how big their assets are, how distributed they are and how much integration they need to do. Organizations must make an informed decision before choosing any . They must choose a solution that fits well with their structure. And, it must also enable them to adopt the solution quickly with business benefits. DAM solution is an award-winning consolidated open source platform for PIM, DAM, WCM and Commerce. Want to know how Pimcore’s DAM platform can help you, . Pimcore try a FREE demo here Here are 7 key factors to consider when choosing a DAM platform: — Digital asset management plays a critical role to improve brand consistency across campaigns and channels. It serves many roles inside and outside of an organization. Thus, it must support greater automation in managing global or local versions of assets, various renditions of assets across channels, and integration with key systems of engagement. Implementation — A digital asset management solution should integrate well with the existing infrastructure of the organization. It should be easy for creative workflow and approval, collaboration, and version control. Your DAM solution must also allow you to take advantage of deep integration with campaign management, marketing automation, and marketing technology platforms to boost marketing agility. Integration — It should offer the deeper capability to efficiently manage a diverse set of content at reduced cost and lesser hassle. Because, DAM is a creative innovation lab for your marketing and sales team. It must reduce time spent searching for assets, streamline approval processes, make it easy to collaborate better with external stakeholders, and provide better visibility of current status. Management — DAM should be compatible with existing as well as modern infrastructure ( like cloud and mobility) so that unnecessary cost can be avoided in the long-run. A next-generation DAM system must take advantage of the cloud and mobility to make access and sharing easier among all teams wherever and whenever they require. Infrastructure — It must provide robust security, metadata, and workflow capabilities — along with the scalability to support or add of assets. Security n-numbers — Today, rich media is created in bulk. The DAM solution should provide strong support for audio, video, and images (with the format conversion capability as well as previews and editing capabilities on images and rich media) to support today’s responsive, cross-channel digital experiences. Rich media capability — The DAM platform must be easily adopted by both internal and external teams (using role-based accessibility) so that business value can be realized as soon as possible. It must empower teams for better asset reuse, avoid duplication of effort and rework, and reduce the number of digital assets that are created but never used. Adoption : It is not about what digital asset management platform you choose. But it is more about how a DAM solution enables you to create value around your entire asset cycle — improving collaboration, strengthening brands, accelerating campaigns, and increasing the ROI. Plus, delivering amazing customer experiences that you always strive for. The bottom line is The original article published here .

7 Considerations to Choose Digital Asset Management Right

and the massive opportunity to build tech for the Financial World Hi I’m Jordan , I love helping people think & grow their products. Hope this helps! You can find me on Twitter and via my Newsletter :) I hate when people ask me if I work in “tech.” It is like they think tech is an industry on it’s own. Newsflash for the world, the future of company is driven by technology. If you want to build a successful company today (success meaning one that strives to be as big and impactful as possible), I’d argue that it must be a technology company. any So to the people asking me if I work in “tech”, the answer, is that the future is tech. The way I see it, every “scaling” company in the future integrates technology. Period. The ironic part of this whole mess is that the critics of “the bubble” (which I am very aware of) are often those in incumbent industries like Finance, Accounting, and Consulting. I’d argue that those industries are just as ripe for disruption as any other. In fact, I’d bet that in the next 10–20 years, we will see major changes in the way each of those spaces evolves. The truth is that while I cannot predict the future, the only thing we can be certain of is inevitable change. As the world evolves, so do our needs. There is so much opportunity to be made around money and we can dramatically improve people’s lives if we solve issues around personal finance, lending, trading, and so many more. Finance, in particular, excites me. And people are dying for it! According to an analysis of over 10 million users performed by credit bureau TransUnion, almost half of millennials (Americans age 18–36) have . A score below 600 is low enough to give many lenders pause before extending a line of credit to an applicant. Contrast this with older Americans — such as baby boomers — and there is a stark difference, with older generations much more likely to land in the “Super Prime” rating level — TransUnion’s highest rating tier. — via the “subprime” credit — meaning a credit score that is below 600 Credit Repair Blog This is not to mention piling . student loan debt A quick picture of this: $1.44 trillion in total U.S. student loan debt 44.2 million Americans with student loan debt Student loan delinquency rate of 11.2% (90+ days delinquent or in default) Average monthly student loan payment (for borrower aged 20 to 30 years): $351 Median monthly student loan payment (for borrower aged 20 to 30 years): $203 via Student Loan Hero TRILLIONS! We are sitting on a friction-full gold mine of incredible business opportunity. So what is next? How will this play out? I think the natural answer is that more and more people will be interested in building for the Finance world. We will see more companies launched. More competition. And overall a better situation for both consumers and businesses. There is already a ton going on in this space. Here is a snapshot of some of the top tools today: Thanks so much for reading! My name is and I write blog posts It would mean a ton to me if you could: Jordan Gonen every day. > Follow me on Twitter < If you ever have any questions, send me an email jordangonen1 at gmail dot com ! Thanks so much!

Super

Top 9 Finance Tools on Product Hunt

Heroku

Trace

This is what Node.js is used for in 2017 — Survey Results

My favorite Onion article of all time (from 2010) is It starts off with some Bernanke brilliance. U.S. Economy Grinds To Halt As Nation Realizes Money Just A Symbolic, Mutually Shared Illusion . “Though raising interest rates is unlikely at the moment, the Fed will of course act appropriately if we…if we…” said Bernanke, who then paused for a moment, looked down at his prepared statement, and shook his head in utter disbelief. “You know what? It doesn’t matter. None of this — this so-called ‘money’ — really matters at all.” “It’s just an illusion,” a wide-eyed Bernanke added as he removed bills from his wallet and slowly spread them out before him. “Just look at it: Meaningless pieces of paper with numbers printed on them. Worthless.” This is not a new idea. From William Gibson’s book , one of the most important sci-fi books ever which established the idea of cyberspace in 1984. Neuromancer clusters “Cyberspace. A consensual hallucination experienced daily by billions of legitimate operators, in every nation, by children being taught mathematical concepts… A graphic representation of data abstracted from banks of every computer in the human system. Unthinkable complexity. Lines of light ranged in the nonspace of the mind, and constellations of data. Like city lights, receding…” Back to the Onion article. “Sen. Orrin Hatch (R-UT) finally shouted out, “Oh my God, he’s right. It’s all a mirage. All of it — the money, our whole economy — it’s all a lie!” Now, ponder . Bitcoin “I’ve spent 25 years in this room yelling ‘Buy, buy! Sell, sell!’ and for what?” longtime trader Michael Palermo said. “All I’ve done is move arbitrary designations of wealth from one column to another, wasting my life chasing this unattainable hallucination of wealth. What a cruel cosmic joke,” he added. “I’m going home to hug my daughter.” Or Ethereum. “A few U.S. banks have remained open, though most teller windows are unmanned due to a lack of interest in transactions involving mere scraps of paper or, worse, decimal points and computer data signifying mere scraps of paper.” I just read Kenneth Rogoff’s I literally have zero cash in my wallet. On a daily basis, I’m dealing with very large sums of money across multiple companies, but it has completely become a functional abstraction to me. The Curse of Cash: How Large-Denomination Bills Aid Crime and Tax Evasion and Constrain Monetary Policy . As I did a fairly sophisticated transaction on my computer yesterday that moved cash into a cybercurrency, I had the phrase “money is a consensual hallucination” echoing in my head. Math and computers are helping reinforce this. . And the government is watching Originally published at Feld Thoughts .

Mind

Money Is A Consensual Hallucination

I’m going to be honest with you, writing tests is not my favorite thing to do (but it doesn’t mean that I don’t do it). I remember at some point for instance, I had to check whether a function rejected a particular value or not and I found myself writing something like this: expect(typeof(var)).toEqual('number') That was it. It felt like I was writing my own tiny, unevolved type checker — like reinventing the wheel, while hating wheels in general. Pretty soon I realised instead of just doing it myself, I should have shortened the process and started to use a static type checker. I chose Flow since it fitted right in with my current setup. One of the main advantages I was hoping for was to receive instant feedback on my code by checking changes and analysing its correctness — I wanted something that not only spotted errors, but that also offered some level of intellisense. Flow does this by integrating with your code editor. This is when the role of editors started to matter, and Webstorm started to suck. The Frustration Flow-bin package: . installed Configuring project and Webstorm: . done Type annotations: . added Result: simply sluggish! Webstorm code analysis became considerably slow after adding Flowtype in addition to Eslint check. Sometimes it took to up to six seconds on my Quad Core i7 (16GB RAM, SSD) MBP to show all of the errors and warnings. I’ve always been a big fan of JetBrains and never was less than satisfied with their products, but this was a deal breaker. Using Flowtype on Webstorm was so unbearable that I had no choice but to look around for an alternative. At this point there had already been constant noise around VS Code in our office. The community also had been praising it for its swiftness for the last two years, so I knew I needed to consider it when it came to performance. Much to the surprise of my colleagues, I turned a blind eye to VS Code and kept living my miserable life with Webstorm for a while. The hesitation While VS Code is free and open source which is more than ideal; for me, it was the thought of going back to Microsoft that stopped me from making the move straight away. To be honest, working with Microsoft brings me back to some dark memories. Coding experience and how things look is so important to me and when it comes to , we’re talking about a company that thinks it’s ok to have multiple rows of tabs on a panel and ship it out there for billions of people to see. Microsoft The horror of tabs This mess was taken to another level with classic Visual Studio. I found myself going through wizards, ticking check boxes and selecting rows of tabs (their favourite) like an MS Office user rather than a developer. This a real screenshot from one of visualstudio documentations is I remember there was once a menu somewhere labeled as something similar to ‘convert this web solution to an mvc solution’. Simply by clicking it — without typing any code or having any control whatsoever — it would perform some kind of magic and god knows what it would have done to my behind the scene. codebase The jump So two months ago, I bit the bullet and decided to download VS Code. I just very carefully visited and downloaded the editor (If you miss the word ‘code’ you will end up in where you will most likely see smiling people in suits giving you a thumbs up). I have to say VS Code was nothing like my experience with classic Visual Studio. It was so minimalistic, in an enjoyable way that keeps you focused on the code and nothing else. Just look at these settings for instance, nicely presented as a JSON: https:// .visualstudio.com/ code https://www.visualstudio.com/ VS Code settings.json It is nothing like what caused my old Visual Studio trauma. Setting up Flowtype was simple(ish) and instant validation was fast. Your type errors are reflected in your ‘Problems’ list (⌘ Numpad 0) which makes them super easy to just spot and resolve straight away. Spotted type error The result Overall after one month I feel positive about my move (and £70 richer). Apart from some occasional annoyance (such as ) VS Code has been a much faster and more pleasant coding companion. You might prefer to stick with Webstorm, and if so leave a comment below and let me know why it works well for you. For me though, I’m afraid it’s too late. With VS Code, I think this is the beginning of a beautiful friendship. no support for multiple terminal tabs, offering a cheap dropdown instead Recommendations If you’re like me and come from Webstorm, I suggest you install and you’ll feel at home straight away. However, this may not cover all the shortcuts (for instance I used to hit double shift to look for a file and now in VS Code I do the same with cmd+shift+a or simply F1). ‘IntelliJ IDEA Key Bindings for VS Code’ You may realise that your Eslint errors in VS Code’s ‘Problems’ list (⌘ Numpad 0) starts with a low number and then as you open more files, more errors pile up on the list; this is basically its VS Code incremental approach. In other words you will never have a full global list of your Eslint errors unless you open all files. You can address this issue quite easily by creating a task to check all your files and updates your ‘Problems’ list. Then you run that task once in awhile and update the list and get on with your life (coding). The process is explained in section of . four this article Configuring Flowtype and Eslint on VS Code can be a little bit tricky. As much as Flowtype checking was smooth, in my experience Eslint checking didn’t seem to be responsive at all and it took me a while to set it right. For setup/config details check out by . this article Sean Groff - Vahid Panjganj, Front-end engineer at WeAreHive Thanks for reading. If you have any feedback, tips or tricks, please leave a comment. If you think this article can be helpful for your friends, please share. You can follow me, here . You can also follow @wearehive where we tweet about tech, product and design related stuff.

How Flowtype moved me from Webstorm to VS Code

Proxy re-encryption is a set of algorithms which allows an untrusted proxy to transform ciphertext from being encrypted under one key to another, without learning anything about the underlying plaintext. Proxy re-encryption algorithms usually work as public-key encryption, in which a public-private key-pair is used to encrypt and decrypt the data, respectively. As a class, proxy re-encryption is well-suited for use cases in which you want to share encrypted data with multiple parties. Rather than naively sharing your private key with recipients (insecure) or encrypting the entire message times for each recipient, proxy re-encryption allows you to encrypt the data once and then delegate access to it based on the recipients’ public keys. This removes the requirement for the data owner to be online and also facilitates revocation of access. N Proxy re-encryption algorithms come in two primary flavors: interactive and non-interactive. Interactive versions delegate access to a private key, while non-interactive ones delegate access to a public key. Today, we’re releasing an implementation of one of (and the first one invented) on . It’s based on elliptic curves. For encryption and decryption, it’s similar to ElGamal operating on elliptic curve prime field and it’s an interactive algorithm that requires knowledge of the recipient’s private key. the simpler algorithms our GitHub Installation is written in Python. It requires `libssl-dev` and `libgmp-dev`. It is a slightly refined version of the same algorithm in the , with a simplified installation process, thread safe, and more appropriate for practical uses. The library charm crypto library To install in Linux (Debian, Ubuntu, Mint): sudo apt-get install build-essential # Compilers etc

sudo apt-get install python3 # Written for Python3.x

sudo apt-get install python3-dev libssl-dev libgmp-dev # Dependencies to compile C extensions On Mac: brew install python3

brew install gmp Now that we have the dependencies out of the way, you can install the `nucypher-pre-python` library. I’d recommend doing it in `virtualenv`. git clone https://github.com/nucypher/nucypher-pre-python.git

cd nucypher-pre-python

pip3 install -e . It’s also convenient to try it in an ipython terminal rather than standard python. Now, let’s start playing with the library! In [1]: from npre import bbs98 We need to initialize the re-encryption object: In [2]: pre = bbs98.PRE() In the BBS98 algorithm, there is a shared non-secret random number, which defines the parameters of the re-encryption algorithm. This number is generated and saved in the class instance, along with the curve name (`secp256k1` by default). Both the sender and recipient must initialize using the same parameters. For that, we can serialize and de-serialize the `pre` object (de-serialization happens on a different machine). If you’re running this tutorial (and both the sender and recipient functions) locally, it’s not necessary: In [3]: backup = pre.serialize()

In [4]: backup

Out[4]: b’\x82\xa5curve\xcd\x02\xca\xa1g\xda\x00.1:A8LQod5lJgbCnh3vQd+RGSe3qDrhw8n8Ju8uZ7dpzKB+’

In [5]: pre = bbs98.PRE.deserialize(backup) Now, let’s generate key pairs `(sk, pk)` for Alice, the owner of the data, and Bob, the recipient: In [6]: sk_a = pre.gen_priv(dtype=bytes)

In [7]: pk_a = pre.priv2pub(sk_a)

In [8]: sk_b = pre.gen_priv(dtype=bytes)

In [9]: pk_b = pre.priv2pub(sk_b) Here `sk` means “secret key”, and `pk` means “public key”. Let’s see what these keys actually are: In [10]: sk_a

Out[10]: b’0:JKwy+rxGu+BvaZ0cKgV/alsfYfhZoVNm63CrCvL/faI=’

In [11]: pk_a

Out[11]: b’1:A5NZVIEGQgao/knbwDbR4cNaxHQwkJCRWUJDCm8vQCJe’

In [12]: sk_b

Out[12]: b’0:otOz8XATKx1rX+Ypp+/2NDw2ej7n+TUx8rBTKRm7KtI=’

In [13]: pk_b

Out[13]: b’1:A9gOmE39Kwuhpbafylfm3d+3y7FLRnupV8pcTYDg0xTl’ Now, let’s encrypt something: In [14]: msg = b’Hello world’

In [15]: emsg = pre.encrypt(pk_a, msg)

In [16]: emsg

Out[16]: b’\x92\xda\x00.1:Aw3nUfn9bNTfCtG0KPkaugzDGKlN3a/Gq0MH3uaAMBkp\xda\x00.1:A3qkvzG47dt5xiODccILFPbLw8CaTZsPlUbJoKbegl/T’ Let’s see if we can decrypt this message: In [17]: pre.decrypt(sk_a, emsg)

Out[17]: b’Hello world’ What if we try to decrypt using Bob’s key? In [18]: pre.decrypt(sk_b, emsg)

Out[18]: b’\x94_\xf3W\xb5aX8' It doesn’t work, of course! Now, let’s transform data to be encrypted for Bob. For that, we generate a re-encryption key: In [19]: re_ab = pre.rekey(sk_a, sk_b) And transform the message. The transformation can be done by a remote proxy which knows neither `sk_a`, nor `sk_b`: In [20]: emsg_b = pre.reencrypt(re_ab, emsg)

In [21]: emsg_b

Out[21]: b’\x92\xda\x00.1:AyafJONHL/ZgrkwKFzFQtEnr8Em5k9hxP/ICzAGCNm4I\xda\x00.1:A3qkvzG47dt5xiODccILFPbLw8CaTZsPlUbJoKbegl/T’ Can we decrypt the re-encrypted message? In [22]: pre.decrypt(sk_b, emsg_b)

Out[22]: b’Hello world’ So, we re-encrypted a message originally encrypted for Alice to Bob. But to delegate access to Bob, Alice needed to know his secret key `sk_b`. Definitely not ideal! Is it possible to avoid this requirement and use Bob’s public key instead? One solution to this would be to use a different proxy re-encryption algorithm, such as AFGH. But there’s a way to do it with the current algorithm. When Alice delegates access to Bob, she can generate an ephemeral key `sk_e` and produce a re-encryption key `rk_ae`. Then she encrypts `sk_e` with Bob’s public key `pk_b` yielding `e_b`. The proxy will be given both `rk_e` and `e_b`. When Bob connects, the proxy will hand him `e_b`. Then Bob can extract `pk_e` out of it and use that to decrypt encrypted messages coming from the proxy. Feel free to play with the library, but be safe: this particular implementation hasn’t undergone a security audit and is currently for educational use only :-)

Different

Proxy Re-Encryption Playground in Python

Extra article on UI, I give here advice on the way to ensure that user interfaces have been correctly developed. Like in the previous articles, I use a Scrum tool : the which is a contract established between the developer team and the product owner on the requirement level of developments. A feature which these requirements . definition of done doesn’t respect can’t go in production The definition of done can evolve during the project lifetime, it starts in general from a minimal list to . Most of the time we will be satisfied with a minimal list rather than living with too many rules constraining the delivery in production. But I think that it’s important to go up in quality and then in requirement while the execution capacity of the team improves. That’s why I propose here different . grow with the execution capacity of the team ladders of requirement Definition of done for the UI part Base ladder: The are interface specifications respected the screen layout is respected the dimensions (space and size) are respected the block colors are those specified the block shadows are those specified the interface components and their style are those specified the images are those specified the texts are those specified the fonts, font sizes, styles, colors, shadows used are those specified the main and secondary flows have been checked The verification has been done on of the different possible variations configurations minimum and maximum supported screen sizes in dp (screen layout suited for small and large surfaces, see ) 1st part of the article smartphone and tablet (to test specific layouts like multipane) minimum and maximum Android versions (compatibility of the interface components used) 2 screen densities, the 2 bigger smartphone and tablet densities : the most requiring in quality and with non proportional factors (to check the taking into account of the density in dimension calculations) supported languages The verification has been done on at least one physical device Choose a minimum device set combining the different configurations to simplify Quality ladder : Animations the have been animations developed the animations are those specified The display is on a mid-range device: constant fluid 60 frames per second The base criteria are respected accessibility adding of a description (contentDescription attribute) to interface components without displayed text The that the integration respects the specifications (good understanding, development compromises and business adjustments) graphic designer validates The base criteria defined for are satisfied quality interface files maximum depth of X for readability (to define) usage of style to regroup attributes interface behaviors described as possible in xml (rather than programmatically) etc. Advanced quality ladder : Interfaces are “Pixel Perfect” The advanced accessibility criteria are respected rest of the (need of test with the TalkBack tool) official Android checklist The verification has been done on the totality of the possible configurations all the supported Android versions have been tested all the densities have been tested risky constructor devices have been tested (to check anomaly due to non respect of the Android specifications, eg Samsung) The criteria defined for interface files are satisfied advanced quality to define This is a proposition. Feel free to adapt it to your team context. definition of done Android Developer at jacquesgiraudel.com

Samsung

“Done” interfaces

We love browsers, they are our window to the world. We love browsers so much that we have over them, wars so fierce and prolonged that only three browsers really survived. fought wars Two of them only survived because their developers also happen to own major operating systems and I do not even need to name names, when it comes to browsers, you all instinctively know who I am talking about. Whatever its name, we rely on the browser and we need the browser, otherwise how else are we supposed interact with the outside world? Go outside you say? Well I am sorry, but I am far too busy for that. Going outside is great, but when it comes to seeing whats going on elsewhere and interacting with it, going outside ain’t got nothing on the browser. We can all agree that life without the browser would be miserable. But that doesn’t mean that the browser isn’t broken. What? Don’t believe me? Who gave you that last virus without telling you that she was infected? Who let the WannaCry ransomware strain come in and encrypt all of your stuff, demanding a goddamn bitcoin ransom to decrypt it all? Who voluntarily gorges themselves on cookies and god knows what nefarious tracking software to let others track you and your habits? Who is it that allows bad websites to spontaneously pop open tabs containing even worse websites? Who left the window open so that filthy pervert could walk straight into your house and watch you through your webcam? Go on, I will give you three guesses and a clue. It wasn’t that bloated bitch Microsoft Word, although she might have done, you these days. never know It was the browser and if you need yet more evidence that she is a total bitch, when was the last time she stopped your ISP or whoever happens to be sniffing the Starbucks wifi network today from watching you browse Reddit? When was the last time it stopped those degenerate advertisers from assaulting your eyeballs without an adblock plugin helping out? Never is the answer, its not the browsers problem apparently. Like I said, the browser is broken. The fundamental problem we have as internet users is that the browser is broken and takes responsibility for nothing, choosing to shirk off its responsibilities to the anti-virus, the firewall or whatever security software you happen to be running to protect yourself. We how well they get on though, you may as well have a ‘Beware Of The Dog’ sign as your screensaver, it can be just as effective. already know The reason we have a fundamental problem is because the vast majority of attacks against your computer are not coming through your wifi connection, they are not coming through your IM client and except for the advanced persistent threat, they are mostly not coming through your email client. The browsers dirty little secret is that the vast majority of attacks are climbing in through the open window that is your web browser and even when you think you closed and locked it, the browser is broken. A recent identified the browser as the primary attack vector for the vast majority of cyber attacks, but of course most of us didn’t need to be told, because most of us have already been mauled by some sort of browser originating malware at some point. study from the Ponemon institute Even if we haven’t fallen victim to a ransomware attack yet, we all know that shady websites belch malware on you through your browser, it doesn’t take a genius to work out that when you open a browser window to look into the abyss, sometimes things hungrily look back through the window at you. Brilliant, lets not use browsers, that way nobody will ever steal my online dating messages, online trading accounts or blog posts on dating. Oh wait, we actually need a browser for (unless there is an app for it) and not using them really isn’t an option for most people, so I suggest that . everything we should do the next best thing and wear a condom We know every time we stick a piece of ourselves into the internet, we are going to catch some kind of nasty dose, so lets just wear internet condoms. By this I mean lets place a physical barrier between us and the nasty infectious stuff that lurks around on the internet, it makes a lot of sense and is something that we are sort of already used to when you think about it. And at this point I would like to apologize for my facetiousness and take on a more serious cybersecurity professional tone. As IT professionals, we that the vast majority of attacks originate in the internet browser, so why are we not isolating our users browsers? know To be fair, a lot of you will not have heard of a smoking hot new cybersecurity model ( ) called . according to Gartner browser isolation Browser isolation is a simple premise, it requires that you recognize where all the trouble comes from (the internet) and commit yourself to physically isolating that trouble away from the things that matter to you the most. You take the browser and all of the browsing activity associated with it and physically isolate it, away from your internal networks and IP. There are a number of ways to achieve this end, you could let your users log into a disposable virtual desktop that is isolated and hosted on a third party server, effectively using somebody else’s browser for web browsing. Its an effective way of isolating browsing activity, that we leveraged almost , but unfortunately not very scalable and hugely expensive. a decade ago Virtualization is not particularly well suited to handling browser compute loads, its at scale and needs too much infrastructure. too expensive Luckily there is more than one way to . isolate a browser cost effectively If we are serious about protecting our users, we need to wake up to the fact that the browser is broken and start treating it like it is toxic. We all need to start physically isolating our browsers, its really the only effective way to stem the vast majority of malware, ransomware and cyber attacks from affecting the vast majority of everyday internet users. Until we recognize that the browser is broken, that it causes most of our cybersecurity problems and treat it accordingly, our dependence on the browser will continue to put us at the mercy of malware like Wannacry. I work with tuCloud and use the tuCloud Safeweb Engine to physically isolate my web browser and browsing activity in a cost effective way. I also maintain their competitor list of browser isolation vendors here on the Index.co website .

The Browser Is Broken | It Lets Monsters Look Back At You Through The Window

Let’s analyze 320 Gigabytes of open source SQL code to determine if we should use trailing or leading commas. Popularity is not enough — can we determine which style leads to success? Proposed SQL style guide: Prefer opening lines with a comma when needed. Don’t go and change all of the existing code just to comply with this rule. : Writing SQL code with leading commas is efficient — but enforcing standards just for the sake of it kill those efficiencies. Hypothesis Can I prove this? Background Many programming languages (C, Python, JavaScript, , …) will allow you to leave after the final element in a list. But others won’t, like SQL (or the JSON format). This has lead a vocal minority to advocate in favor of a dreadful practice: . Go a trailing comma Start new lines with a leading comma, in the name of efficient code writing and change management Would you prefer SQL code formatted like this: # trailing commas
SELECT name,
  company,
  salary,
  state,
  city
FROM `employees`
WHERE state='CA' or like this: # leading commas
SELECT name
  , company
  , salary
  , state
  , city
FROM `employees`
WHERE state='CA' Let’s bring the data Luckily we all have access to terabytes of . There is a huge table with all of the available extracted code — and your first step should be extracting only the code you are interested in, before performing further analysis. open source code ready to be analyzed in BigQuery To get all of the code inside “.sql” files out into a new table: #standardSQL
SELECT a.id id, size, content, binary, copies,
  sample_repo_name, sample_path
FROM (
  SELECT id
    , ANY_VALUE(path) sample_path
    , ANY_VALUE(repo_name) sample_repo_name
  FROM `bigquery-public-data.github_repos.files` a
  WHERE PATH LIKE '%.sql'
  GROUP BY 1
) a
JOIN `bigquery-public-data.github_repos.contents` b
ON a.id=b.id This gives us a table representing a total of 2 million SQL files out of GitHub — more than 320 GB of code! I left an improved public —so you can skip this first step. copy of this table in BigQuery First approach: Count number of lines, files, repos My first approach using data backfires: Findings: There are 50 million SQL lines that end with a comma, while only 1.4 million begin with one. There are 329,308 unique SQL files with trailing commas, while only 18,312 have leading ones. There are at least 72,506 repositories with SQL files containing trailing commas, while only 3,360 repositories with leading ones. There are way less projects and files using them. Summary: . Leading commas lose the popularity race Side note: There are also 5,647 SQL lines in 1,029 files that have commas at the beginning and the end. At least 360 repositories allow these monstrosities. Second approach: Incorporate success metrics Losing the popularity race is not the end of the road. We need to ask ourselves: “ ” Which projects are more successful ? How do we define success in GitHub? Number of stars? Number of stars last year? Number of stars this year? Number of active users? General activity levels? How about all of that! The rules: Each repository gets one vote, regardless of number of lines or files. Files present in many repositories get assigned to the one with most stars. Repositories will get assigned to one of four groups: Only leading or trailing commas, no commas at the start of end of a line, or a mix of both styles. These are my results: What we see here: . Most projects (at least 69,665 repos) show only trailing commas at the end of SQL lines. 571 repos show only leading commas, and 2,847 use a mix of both styles. Only a small percentage of projects enforce leading commas, many more allow a mix of styles, and the majority only trailing commas In average mixed style projects got 29.37 stars, 11.73 people involved, and >150 events during this year. In comparison SQL comma trailing only projects have 13.06 stars, 5.49 people involved, and less than 50 events this year (so far). Projects that allow a mix of styles show the most success. as the mixed ones, but still seem to do better than the only trailing ones. Projects that enforce leading commas don’t show as much success — comparing the total number of stars, the stars during 2016, and the stars, people, and activity during this ongoing 2017. The trend is stable throughout the years Query #standardSQL

WITH comma_lines_per_files AS  (
    SELECT sample_repo_name, sample_stars_2016, sample_stars 
      , REGEXP_CONTAINS(line, r',\s*$') has_trailing 
      , REGEXP_CONTAINS(line, r'^\s*,') has_leading
      , line
    FROM `fh-bigquery.github_extracts.contents_sql`
      , UNNEST(SPLIT(content, '\n')) line
    WHERE line LIKE '%,%'
    AND LENGTH(line)>5
), stats_per_repo AS (
  SELECT sample_repo_name
    , MAX(has_leading) has_leading
    , MAX(has_trailing) has_trailing
    , ANY_VALUE(line) sample_line
    , ANY_VALUE(sample_stars) stars
    , ANY_VALUE(sample_stars_2016) stars_2016
    , (SELECT COUNT(DISTINCT actor.id) FROM `githubarchive.month.2017*` WHERE sample_repo_name = repo.name AND type='WatchEvent') stars_2017
    , (SELECT COUNT(DISTINCT actor.id) FROM `githubarchive.month.2017*` WHERE sample_repo_name = repo.name) actors_2017
    , (SELECT COUNT(*) FROM `githubarchive.month.2017*` WHERE sample_repo_name = repo.name) activity_2017
  FROM comma_lines_per_files
  GROUP BY sample_repo_name
)

SELECT COUNT(DISTINCT sample_repo_name) repos
  , IF(has_trailing, IF(has_leading, 'both', 'trailing'), IF(has_leading, 'leading', 'none')) commas 
  , ROUND(AVG(stars), 2) avg_stars
  , ROUND(AVG(stars_2016), 2) stars_2016
  , ROUND(AVG(stars_2017), 2) stars_2017
  , ROUND(AVG(actors_2017), 2) actors_2017
  , ROUND(AVG(activity_2017), 2) activity_2017
  , STRING_AGG(sample_repo_name ORDER BY stars DESC LIMIT 3) top_repos
FROM stats_per_repo
GROUP BY commas
ORDER BY repos

repos commas stars stars17 actors17 activity17 top_repos  
571 leading 22.99 7.36 10.04 39.89 drone/drone,aspnetboilerplate/aspnetboilerplate,HazyResearch/deepdiv2847 both true 29.37 6.44 11.73 156.63 apache/spark,begriffs/postgrest,mybatis/mybatis-3  
5933 none false 20.05 4.8 7.57 54.43 ajaxorg/ace,zulip/zulip,fivethirtyeight/data  
69665 trailing false 13.06 3.22 5.49 43.68 Microsoft/vscode,rails/rails,kubernetes/kubernetes Bibliography . Dan Nguyen asks about SQL formatting on Twitter ’s to answer. Elliott first data attempt . Reddit discusses early results . Go forces a trailing comma . More SQL analysis over the GitHub repos in BigQuery Next steps Want more stories? Check my , , and subscribe to . And — every month you get a full terabyte of analysis for . Medium follow me on twitter reddit.com/r/bigquery try BigQuery free Some coders like it hot — but most prefer colder climates Counting uniques faster in BigQuery with HyperLogLog++ 400,000 GitHub repositories, 1 billion files, 14 terabytes of code: Spaces or Tabs?

Apache

First Data

Winning arguments with data: Leading with commas in SQL?

As a CEO, your biggest leverage is in . In fact once you cross the early stage of a company, the two most important (and frequent) things you end up doing are — decision making and communicating. So, if the decisions you take can make or break your startup, how do you take the right decisions? decision making Basis my over the last 5 years, I have realized there are 3 key attributes of decision-making learning how many lives it touches, till how long will it affect, does it significantly impact the key metrics etc. Impact — — both in terms of gathering the data you need to make that decision and once decided the effort that goes into execution Complexity — if you end up taking the wrong decision how easily can it be undone, if at all. Reversibility While you are evaluating each decision against these 3 parameters, your ultimate goal is to optimize for the following 2 things — right decision taken quickly > wrong decision taken quickly > right decision taken slowly > wrong decision taken slowly. Yes speed is important, a wrong decision taken quickly is actually better than a right decision taken slowly. That’s because, theoretically no decision is completely irreversible (other than altering life form). So even if you take the wrong decision, you can reverse it quickly. And since you don’t really loose something by making mistakes (you learn and become smarter for next time), a wrong decision quickly reversed is a better than a right decision taken slowly. Speed that — if we keep the obvious situations aside where the right choice is obvious (like whether to jump in front of a speeding car), in most of the situations any decision can turn out to be right if executed with conviction. That’s because the correctness of the decision cannot be determined at the time it’s taken but at the time it’s fully executed. So if you have complete conviction, your execution is bound to drive success. Conviction fuzzy real life The overlay of the 3 parameters — impact, complexity and reversibility can be demonstrated by the Venn diagram below. The circle of impact means a high impact decision, that of complexity means high complexity and that of reversibility means low reversibility. Decision Making Though there are various sections in the diagram, one can broadly divide them into two — low impact and high impact decisions. Let’s start with low impact decisions. Low-impact Decisions If you are in a role where you have to make a lot of decisions, as much as possible, delegate the low impact decisions. If you can’t delegate these decisions then replace decision making with process. Define a process such that you don’t have to expend mental effort every time a repeated low impact decision is to be taken. In the low-impact segment, let’s first look at decisions that fall in category — these are which are and have . A good example of this is — which house-keeping service to use for your office. The decision is complex because you will have to meet a bunch of agencies, get their quotes and then finalize one — this can take up to weeks. It’s has low reversibility because once on boarded you will take at least 6 months before you figure out it’s not working out and then the selection process starts over again. But this is a low-impact decision because house-keeping service is a fairly common thing. There are enough good service providers and though it’s important to have a good service (it’s hygiene), having a great one is not a game changer as the upside of a great housekeeping service is fairly limited. C low impact decisions complex low reversibility Hygiene decisions are not really high impact decision because I believe the impact of a decision is determined by the upside that it creates. So as much as possible possible, delegate these decisions. And if you are not able to do that then optimize the decision for velocity over anything else. low-impact, high-complexity , low-reversibility There are 2 other types of decisions in the low-impact section — and . For the former, reversibility is high so take a quick decision and reverse if you are wrong. For the latter, complexity is low so quickly gather the facts and basis that choose the best available option. My strong advice is — ‘ ’. If you can find out the best practices or if someone has already done this before, just follow in their footsteps. Remember these are low impact decisions, so the upside of taking an A+ decision will not justify the time wasted for it. high-reversibility, high-complexity low-reversibility, low-complexity Don’t reinvent the wheel High-impact Decisions Though one should still optimize for velocity in decisions, I would not recommend rushing through them. Also, in many cases optimizing for conviction can be more important than speed. Let’s look at various decisions that fall in this section. high-impact The first category is decisions that fall in section — . There are not a lot of decisions that fall in this category because generally low reversibility decisions are also high complexity. However, an example is, what electives to choose in college. I call it high impact because the electives you choose can come in fairly handy later in life. They can open up alternative career paths or help develop a different perspective to your core job. These are low complexity decisions because one can combine common wisdom with innate interests to identify a useful list of electives. However, where we generally go wrong in these decisions is to not think through them properly. For instance, students often miss out on the good electives because they are too lazy to enroll for them early. The risk here is not that you will take a blatantly wrong decision, that’s unlikely as it’s low complexity decision but by not thinking through one is highly susceptible to making a sub-optimal choice and missing out on a potentially large upside. So the idea here is to optimize for the upside. A high impact, low reversibility but low complexity The second category is of decisions that fall in section — . An example of this is — you came across a customer who has an interesting use case but the product does not support it. If it works, there a lot of upside but you are not sure if it’s worth the time and effort (the complexity is not in taking the decision but executing it afterward). I have seen most of the companies taking these decisions extremely fast when they are small but as they grow they slide into analysis-paralysis. Since the decision has high reversibility, you can always shut it down if it doesn’t work. In fact in 9 out of 10 cases you will end up reversing the decision — shutting down the experimental product/feature. But it’s not about the 9 wrong decisions but about that 1 right decision that creates the . As you optimize for velocity in these decisions, it’s ideal to reduce the complexity as much as possible — reduce the scope of the experiment or figure out a simple execution strategy. You also want to optimize a bit for conviction because you don’t want to end up in a situation where you are firing up experiments and shutting them down whimsically. The most ideal way to take these decisions is B high-impact, high-complexity but high-reversibility can be high upside take the decision quickly but spend time in defining the success of the experiment — what should happen that you can say this was a great experiment. Define a few objective criteria that can be easily measured for success. commit a certain time to it. You know it’s not going to be successful overnight so commit a minimum amount of time and measure the success criteria during it. There are only 3 outcomes — success, failure & can’t say. What to do in the first two is obvious. In cases where you can’t say, if you still have high conviction, extend the time by some reasonable amount and evaluate again at the end. If you still don’t have an answer, I wouldn’t recommend extending any further. document the decision making — why you took that decision, what factors you considered etc. This will help you for future decision making. Another example of decisions that fall in section is when there is complexity in taking the decision itself and not so much in execution. Let’s say you haven’t used PR as a marketing strategy and you want to try it out. It’s a reversible decision because you will typically start with an external PR agency and move it in-house only if it works — so if the agency doesn’t work, you can reverse your decision. Also if the agency fails in demonstrating success, it’s likely that that outcome will be no different if you try this in-house. B This decision is because you not only have to identify and on board the right PR agency, you also have to ensure that you have the right internal systems to leverage the agency work. Here the decision to try out PR should be fairly quick (you will be surprised by how much people think about such high impact, highly reversible decisions). But you do need to spend good amount of time in execution. high-complexity There is simple way to get these things right — don’t reinvent the wheel. Seek someone who has already done this and follow their advice. Toughest Decisions Of all the decisions that you will have to take, the toughest ones fall in section — and . It’s not going only going to take you time to take these decisions but once taken it’s also difficult to reverse them. These are the kind of decisions where I would optimize for . Because in the course of decision making, even though you will collect a lot of data, do significant amount of research and take multiple opinions at the end you will have to do . Decisions like buying a house, getting married or significantly changing the strategy of your company fall in this category. D high-impact, high-complexity low-reversibility conviction over velocity what you believe in We went through a situation where we had to significantly change the strategy of the company, it wasn’t a complete pivot but a quite consequential change. For 4 years we had been a community first business and then one day we decided to be an enterprise SaaS company. This was going to have a far-reaching impact on the company. It meant all the teams had to be redistributed, a few product product lines had to be killed, couple of low-key business models had to be shut down, some roles would become redundant and most of the folks had to be re-trained. And to top it all, everyone in the organization had to be re-aligned to a new company mission. The impact was colossal! You just can’t move fast on decisions like these and you rarely take these decisions in a point of time. The thoughts for such decisions are seeded in your head much before you consciously start thinking about them. Once you make up your mind, comes the stage of research. You have to engage in extensive research — mining through your data, doing competitive research, going through third party reports and public data and most of all speaking to tons of people. The most important thing in such decisions is to have a What that means is that you have complete clarity on and , even though you may not know or . fixed-desired-end-state-condition. where you want to be why how when With this north-star metric, this non-negotiable outcome you start mapping a) where you are today and b) what are the possible ways for you to be where you want to be (a mind-map is a great way to chart out something like this). As you create this mind-map, collect detailed data for every point on the map and objectively evaluate how each point aligns with your fixed-desired-end-state-condition. Though it’s important to have a time limit on any decision one should deliberately go slow on these. That’s because, not only you will have to do extensive research but more importantly you have to build a rock-solid conviction about the decision you are going to take. As you go through the mind-map, day after day, discussions after discussions, slowly it becomes clear what decision you have to take. And gradually the decision will sink into you. This is a high impact decision that you most probably may not be able to reverse, so whatever you decide, you not only have to live with but also enjoy and evangelize (at least in case of a strategic change because you need to go out their and convince internal and external stakeholders). So unless you are completely bought on, this decision is bound to fail. If you use the above Venn diagram to classify your decisions and optimize them for velocity and conviction, you will realize that in large majority of situations it’s not so much the inherent complexity in decisions but the complexity that we create by not being objective and by over-thinking things. Most of us tend to put high-impact decisions in the section when they really belong to other sections. For example, people ask me how I was able to leave my plush, high-paying job at Google and plunge into the uncertainty of a startup with absolutely no prior experience. 99.9% will put this decision in , and section_._ Though it is high-impact and maybe even high-complexity, it’s definitely not low-reversibility. If it doesn’t work out one can always go back to a corporate job, maybe at even better financial terms. We even reduced the complexity by deciding that we will not startup unless we have capital sufficient to sustain us for an year. Then it was all about finding an accelerator/angel investor who would help us startup. We essentially moved the decision from and to and I have written about this in more detail . D high-impact low-reversibility high-complexity low-reversibility high-complexity high-reversibility low-complexity. here The whole point of the above matrix is to help you move decisions out from section . D In addition to the above, there are a few other learning that I have had: You make a few great decisions by making a lot of wrong decisions Great decision making cannot be learned theoretically, it can only be practiced. We often underestimate the role of sub-conscious mind in our decision-making. The human instinct, the gut-feeling, that we have all found to be extremely useful in critical situations is not a mental skill that exists from birth, instead it gets built over a period of time. It is the manifestation of continued learning of human mind and it resides in those part of our brain that our conscious self cannot call at will. The only way to hone our instinct is to be put ourselves in a lot of decision-making situations, to consciously take the best possible decisions with information at hand without fretting too much about being wrong. And though most of the times you are going to be wrong, as you are consciously thinking while taking a myriad of decisions, our sub-conscious mind is identifying patterns hidden in seemingly unrelated data-sets and hard-wiring them in our mind. So when next time you come across a similar situation that you may have experienced in some form in the past, even though you are not able to recall the exact situation, your instinct is able to match the patter and point you towards the right decision. Don’t reinvent the wheel I have probably said this statement a couple of times in this post because I can’t stress enough on this. 99% of the times, the decisions that we take have already been taken by someone else. Most of the human lives are not very different, for what you are going through there are probably millions of folks who have gone through the same situations. So it’s really common sense to go out there and seek folks who have done similar things in past and learn from their success and failures. Thought it’s seems obvious people rarely do this. Maybe it’s because taking decision gives us a sense of power, so saying that let’s do what 5 other great people before us have already done doesn’t sound that impressive. Or maybe it’s because we are so drunk by our own decisions, that we don’t want to know that we can be wrong and hence we don’t seek other people’s counsel. Or whatever else may be the reason, one things is fairly obvious, we individually know far far less than what all of us know together. What I have done to effectively seek counsel from other people is to have 2–3 folks as my mentors (who I feel are smarter than me) and every time I come across a tricky situation, I will quickly pick their brains. It doesn’t matter whether I take their opinion or not, at least it gives me another perspective. to maintain a running list of sticky situations that I have come seen in the past. Whenever I come across someone who is an smart in a particular domain I ask them a bunch of questions from that rolling list. Reduce the number of decisions you make This is not contrary to my first point. In the beginning it’s all about putting yourself in as many situations as possible and taking more decisions. But over a period of time as you mature, your value is not in taking a lot of decisions, but taking as few decisions as possible. As you create a system where you try and reduce the number of decisions you take, the following happens: you start empowering others to take decisions, hence eliminating a single point of failure (you) and adding more reliability in decision making process you create processes that ensure that majority of decision making doesn’t take a hit if you are not available you allow yourself to by ruthlessly asking yourself if you really should be taking this decision do less you cut through the noise to identify those decisions that are most critical and you focus your complete energy on them — your output will be significantly better Decision making is more of science and less of art. You rigorously collect data, you take a lot of decisions, you document your decisions and learn from the mistakes and you seek advice from people smarter than you.

BUNCH

Velocity

How to make (right) decisions

This is another post inspired by my recent visit to Rio and dialogue at the ABRATES conference, where translators were eager to engage with MT in a meaningful way, and asked many questions about where the most interesting translation challenges were. In several conversations about “the translation market” I had a very clear sense of how there really needs to be a larger perspective on what this means, as the most interesting opportunities with MT tend to lie outside what is generally understood as the translation industry. For most of the people who attend “translation industry” and localization conferences, the most trusted description of the industry is the market that Common Sense Advisory (CSA) describes as the . This is a market that is estimated by CSA to be $43.08 Billion in 2017, with Lionbridge and the largest language service provider (LSP). provides a clear description of what the CSA market definition covers. globally, measured by total revenue. Here is the CSA market summary that shows geographical concentration of the industry. Language Services Market A market where translation agencies provide translation, localization and interpreting services to buyers for a fee. proudly claiming to be a “perennial list-topper” Their PR piece This link lists the Top 20 LSPs another view of The following graphic looks more closely at what the focus of the LSP Translation industry is, and we see the kind of content they focus on, and the tools and skills most relevant to addressing translation of this type of content. Thus, project management is the core business function and the most important tools are TMS systems and TM. While some LSPs do use MT, it is generally not a mission critical tool. MT is used if the LSP is able to pull together an MT system that improves productivity and reduces costs, and is largely reactive i.e. often because the client insisted. But, it is important to understand that the focus is still on the same kind of content shown above. The translation industry has mixed success with MT, and maybe a few systems do become integral to the overall translation production process. But most do-it-yourself LSP MT initiatives fail or wallow in a kind of confused and isolated geekdom with mediocre results. The MT experience that Jost and other translators describe in blogs, described as PEMT, MpT, MT+PE etc.. is presented as the great evil by IAPTI, or horrid commoditization of the work of translation by many others. Most often they are working with MT systems at arms length, and have no ability to steer or guide the MT system development to make it more useful. Hopefully, the notion of Moses-as-instant-magic is now widely understood as a limited success strategy, and the more savvy enterprises and LSPs leave it to experts, who also struggle to meet these consistent high quality output goals. MT systems that consistently produce excellent output are the hardest to develop, so it is somewhat ironic that those that understand the least about how the technology works, try and build the most capable and efficient MT systems. Good MT systems will always take time, expertise and articulate linguistic feedback to develop. However, I think the new that Lilt is producing has a very bright future with smart LSPs, and provides a platform to transform the MT experience into a much more predictable and worthwhile endeavor and will also allow translators to be much more engaged and involved in steering the MT system. Adaptive Dynamically Learning MT Though the “translation industry” MT experience is mixed, I would argue that MT has been responsible for driving revenue or definable economic value in a variety of non-traditional scenarios, on a scale that dwarfs “the translation industry” as defined above. Interestingly, the most successful implementations of MT are done by global enterprises who often still work with LSPs for the static structured content, but for the higher value unstructured dynamic content are largely choosing to do it themselves (sometimes with some expert help) or build internal teams to address what they see as a long-term and strategic need to enhance international business initiatives. It is useful to consider some case studies of these strategic MT initiatives by enterprises, to understand this better. The graphic above shows the volume of words that Google translates every single day with their MT systems as reported at Google I/O in April 2016. To put this in context, I saw a Lionbridge presentation a few years ago, where the CFO said they translated just over a billion words that year (2009). SDL who is probably the most MT savvy and active with MT LSP, recently claimed they are through MT. . It also gives them very specific intelligence on what matters to people across the world and what cross language content is the most sought after. The economic value of this knowledge is significant, and hidden in the advertising revenue they report. This knowledge of what matters across the globe is something the “translation industry” and SEO experts would love to know. doing 20B words per month So, it is quite possible that Google alone, translates more words a week than the whole “translation industry” does in a year When one considers that perhaps over 90% of Google’s revenue (~$78B/year) is generated from advertising linked to key words, it is quite possible that Google derives tens of billions of dollars from their MT technology initiative! is another example of high value derived from MT. Their initial entry into MT was like Google related to search, but additionally they had a massive knowledge base in English for their software products that was difficult for their substantial global customer base to efficiently access. Thus, while Microsoft probably spent hundreds of millions on “translation industry” services for static content, this only covered a tiny fraction of what they needed to translate. Given that Microsoft gets as much as 70% of their revenue from non-English speaking countries, translation of all kinds of product related content is important. The software industry measures the value of self-service content by something called deflection cost. So, if they can deflect a call to the support center, by making more knowledge base content available in more languages, using MT, they can save possibly as much as a $100M+ per day given the size of their user base and actual volumes of knowledge base access. Add maybe another 50B words/day that their Bing MT does for the random internet user, and we have another stream of economic value coming from search words that generate advertising revenue across the globe. Their recent Skype STS initiative also will likely yield great benefit and new ways to monetize their translation technology expertise. Making more technical support and customer care content rapidly multilingual was an imperative for executives who cared about the customer experience, and also generated huge savings in support costs and dramatically improved the user experience for the non-English speaking customer. When you consider that both Intel and Adobe also use the Microsoft Hub MT to translate knowledge base support content, the deflected cost savings impact is easily worth hundreds of millions of dollars a day. This is not even considering the many other IT companies doing this on their own using other MT technology e.g. Symantec. The “translation industry” has a very small footprint in this kind of translation activity,which is now often considered mission-critical and probably involves several billion words per month. The online eCommerce market is another example of economic value generated by competent MT efforts that is off-the-books of the “translation industry”. that emerging economies were a huge opportunity worth strategic attention. So and built . Based on presentations they made at the AMTA 2014 conference it was clear that there was from their initial efforts to to make more Russian content available. It would be safe to say that the value of the impact is probably in the hundreds of millions of dollars of new revenue, from all the new markets that they have been addressing using MT. It is also really worth taking a look at what is involved in doing this. We should note that most competent MT efforts of any scale, move carefully, one language at time rather than trying to do 20 or 30 in a single go. We also see that Amazon acquired Safaba in 2015 and possibly have similar plans to make catalogue content multilingual to drive bigger volumes of international business. Alibaba and Baidu also have eCommerce focused MT efforts well underway but fewer details are available. The net economic value of all these type of MT initiatives: Probably in excess of $20B per year by my estimates. EBay decided some years ago they acquired MT technology a competent MT team that had astrong linguistic collaborative component in the team a huge growth impact in the Russian market It takes focus on solving new kinds of translation problems and making sure the translation problems you solve do enhance the value of your MT efforts. This last link shows the special issues related just to Brazilian Portuguese. very rough Recently Facebook surprised the world by announcing that after using the Microsoft Bing MT technology for several years. When asked why they did this Alan Packer said: Scale is one reason Facebook has invested in its own MT technology. The other reason is adaptability, they wanted technology that was optimized for their very specific needs. Facebook is now serving 2 billion text translations per day. The problem they had with Bing they claimed was, it was built to translate properly written website text and did not do well with the slang, metaphor and idiom typical in Facebook comments. Packer described Facebook language as “extremely informal. It’s full of slang, it’s very regional.” He said it is also laden with metaphors, idiomatic expressions, and is riddled with misspellings (most of them intentional). Additionally, as in the rest of the world, there is a marked difference in the way different age groups communicate on Facebook. They know that already 50% of Facebook users regularly use auto translation. This user group will only grow as more people come online. Packer says that access to the translation product leads users to “have more friends, more friends of friends, and get exposed to more concepts and cultures.” . The economic value of this is probably . Emerging social networks that are global will need to address the same problem. they have a substantial MT effort underway The more people across the world that Facebook users can connect with, the longer they’ll spend on the social network, and the more revenue-earning ads they’ll see several billion dollars a year Solving large-scale translation problems using MT is apparently a very high value proposition, and Probably because it is very clear to any strategic observer at these companies, that most LSPs lack the vision, skill, interest and competence to solve these types of translation problems. We can perhaps even generalize the core requirements for a larger set of global enterprises as shown below. There is a real mismatch in terms of skills and focus between the broader translation needs of global enterprises and the service focus of the “translation industry”. While the static content will likely remain important as a mandated requirement, it is not where long-term corporate value is built either for the enterprise buyer or the LSP in my opinion. So what we see is that a select few companies are generating more economic value from solving very specialized and much more challenging translation problems than the whole gross revenue output of the “translation industry”. none of the global enterprises mentioned above considered going to the “translation industry” to help solve these really challenging and complex translation problems. To illustrate this further let us consider the investor sentiment on value that can be gleaned from stock market data. While this might be a stretch of logic to some, . Facebook has seen a huge growth in mobile ad revenues and recently, and so these Market Value/Sales numbers reflect very active market trends. The investor sentiment is that Facebook is probably better poised to gain $$$s from the next wave of internet adoption than any of the companies listed in the chart as they climb beyond 2B users, very few who speak English or French or German. Contrast this with the investor sentiment for large LSPs, surely, it has something to do with long-term promise and potential. To me this suggests that investors in general view the LSP focus as lower in value but understand that translation can produce huge leverage in the right hands. I think we can fairly assume that investors value solutions to certain kinds of translation problems more than others it seems that they are taking ad share away from Google As one analyst says: “Advertising budgets are moving towards Facebook, and it seems to be a winner in the online advertising world with measurable results.” So to those wonderful translators at ABRATES who asked me what kinds of MT projects to get involved with, I would say the following: Focus on companies who are solving interesting translation problems. They will have the most rewarding work and it might involve stepping out of the translation industry. Stay away from LSPs who sell the Moses Mirage, this is likely to be the worst PEMT experience. MT systems that don’t want translator feedback at a pattern level are not likely to be a professionally satisfying experience. Work with people (LSP/Enterprise) who allow and want you (translator/editor) to provide feedback and interact with the MT development process. Learn about Machine Learning and AI in other domains, and develop skills with Regex, Corpus Analysis & Corpus Editing and Pattern Identification skills to be considered valuable. Explore Adaptive Dynamic Learning MT like Lilt (maybe others will appear soon) to understand how MT can work with you and for you while you wait for the right opportunity. This is truly a paradigm shift that is worth at least some experimentation to see how the translator desktop could evolve. Ease up on the need to have everything on the desktop. The future of Machine Intelligence solutions will require big data and big computing, so the best and most sophisticated tools will by definition only be available in the cloud. Lilt is a first generation example of this, others are coming. The cloud makes sense and allows new, more effective ways to solve old problems and is not a bad thing. And for those who think the four companies above are the exception rather than the rule, it is worth noting that we are just beginning with what is possible to do with Machine Learning and Artificial Intelligence. Neural MT is just beginning and could drive a whole new wave of higher quality and more adaptive MT. The is still nascent and we will very likely see big data + big computing + smart algorithms come together, to solve problems that we thought were beyond the scope of computers just last year. Machine Intelligence market Originally published at kv-emptypages.blogspot.com on July 26, 2017.

eBay

Intel

The Larger Context Translation Market

Why not both in one? Headless or Coupled (database-driven) CMS? You’ve probably heard about this mess before (there’s a lot of articles on the internet) and want clarification on what CMS software to choose and especially in which case. The last one is the main point: your choice completely depends on what’s your content for. CMS Headless CMS Headless CMS — content system that assumes only content layer, without representation layer. You create and organize content for later delivery to your website, mobile app, anything else. management Therefore, pros and cons obviously will look like this: Pros: Separation of content and its presentation Independency from presentation level: choose any frontend serving technology you like — static website generators, plain HTML and JS, web frameworks Single place for your content: use it on any number of websites or mobile apps Developers like APIs — not an obvious advantage, but makes sense because not every developer likes to learn special templating language Cons: You need one more layer to be managed somehow — presentation (so you probably need infrastructure: version control, web server, etc.) Isolated costs: CMS itself payment, developer’s job payment, infrastructure payment likely More “expensive” developer: pretty clear that developer should be more qualified and will spend more time Could take time: you need to learn API, integrate with it, debug and test Coupled CMS Coupled CMS — content managing system that handles both layers: content and presentation. These are old-school players like Wordpress, Drupal or similar. The idea is pretty similar — your website should be completely served by one system. And here pros and cons for such type of CMS: Pros: Solid system: content and its presentation (HTML) coupled together Clear costs for website development: one system — one account — one payment Low entry threshold for developers Quick result: “API” already tested and integrated, you’ll see changes immediately Cons: Dependency on presentation layer: possibilities are limited Website-only content (in case of API absence): you can’t use the same content in mobile apps of somewhere else Learning for developers: they would prefer favorite language over special one As you may notice, some pros of first are cons for second and vice versa. Depending on your business tasks and the list above you can decide which one of these CMS types to choose. So these systems look like counterpart for each other. What if just to combine benefits from both eliminating all disadvantages by the way? Sounds interesting for me, and may be a good reason for researching and implementing in . APIQ CMS What do you think about this possibility and does it make sense for you? This article was originally published on the APIQ CMS blog .

Headless CMS Or Coupled CMS

The automotive industry is one that, for decades, has been on the opposing side of a treacherous battle for environmental health. However, with and many others dedicated to the eco-friendly world of green business becoming leaders in the automotive industry, it is no surprise that the manufacturers, fuel companies, major cities, and scientists of our world have now begun to work hand in hand with the auto industry to create a brighter future and greener world, one step at a time. Elon Musk However, with so many parts of the auto industry being influenced, three rarely recognized aspects of the industry’s involvement in the green initiative are may make a far larger impact than you may think in the long run. Therefore, by reviewing these three elements, we can see just how the auto industry is making a difference and what this will mean for our world and our future generations overall. After all, every road less traveled is bumpy at first, but, after a few passes, even the rockiest of roads will form a path ahead. 1)Green Production The manufacturing of cars has been one aspect of the auto industry where green business practices have been lacking for years now. However, in the last five years, car manufacturing has made a significant transition into the green initiative by incorporating far more recyclable materials into car production, choosing fuel alternatives that allow companies to reduce their fossil fuel intakes, and making car parts that are overall more reliable and eco-friendly. When it comes to more recyclable materials that save fuel economy, we can quickly look back on my previous article on . Because aluminum is so lightweight and malleable, this means that it can be used to manufacture any car, reduces the fuel intake of said cars, and also is easily recyclable likewise. Although cars can not be completely comprised of aluminum for safety concerns, it is estimated that, by 2025, cars will be comprised of roughly 550 pounds of aluminum. This will ultimately lead to a far more efficient, cheaper, and more environmentally friendly mode of transportation that can be quickly recycled and redistributed likewise. aluminum and its impact on the auto industry Furthermore, in the case of fuel alternatives, it is clear that many car companies have begun to turn to electric power and various other forms of fuel so as to reduce their carbon footprint and the sheer amount of oil used daily by the American population. In fact, going back to aluminum, a new is said to be capable of 1,000 miles gas-free before needing to be recharged. With this said, not only would this reduce the need for fuel drastically, but it would also save time for the average American and reduce the amount of times in which an individual finds themselves stuck on the side of the road without gas. On top of this, to reduce this risk even further, it is said that there will be quick-charge devices which individuals will be able to purchase to quickly give their cars a boost, even when there are no charging stations nearby. revolutionary aluminum-air battery Lastly, the parts a car needs can often be comprised of materials that are not easy to recycle, wind up sitting for decades in a junkyard, and break easily after a few years worth of use. Therefore, many car part companies have joined the green initiative by simply providing parts materials that are eco-friendly, recyclable, and durable. For instance, currently, by using durable green materials. This allows for the average consumer to purchase green tires that are durable for the same price, if not less, than other non-green alternatives. tires are going eco-friendly In the end, the manufacturing portion of the auto industry has truly embraced the green message and instilled this initiative in every part of the car production procedure. However, this is far from the only thing the auto industry has done to help reduce the carbon emissions and negative environmental impacts it has created over the years, and, perhaps, its help within the urban communities of our nation are truly where they shine. 2) Lowering Urban Temperatures With a myriad of scientists and the auto industry backing them, various urban communities have begun to paint their massive asphalt streets completely white in order to reduce the amount of heat built up on city streets. In fact, the despite Trump claiming to want to curb the laws protecting the environment. Although it may not seem like much, doing this has been proven to which not only helps the environment by providing a temperate city life where vegetation can survive once more but also by reducing how many individuals turn to air conditioning for relief from the exhausting heat. auto industry titans say they’re still committed to cutting emissions significantly reduce the heat levels of the city The truth is that air conditioning devices both in cars and homes , which builds up in our atmosphere and destroys our ozone each and every day. By reducing the heat in a given city, you can reduce these carbon emissions drastically. You can also help improve fuel economy since the rubber of the car tires will no longer stick to the hot asphalt causing drag which actually significantly lowers your fuel economy over time. Lastly, you can reduce the amount of cars on the road as well since people will be more apt to choose a bike or walking if the weather is permissible. emit outrageous levels of carbon So far, it has been proven that these white streets can actually reduce the temperature of a city by over , which means that record heat could quickly be comparable to a slightly warm day. With this said, we could reduce the amount of cars on the road, increase vegetation, encourage alternative forms of transportation, and reduce the amount of air conditioning units being utilized on any given day for nothing more than a large amount of white paint and some dedicated workers to apply it. However, just as it is important to stop existing conditions before they get worse, the auto industry has also begun to take preventive actions likewise that could help us rid ourselves of issues before they ever even occur. 44 degrees fahrenheit 3) Supporting GPR Risk Assessment Initiatives For those that are unaware of what GPR is, ground penetrating radar ultimately gives scientists a picture of what’s beneath the earth’s surface. However, the are truly what makes it so interesting to the auto industry and scientists nationwide fighting the environmental crisis. environmental applications of ground penetrating radar The reason for this is because of the fact that GPR allows scientists to assess landfill limits, map the extent of contamination plumes, and determine the direction of contaminant migration as well. Because of this, scientists are able to recognize when contaminants are affecting our environment and determine exactly how to solve these issues before they become serious concerns. Furthermore, this allows the auto industry to recognize where they need to recycle the most so as to reduce the amount of cars found in landfills and reduce the sheer each and every day. From there, the auto industry can begin to recycle older cars in a more effective way, transform these cars into new, aluminum-prominent cars, and create a future of cars that is far more recyclable than ever before. amount of carbon emissions these landfills create In the end, the auto industry is one that has truly recognized the faults in its ways and made a change for the better. As each step in the right direction is taken and each aspect of the auto industry receives a new, green look, the consumers of today slowly become the testers of the products of tomorrow — and the rocky road less traveled slowly becomes more and more reliable as each day passes.

Nationwide

Tesla

Three Ways the Auto Industry Is Responding to the Environmental Crisis

App and API Security That Tastes Good Used properly, is a simple and effective security tactic to minimize attack surfaces. If you’re not on the list, you don‘t get in. No exceptions. Smooth as chocolate. If it’s too easy for you to find and spoof a name on the list, use to make it harder. Sticky as peanut butter. Together they taste great. whitelisting indirection App Whitelisting A whitelist is a list of the only entities allowed to access a particular resource. Each entity is identified by one or more identifiers, such as user id, ip address, port number, or API key. It is important that these identifiers specify unique entities and that these identifiers cannot be easily mimicked by other entities. If the list of allowed entities is small and slowly changing, then maintaining the list is quite practical. For example, if you provide a health care mobile app which communicates with your back-end services through an API, then your authorized app whitelist consists of released and approved versions of your mobile app. Versions can be added and removed from the list as features are added and retired. API calls will only be permitted if they include an app version’s identifier which is on the whitelist. Apps often make API calls to a variety of different services. What makes a good white list identifier? Google Maps Android API To use the , you must register your app project on the Google API Console and get a Google API key which you can add to your app. From a web page, you make a call to the map service appending YOUR_API_KEY: Google Maps API center=Brooklyn+Bridge,New+York,NY&zoom=13&size=600x300&maptype=roadmap&markers=color:blue%7Clabel:S%7C40.702147,-74.015794&markers=color:green%7Clabel:G%7C40.711614,-74.012318&markers=color:red%7Clabel:C%7C40.718217,-73.998284&key= https://maps.googleapis.com/maps/api/staticmap? YOUR_API_KEY It is very common to use a static API key to stand in as an app or developer identifier, but how safe is it? There are two basic types of attack, reverse engineering the app code to find the API key, and observing the API key in transit during an API call. On a web page, finding the API key may be as simple as looking at the page source in your browser. In an Android app, Google suggests placing the key in the manifest file, but that is easy to read by . Even though the Google maps API call uses HTTPS, if you can mount a , you can directly observe the API key being transmitted. decompiling the APK Man-in-the-Middle attack You can try to , but that only slows down a determined attacker. For the Android maps API, Google recommends restricting access to the signed app’s fingerprint, but this is ultimately just a second static key to determine, more difficult, but not impossible. hide API keys through obfuscation or encoding API Gateways David Wheeler is often quoted as saying So if hiding static API keys is hard, why not move them off the app and behind a proxy server which can indirectly make the calls for you? “All problems in computer science can be solved by another level of indirection.” With this configuration, a client app makes an API call without the API key, and the proxy server redirects the API call, appending the appropriate API key. The key is not stored in the app, nor is it ever transmitted between client and proxy. That’s a good start, but have we really gained anything? Although we’ve removed the API keys from the app, now anyone can call the proxy, unless, we create a new app whitelist for the proxy sever, which means a new static identifier, which we’ll call the shared app secret. Sounds like the same problem all over again. However, most apps make API calls to multiple 3rd party services. At least the API keys for all these services can now be secured behind the proxy. This makes the security of the single app secret all the more critical, but now all the API services can be centrally managed. API keys can be updated separately from the apps, and usage can be centrally logged and rate limited. Most commercial and open-source API gateways provide best practice implementations of these features. App Authentication Services Let’s try one more level of indirection for that remaining shared app secret. This time, we delegate identification of the authentic app to an external service. The app secret is known to both the API proxy and the authentication service but is never directly shared with the app itself. Instead, if authentication succeeds, the app secret is used to an app authentication token which is returned to the app. The app then passes the token to the API gateway with each API call. Using the app secret, the API gateway verifies the token signature before redirecting the API call, along with the appropriate API key, to the 3rd party service. cryptographically sign Though the secret is static, a token needn’t be. The lifetime of the token can be very short lived by giving it an expiration time, limiting the number of times it can be used or both. This way, if a token is somehow stolen, its value is quite limited. As each token expires, an app can request a new authentication and receive a fresh token. Further, the authentication service itself can evolve over time, improving authentication strategies and/or adding additional secondary identifiers to the token. Attesting the app identity periodically and returning time-limited tokens are big benefits of indirection over static identifying keys. A Practical Implementation At CriticalBlue, we have combined whitelisting with indirection to build the app authentication service for mobile apps. Using Approov, only authentic and authorized apps can call your back-end APIs. Approov You first drop the Approov SDK into the app to enable communication with the authentication service. Next, you register your app with the authentication service which enables strong app attestation and generates the app secret shared between the service and your back-end server or API gateway. To see it in action, you can download and try an for Android or iOS. For more detail, you can follow a showing how to remove all secrets from an app using both an API proxy server and an authentication service. app demo Hands On Mobile API Security tutorial Combining an app authentication service with user authentication services such as / greatly reduces the attack surface present with user authentication alone. OpenID-Connect OAuth2 Android may have its treats, but for app and API security, whitelists and indirection are their own taste sensation. Thanks for reading! I’d really appreciate it if you recommend this post (by clicking the ❤ button) so other people can find it.

Transit

Whitelists and Indirection Go Together Like Chocolate and Peanut Butter

Every year computers ease deeper into our everyday lives. Traffic lights and water pitchers pack tiny processors to form an entire internet of things. Moore’s Law continues to forge more portable power as computers have migrated from our offices to our homes to our pockets. As companies plan what’s next, some look to tablets like Apple’s iPad or Microsoft’s Surface Pro as the heir apparent. Pay no mind. The future of personal computing is not about subtracting ounces from a device. It’s about dividing objects by identity. The future of personal computing is personalized computing. “When we were an agrarian nation, all cars were trucks, because that’s what you needed on the farm. But as vehicles started to be used in the urban centers, cars got more popular…PCs are going to be like trucks. They’re still going to be around, they’re still going to have a lot of value, but they’re going to be used by one out of X people.”  -Steve Jobs, 2010 That metaphor continues to unfold. Carmakers will soon see their core business model swing from private car ownership to subscription access to a suite of transportation options. Technologies like Tesla’s Self-Driving capability and Uber’s tiered ride sharing platform are accelerating this transition from private transportation to personalized transport. A similar shift will occur as people migrate from owning personal computers to accessing personalized computing experiences. The change is afoot. Network speed, hardware availability, storage size, and security the key levers. Link NYC Hardware Availability Desktops, laptops, and tablets will become more ubiquitous. Offices, cafes, , , , and will continue to put computers in front of us to work, buy, and navigate the world around us. Increased access to capable computing will reduce the need for us to supplement our phones with additional devices. libraries airports malls cities OneWeb satellite constellation Network Speed & Ubiquity . This will allow all internet devices to remain perpetually online. With always-on Gigabit internet, data packets can criss-cross the globe almost instantly. Near-field networking protocols are also becoming faster and more reliable with every iteration. The world will soon be blanketed in reliable, high-speed internet Storage Size The NAND flash memory found in most high-end devices stores more and more data into a smaller and smaller footprint. Apple Watch, for example, has an 8GB chip. It won’t be long before it can hold 128GB. Security + robust encryption will attempt to make transferring information safer. Be it a fingerprint, retina, or DNA, the addition of biometric verification will allow us to securely send data to devices near and far. Biometric security At your best, you are Voltron. Voltron Condense these advancements into the most efficient package and you will see a tablet is not ideal. A watch is. It is more affordable, packs the networking, local storage, and a biometric sensor in a format that leaves both hands free. Imagine a watch with enough storage for your computer settings and passwords. Approach any computer while wearing your watch, verify that you’d like to use it, and boom, your personal computer is unlocked. Your settings, cloud based files, media, and services are ready. Network drives have been available for decades. Most major research universities provide each student with login credentials that summon a personal profile and documents onto any campus computer. Multiply that by 1,000,000. Log into any computer, public or private, and you can temporarily transfer your personal computing assets in the time it takes a modern Mac to boot. As you work, all files and changes are saved back to your watch. Log out and leave no trace. Your computer goes where you go. Culture Shift Service vs Product There’s a larger economic trend playing out today. The shared economy is partially a rejection of the value of private ownership. The Netflix and chill generation has sent shockwaves across business. See Spotify & Hulu (Entertainment), Harry’s & Quip (Personal Care), Office 365 & Adobe Creative Cloud (Productivity), Zipcar & Lyft (Transportation). Still, even with Uber only a few taps away, many New Yorkers still own their own cars. Likewise, some people will continue to own private computers. However as our watches and phones become more powerful, large-screen, high-powered computing will become a service not a product. Personalized Computing A portable device with local storage, high speed networking, and biometric security that can safely store and disperse all of our data means you never have to fill out another form, carry a metro pass, or worry about cancelling a credit card. With a flick of that wrist, you can provide your health history and identification. Double tap your steering wheel and transfer your license and registration without a word. Dab an ATM to remove cash without typing a pin. All of your data is hardware encrypted to your unique device and verified by your biometric signature. Any outward facing information is just an alias. Your driver’s license, debit card, insurance, gym membership, health records, Netflix subscription, addresses, metro passes, all stored securely and backed up to the cloud. But, not the cloud we’re used to. Verifiably You The barrier to the next stage of personal computing is not technology. The barrier is trust. When personal information is sold or hackers compromise Visa, Google, or world governments, the public loses faith in digital systems to manage personal information. For the next stage of personal computing to take shape, we need a system that engenders trust. For some that could mean bringing all of their data onto their personal device. But, what happens when that device is damaged or destroyed? Enter . Instead of using a series of passwords (account numbers, pins, and liscenses are essentially passcodes) on remote servers entrusted to sometimes unreliable agents who verify each transaction, data is stored in encoded cryptographic “blocks” that live across a network of publicly verified ledgers. Any attempt to interact with these blocks requires device-level two-factor authentication and digital signatures. So, Bank of America does not store your data on a private server where it is in danger of manipulation, fraud, or human error. There are not passwords to keep up with because your fingerprint matched to your physical device is the only password you need. Blockchain The Next Wave With every major change, computing has stepped closer to the individual. We can easily forecast a future where computers will exist as chips implanted into the human body. When you consider that, a tablet appears much closer to a desktop than any future computing shift. In fact, the largest clue that tablets are a red herring for the future of personal computing is how ardently tablet makers have worked to make them . Due to the assymetric maturity of the key technologies (blockchain, ubiquitous high speed networking, storage miniaturization, biometric security, hardware availability), the complete solution will also bypass handhelds altogether. So the next time Tim Cook proclaims that the future of personal computing is the iPad… more like their predecessors

HackerNoon Tech Stories Archive July 26th, 2017

@CyberStudio.ioLena and Oxana from Cyber Studio

@samayshamdasaniSamay Shamdasani

@benschacBenjamin Schachter

@antonkorzunovAnton Korzunov

@azamsharpMohammad Azam

@maskupappMaskUp

@CraigSwannCraig Swann

@andrewwidjajaAndrew Widjaja

@mohitmamoriaMohit Mamoria

@chanakyabhardwajCha

@ontobornOntoborn Technologies

@ontobornOntoborn Technologies

@jorge.sernaJorge Serna

@codepo8Christian Heilmann

@uday.marepalliUday Marepalli

@rgujratiRitesh Gujrati

@jordangonenjordangonen

@RisingStackRisingStack

@bfeldBrad Feld

@panjganjVahid Panjganj

@NuCypherNuCypher

@jacquesgiraudelJacques Giraudel

@guisebuleGuise Bule

@hoffaFelipe Hoffa

@sachingupta006Sachin Gupta

@kvasheeK Vashee

@igor.petrovIgor Petrov

@samanthalee1440Samantha Hager

@skiphSkip Hovsmith

@AbdurRabbAb

@CyberStudio.io
Lena and Oxana from Cyber Studio

@samayshamdasani
Samay Shamdasani

@benschac
Benjamin Schachter

@antonkorzunov
Anton Korzunov

@azamsharp
Mohammad Azam

@maskupapp
MaskUp

@CraigSwann
Craig Swann

@andrewwidjaja
Andrew Widjaja

@mohitmamoria
Mohit Mamoria

@chanakyabhardwaj
Cha

@ontoborn
Ontoborn Technologies

@ontoborn
Ontoborn Technologies

@jorge.serna
Jorge Serna

@codepo8
Christian Heilmann

@uday.marepalli
Uday Marepalli

@rgujrati
Ritesh Gujrati

@jordangonen
jordangonen

@RisingStack
RisingStack

@bfeld
Brad Feld

@panjganj
Vahid Panjganj

@NuCypher
NuCypher

@jacquesgiraudel
Jacques Giraudel

@guisebule
Guise Bule

@hoffa
Felipe Hoffa

@sachingupta006
Sachin Gupta

@kvashee
K Vashee

@igor.petrov
Igor Petrov

@samanthalee1440
Samantha Hager

@skiph
Skip Hovsmith

@AbdurRabb
Ab