Source: https://www.microsoft.com/en-us/microsoft-365/blog/2017/11/13/how-organizations-are-connecting-their-on-premises-identities-to-azure-ad/ is the de facto gatekeeper of Microsoft cloud solutions such as Azure, Office 365, and Enterprise Mobility. As an integral component of their cloud ecosystem, it is serving roughly 12.8 million organizations, 950+ million users worldwide, and 90% of Fortune 500 companies on a growing annual basis. Given such a resume, one might presume that Azure Active Directory is secure, but is it? Azure AD Despite Microsoft itself proclaiming “ ” as the of their security strategy, if you were to tell me a week ago that Azure or Office 365 was vulnerable to rudimentary attacks and that it could not be considered secure, then I probably would have even laughed you out of the room. But when a client of ours recently had several of their Office 365 mailboxes compromised by a simple brute-force attack, I was given no alternative but to question the integrity of Azure AD as a whole instead of attributing the breach to the services merely leveraging it and what I found wasn’t reassuring. Assume Breach guiding principle After a simple “ ” search on google and without even having to write a line of code, I found that I was late to the party and that Office 365 to and attacks via (RPS). It was further discovered that these vulnerabilities are actively being exploited on a broad scale while remaining incredibly difficult to detect during or after the fact. Skyhigh Networks named this sort of attack “Knock Knock” and went so far as that as many as 50% of all tenants are actively being attacked at any given time. Even worse, it seems as if there is no way to correct this within Azure AD without consequently rendering yourself open to (DOS) attacks. Office 365 brute force is indeed susceptible brute force password spray remote Powershell estimating denial of service Source: https://cssi.us/office-365-brute-force-powershell/ In fact, this sort of attack is so prevalent that it happens to be one of the biggest threats to cloud tenant security at Microsoft according to ( ) and is among several reasons that Microsoft itself advises their customers to enable multi-factor authentication (MFA) for all users and implement advanced available only to E5 subscription levels or greater; basically requiring companies to give Microsoft more money to secure their own solutions. But MFA also doesn’t impede hackers from cracking passwords or protect businesses from a DOS attack nor does it help those that are unaware of its necessity as many tenants are at present. Mark Russonivich CTO of Azure threat intelligence Source: https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/mfa-connect-to-exchange-online-powershell?view=exchange-ps Further and since RPS does not work with deferred authentication (DAP) and MFA, partners consisting of consultants, managed services and support providers also use their partner credentials to connect to the tenants of their clients via RPS for advanced administration and scripting. Even though they can easily manage their clients via a browser-based admin center with MFA, they often have to resort to creating admin accounts within Office 365 tenant itself instead, but others do it simply for ease of access to the admin console or for when they are not the Partner On Record. In turn, these accounts are precisely what many of these attacks are targeting, often unbeknownst to admins, and is a perfect example of such a scenario. cannot Deloitte’s breach Unfortunately, these accounts are often stripped of MFA security to make them more convenient and accessible for the multitude of support and operations staff to use while working for various companies offering support services and they seldom change upon company exit or expire. By default in Office 365 and on top of being vulnerable to being cracked and breached, the password expiration policy is further set to a , rendering accounts vulnerable to a prolonged breach at that. Needless to say, they are ripe for attack and this exact scenario is what enabled a hacker to have unabridged administrative access to Deloitte’s Exchange Online tenant for 6+ months. 730-day expiration and further disabled Complicating matters even further, the natural solution to this problem renders the tenant vulnerable to DOS attacks by virtue of being able to lock users out of their accounts for a fixed duration imposed by Azure AD; but this is still in preview phases. For example, by default (Preview Stage), which is still in preview, is configured to allow 10 password attempts before subjecting the account to a 60-second lockout, giving attackers a theoretical limit of 14,400 attempts per account/per day. You could decrease the threshold to 5 and increase the duration to 5 minutes protect against breaches, reducing attempts to 1,440 per day, but this would create the potential for downtime for users whenever their accounts are being attacked with brute force and password spray attacks. Azure AD Smart Lockout Source: https://cssi.us/office-365-brute-force-powershell/ However, at CSSI also called out that Microsoft doesn’t seem to throttle or limit authentication attempts made through RPS. As shown, Tyler was able to surpass the theoretical 14,400 per day limit listed in Azure AD Smart Lockout Preview without added logic, moving at a rate of 48,000 per day had he let it run for a 24 hour period or an est. 17,520,000 attempts over 365 days. However, there are obvious ways to optimize these efforts even further through via ( cmdlet) by essentially running attacks asynchronously instead of synchronously while optimizing for custom lockout limits, max attempts, and minimal detection. The possibilities are endless with regard to password spray attacks for obvious reasons. To be fair to Tyler and CSSI though and in my opinion, they didn’t need to leverage such measures to validate their concern. Tyler Rusk background jobs start-job If their lockout feature were to work though and if you were able to reduce the threat surface in the manner above, you would then have to contend with the hard countdown of the duration time. It’s immutable which means that users have to wait for it expire in order to render the account accessible again. The unlock cannot be expedited administratively at present. As such, it can just as easily result in an intentional DOS for end users if they or an unintentional DOS while running the possibility of exposing the attack; that is when/if it starts actually working. Obviously protecting from breach takes precedent over downtime, but becoming prone to DOS attacks is hardly a consolation prize. Banned passwords nor MFA cannot protect against DOS or brute-force attacks either, only against the breach itself. In fact, when brute forcing an account protected by MFA, the MFA challenge itself can be treated as confirmation of a valid cracked username and/or password. In turn, they can then begin to try these credentials in other places which may not be protected by MFA as users and admins alike tend to keep them as similar as possible in multiple directories so that they’re easy to remember. I’ll defer to Ned Pyle of Microsoft as to whether this applies to his employer and their partners. Summarizing matters thus far, you can brute force accounts housed in Azure AD used via RPS. Obvious solutions for this such as MFA, customized password blocking, and advanced threat intelligence are either ineffective, insufficient, paywalled, and/or generate significantly more overhead in order to offset these vulnerabilities. Further, these solutions are often ignored by lazy admins, consultants, and managed services providers and many may be oblivious to this threat entirely; possibly even to breaches of their own. Deloitte has proven that this can even hit the best of them. As offensive as all of this may seem though, it’s important to remember that AD was never designed to be public facing, quite the opposite. It has actually always been inherently vulnerable to brute-force, password spray, and DOS attacks by design. AD has always been designed to be implemented in conjunction with various other counter-measures in order to maintain its integrity. This includes but certainly is not limited to relying on physical security measures such as controlled entry and limiting the ability to access the domain to those that make it past physical security measures successfully; with the obvious exception of VPN users. This is nothing new. That said, AD was never, ever, meant to be the sole source of security for IT infrastructure and is fundamentally dependent on other security measures in order to be effective. Consequently, AD becomes markedly more vulnerable when other pre-emptive methods fail or are non-existent. Put simply, such breaches should be the expectation when depending on Azure AD alone for IT security, and this sadly applies to any Office 365 tenant with its default security settings. However, understanding its limitations helps us illuminate ways to harden Azure AD and mitigate these problems just the same. It almost goes without saying, but none of the measures to necessary to patch these vulnerabilities are free to companies leveraging these services at present. Even if Microsoft were to fix this, who is to say that something else just as simplistic and embarrassing isn’t hiding around in the corner or already being used? That said, avoiding products backed by a 20-year-old security system streamlined for seems like a viable solution to avoiding this problem in the first place. vendor lock-in Source: https://www.microsoft.com/en-us/microsoft-365/blog/2017/11/13/how-organizations-are-connecting-their-on-premises-identities-to-azure-ad/ Before anything else, I truly think that the onus is on Microsoft to ensure that their baseline configuration for cloud accounts doesn’t expose their tenants unnecessarily. Sure, we could blame ignorant users and lazy admins, but I don’t think that this is fair given the scope of this vulnerability, which is essentially 46% of AzureAD’s user-base (password hash sync + cloud only = 46%). It is unknown how many have MFA enabled and the scope of this is ultimately an unknown both with regard to those who are vulnerable to it, actively being attacked, and/or those already breached though. But as a former tier 3 support engineer for Exchange Online at Microsoft, I can confirm that a significant amount of individuals as well as small-medium businesses are relying on Azure AD exclusively without further counter-measures and that they account for a sizable amount of Office 365’s user-base. That said, telling customers that pay you to secure their mailboxes to to address this doesn’t cut it. disable basic auth Presentation to Partners… Microsoft has clearly this problem, but rather than hardening their tenants from such attacks as other cloud services have, they have offered solutions only available to their high tier plans so as to capitalize on this problem rather than fixing it. As expensive as they are to migrate away from now, or as they like to call it, their products are just going to become more costly to manage, vulnerable, and difficult to migrate away from over time. This is the malady of any legacy solution. acknowledged sticky One easy way for Microsoft to mitigate such attacks is to update their RPS module to support DAP and develop other creative avenues for admins and the like to efficiently and securely manage their clients’ tenants. They should also extend their threat intelligence and advanced customizations available only to costly, high tier license subscribers to all license levels, at least until proper solutions are implemented for all tenant levels. As an immediate mitigation step though, Microsoft could simply swap the order of authentication. Rather than requiring a password prior to doing a two-step verification on your phone, they could require the phone verification through authenticator app or a third party MFA app such as Duo as the initial means of authentication. By deferring their password in Azure AD as the second step instead of the first, they could buffer its weak password security at present and buy time to implement a proper solution. However, this only applies to users and tenants with MFA enabled and in-use. Just as Active Directory seems to create necessity for other costly ancillary solutions, Microsoft seems to have built AzureAD to generate further necessity for more costly solutions coincidentally offered by them just the same. On top of this and if they had their way, their solution to enable MFA would also require employers to buy phones and mobile plans for two-step verification for all of their employees which can cost more on an annual basis than any of their plans.The same can be said of the costs associated with a proper MFA solution and/or an on-premises or hosted ADFS solution (if none exist) as they drastically complicate the solution as a whole while consequently inflating the ownership costs associated with it. As complexity increases, stability falters while costs skyrocket. All of which is why I recommend avoiding their solutions entirely. Source: https://blogs.partner.microsoft.com/mpn/create-stickiness-with-ip/ But if a company is entrenched with Microsoft products and migration is out of reach, there are options. One solution that companies can implement is which defers authentication attempts to your own domain controllers on-premise rather than Azure AD while immediately granting more granular control of password policies with Active Directory on-premise and as much protection as money can buy on the network layer. All of which can be quite costly from a licensing perspective alone, let alone the hardware, network infrastructure, and labor required to implement it all let alone the staff to maintain it. This creates a single point of failure, often on-premise, for a cloud solution unless implemented in a highly available manner though. ADFS They can also implement an MFA solution as well but there still remains added exposure and vulnerabilities which may require further consideration. But as mentioned before, there are also added costs and MFA may not protect accounts entirely. Users tend to manually synchronize their passwords across multiple platforms for the sake of remembering it, but not all of them have the same protections, MFA or otherwise. Similar to ADFS, access to your mailbox and other apps are restricted when MFA services are degraded, also becoming a single point of failure, as shown today by Azures . So if you go with an MFA solution, diversify with a 3rd party MFA provider. MFA outage While the existence of dirsync can do little to protect against brute-force attacks, enforcing a strong password policy including a customized banned password list on premise can be mirrored in the cloud. Customers with dirsync already pay for this functionality with Active Directory on premise and can simply have it be mirrored in the accounts synced to the Azure AD forest. Although this cannot protect from brute force, password spray, or denial of service attacks, it can absolutely harden accounts against prolonged breaches. I suppose they could also call support to complain about it and see if they’ll fix it, but you will likely be met by someone difficult to understand without experience on such matters. Or maybe they could even get a technical account manager to yell into the void or possibly even find someone with half of an ass on your behalf if you have deep enough pockets for a premier membership. While you’re at it, maybe you could upgrade your plan at almost double your monthly cost of E3 just to pay Microsoft to compensate for its own vulnerabilities. E3 plan to an E5 In summary, Microsoft services built on Azure AD along with the businesses leveraging them are vulnerable to brute-force and password spray attacks which can be carried out by anyone with the capacity to run a script in RPS. Also, there isn’t an adequate means of hardening these services without incurring significant financial burden and paying for more of Microsofts services. All of which has probably been the case for as long as the ability to access tenants via RPS has been widely available to admins and ultimately why you would be wise to assume breach with Microsoft cloud solutions just as Microsoft does. Entities can absolutely mitigate these vulnerabilities, but Office 365 and Azure would cease to function as true cloud solutions while generating significantly more overhead costs in the process. All things considered though, it seems as if there is no way to harden Azure AD or the services such as Azure or Office 365 when leveraged by itself without incurring significant costs in addition to the aforementioned introduction of further complexity, points of failure, and on-premise dependencies for your cloud architecture. By default , Azure AD is more of a security problem than a cloud. This is not to say that Azure cannot be made to be secure but it comes at a cost while sacrificing cloud resiliencies. Although they advise others to assume breach, Microsoft seems to be omitting this reality from Office 365 and Azure advertisements and such inconsistencies are indicative of this stance being more of a cop out than a tenable security strategy because of this. Rather than hardening the vulnerabilities inherent to Active Directory and Azure AD which makes them susceptible to some of the oldest tricks in the book, Microsoft seems to be attempting to capitalize on them instead while exposing those unaware to a haunting amount of risk.

Google

Microsoft

Target

Tenable

How Azure AD Could Be Vulnerable to Brute-Force and DOS Attacks

. I used these three product rules to find the biggest problem people have with documents. And I’ve solved it. Learn more about my new product FYI I had just built two products that didn’t work. Yes, two in a row. Back to back. Months of work, down the drain. I was licking my wounds from these two failures. And then something changed. After making those two (embarrassing) mistakes, we came up with to make sure we never made the same missteps again: three product rules Market size matters Innovate with purpose Solve big problems It’s one thing to have rules though. It’s another thing to actually follow them. Going after giant problems isn’t for everyone. It’s not easy. It’s not fun. And it’s very challenging. While doing customer to figure out what to do next for Draftsend, we very quickly identified the number one challenge people have with documents. But at first, we were afraid to go after it. development When there’s a huge market opportunity, it always looks like a scary opportunity. Maybe the challenges are really difficult. Or there’s a graveyard of other companies that all went after the same problem and failed. technical We had both of these challenges with . So naturally, the doubt crept in… FYI Why would we be successful where others had failed, time and time again? Before we moved forward on building the product, we had to make sure the market size was worth all the time and effort we’d have to put in to make sure the product was successful. How do you know when your market is big enough to go all in? After discovering the huge problem that FYI solves, we came up with three signs to look for to know that a market really is big enough. Everyone has the problem In some markets, it’s obvious that there are enough customers. Like social networking or search. Everyone who has an Internet connection on any type of device is a potential customer for Facebook and Google. When there are enough potential customers in the market, you’ll have an opportunity to serve millions (or even billions) of people and/or earn billions in revenue. If you’re looking for a massive B2B opportunity, it’s critical to answer “yes” to all four of these questions. Does it apply to everyone with a device? — Your goal is to determine if the problem you are looking to solve is so pervasive that everyone needs it solved. Does it apply across different types of markets? — Determine if people across different industries want this problem solved. Does it apply across different types of companies? — The problem should affect companies regardless of their size and maturity. Does it apply across teams? — Make sure that this problem affects people in Marketing, Sales, Finance and every other team in a company. These questions are simple and straightforward. The challenging part is to find a problem where you can say “yes” to all four of these questions. Those types of problems are extremely rare. If you aren’t able to answer “yes” to all of these questions, it means that you still have work to do in order to find a breakout market opportunity worth pursuing. Once you start building your product and prioritizing individual features, these questions also help you pick the right features. We use them to stress test FYI and every feature we want to add to the product, every day. When your features impact broad markets, they have huge leverage instead of only benefiting a small segment. The problem is getting worse The best problems to solve are a perfect storm of growth. They are huge on their own. But market conditions make them even larger. You want to look for market conditions that are amplifying the problem you discovered more and more every day. The problem should be getting fed by something that continues to grow on its own. For example, the growth of websites created the problem Google solved. And continued growth of new websites helped catapult Google into the giant it is today. People needed a way to find what they were looking for as the amount of websites available online increased. Web directories couldn’t keep up with the natural growth of the ecosystem. The rise of social media created the problem HubSpot solves, and it continued to fuel the problem. Marketers needed a way to manage the increasing amount of non-paid marketing channels they had to engage with on a daily basis. As new marketing channels came out, HubSpot was there with the perfect all-in-one solution. When you’re assessing a problem to see if it’s getting worse, you need to look for the trends that are creating the problem in the first place. It’s not just about the problem itself. You have to understand why people say they have the problem. Get to the root cause of the problem and make sure it’s getting worse. If the trends you discover point to a pain that is growing and not showing signs of slowing down, you’re onto something huge. No one has solved the problem The problem exists. And it hasn’t truly been solved by anyone. But they’ve tried. A graveyard of products in the market is a sure sign that others have discovered the problem in the past but just didn’t quite make it. That’s encouraging, as long as you have the first two signs covered with the opportunity you discovered. Just imagine if they had successfully solved the problem — you would be struggling against hordes of other companies to get market share. There might be some competitors who exist, but they haven’t actually cracked the code to the problem and don’t have enough customers to make a meaningful business. Solving a problem that no one has solved before doesn’t mean that others haven’t tried. It just means that they weren’t successful with their attempts. There are a number of things they could have done wrong, but that’s not important to focus on. Understanding why others have failed doesn’t help you determine the market opportunity. It only helps inform the right and wrong ways to create your solution. What’s important to understand is that when you talk to potential customers, they are telling you that their problem is not solved. Your goal is to identify if they have (or know of) a solution that they can use or buy. If not, this indicates not only that they have the problem but also that anyone else that has tried to solve the problem has not cracked the right solution yet. These three signs are exactly what we saw in the opportunity we are going after with FYI. The feedback has been rushing in, unlike anything I’ve ever seen before. We didn’t just imagine that the problem we are solving is the biggest one worth solving. We kept digging in, deeper and deeper to make sure it was. We kept going until we knew everything we could about the problem, why people have it and what they’ve been doing to solve it (and failing at). . Want to learn more about the biggest, most important problem we discovered in the document space? Sign up for FYI

Catapult

Facebook

Three ways to tell if you’ve found a breakout market

We live in a world that has walls and those walls need to be guarded by men with guns. — Aaron Sorkin If you loved technology at one point of time but now are unable to be up to speed on account of management responsibilities - If the word “Cloud” (strictly in reference to computing) gives you bouts of paranoia around aspects of security - If you are evaluating cloud proposals but with a lingering tinge of doubt around the security implications - Then Keep calm and read on During the course of my employment wherein, I am involved in the assessment of cloud migration proposals from solution vendors for a global banking giant, I have noticed that there is still a tinge of insecurity amongst the senior executive around cloud computing. First things first, cloud computing is nothing fundamentally new from the way computing has been done in the past. As per NIST — Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g. networks, servers, storage, applications and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. Five major attributes define a cloud based system viz- a) On Demand self service b) Broad network access c) Resource pooling d) Rapid elasticity e) Measurement of service So as we can see from the above widely accepted definition, there is nothing technically different in cloud computing which differentiates it fundamentally from its predecessor, on-premises computing. In other words, cloud computing is not something as fundamentally different as say quantum computing. So the natural question is — Should we worry more for security, in case of workloads hosted on public cloud ( like AWS) vs on-prem hosted workloads? Like all such questions, the response is also pretty standard — It depends. The reason it depends is that even though the underlying technology has not changed much but the toolchain in use is pretty new, the impact area ( though not due to cloud) is pretty large. This coupled with the fact that any outage to business is now magnified many times in the age of social media and high outreach makes security all the more important now. And as always its easy to pick on the new kid on the block. However, on the other hand providers like AWS have dedicated security teams who are highly specialised in InfoSec. So as a cloud services user, you are not alone. Before we go further onto AWS stack, let us get a few concepts off the table. Shared responsibility model I provide the resources , you do the job !!! AWS follows a concept called “ ” with respects to security which in essence demarcates the ownership of responsibilities between AWS and the customer. In essence it means - Shared Responsibility Principle We ( AWS) are responsible for security the cloud. OF You(customer) are responsible for security the cloud. ON A natural extension to the above philosophy is that the higher a customer goes in AWS stack towards managed services , more of security aspects will fall on the plate of AWS ( obviously with more cost implications). So in case of IaaS offering ( EC2 for example) , the user will be responsible for OS upgradation , security patching whereas for FaaS( Lambda for example) , he need not worry about these bits. Levels of management in AWS In all scenarios , there is a bare minimum set of security which lies with AWS at all times. This includes aspects like physical security of the underlying AWS managed infrastructure from threats like natural calamities , man made incidents , technical failures . Right from site selection of data centre( read region/Availability Zone) to staff access is controlled by AWS with well defined . policies Principle of Least privilege One important tenet of security is giving the least possible privilege required to do the given task to any user/process/task . AWS implements this principle in a very elegant manner by way of Identity and Access Management( )service . IAM Detective Controls These controls are used to identify various vulnerabilities in the architecture. It involves inventory management of all active / dormant assets in the account. Some common mechanisms used are — log analysis , integrating audit controls with day to day workflows. AWS provides a range of services for detecting potential security weaknesses in the architecture. AWS also provides guidelines to customer for a focussed . audit Defence in depth Defence in depth as the name implies is an IT security concept wherein multiple layers of security are deployed to protect the asset. Penetration testing AWS allows customers to carry out penetration testing. However it expects a prior notice to be given so as to ensure no inadvertent impact to their other customers who may be sharing the resources. The request for the same can be raised by logging in via root account. Encryption As per wikipedia is the process of encoding a message or information in such a way that only authorised parties can access it and those who are not authorised cannot. Encryption does not itself prevent interference, but denies the intelligible content to a would-be interceptor. In an encryption scheme, the intended information or message, referred to as , is encrypted using an encryption algorithm — a — generating that can be read only if decrypted. Encryption plaintext cipher ciphertext With so much of data passing and stored in cloud , the importance of encryption can not be emphasised any more. These are a few of my favourite things… 🎶🎶🎶 Controlled security groups, sensible IAM use. MFA on root account and CloudTrail logging — These are a few of my favourite things 🎶🎶🎶 Playing on the generic security concepts mentioned above , the next natural question is — how are these implemented in AWS ? Well the answer, like all things tech , is quite comprehensive. AWS has a gamut of services which can be used to ensure security and compliance. Below is a brief run down of of them and the role they play in securing your architecture. Given the way cloud computing is innovating at a rapid pace , more and better services in future are inevitable. few AWS console has a dedicated section for security and compliance. However there are some services marked under other heads which particularly intrigue me for security handling. Security services umbrella of AWS IAM (Identity and access management) This service is used to create users , groups , policies and roles via which access can be given to the AWS account. On account opening , there is an all-powerful root user account which as a best practice should not be used for day to day purposes. With this constraint , how do we have more users access the account on-need basis ? Well IAM is your man(or woman) for the job. The users created out of IAM can be given fine grained access controls to the various AWS services on need basis. can be aggregated into based on common attributes. This eases the administration of access rights. User defined policies can be created to create fine tuned specific policies. is a unique IAM entity which is used to grant access to other AWS entities. For example if an EC2 instance requires access to S3 , then the EC2 instance can be invoked mapped to the specific role which has S3 access. Role can also be used to provide cross-account access. Existing on-premises credentials can also be used by way of federation. Users groups Roles VPC (Virtual Private Cloud) Though tagged under networking head in all AWS reference literature, VPC (and its associated features) act as a very powerful way to control access to the estate. By way of efficient one can demarcate his IT resources based on the sensitivity of their processing. Not only does VPC cover preventive aspects of security but it also covers the detective measures by way of flow logs. are used to capture any incoming/outgoing traffic of the VPC. are used to control access to the resources at a level of protocol , port and source IP. These are just a few of the security aspects which VPC provides. No wonder this is one the most frequently used service for securing the estate. subnetting Flow logs Security groups CloudFormation CloudFormation is AWS’s interpretation of Infrastructure as a Code. Critics may say that this comes under the umbrella of management tools but a well made secure template is a sure hit recipe for a replicable safe architecture. An automated version controlled environment also has a less chance of having vulnerabilities due to manual oversight. Web Application Firewall ( WAF) and Shield Security group was mentioned previously as a feature to control access to the system. Security group however does not do any packet inspection. So a security group would let a malicious data packet enter the system as long as it originating from a permitted IP address and coming in via an accepted protocol. WAF provides the next level of security ( Defence in depth anyone) wherein it inspects the incoming package for malicious content. It provides protection on various aspects like source IP , packet content ( SQL injection, cross site scripting) to name a few. Shield is used to protect the account from DDoS attacks. There are two variants of AWS Shield — Standard and Advanced. Standard version is offered to all customers by default. Advanced variant can be invoked on demand. CloudHSM Organisations with strict security need driven by either business or regulators use hardware security module to manage their cryptographic keys. Hardware security modules as the name implies are dedicated hardware which is used to provide extra security. Since it is a dedicated piece of hardware , it handles security related aspects to a very high grade of efficiency.CloudHSM provides the same facility for users operating in AWS plane. Users with less stringent security needs can opt in for KMS ( Key Management Service) which is multi-tenant. Trusted Advisor AWS provides a resource which can be used to run tests over the AWS account to measure up the account against the heads of . These tests look up for common issues and informs the customer of the same. cost optimisation, performance, security, fault tolerance and service limits CloudTrail and CloudWatch CloudTrail is used to monitor all API calls so that any suspicious invocation can be flagged off. The logging which is done by this service can be used for audit/compliance purposes. Any logging of activity becomes all the more useful when accompanied with a robust notification system. CloudWatch fulfils this role with aplomb by giving user access to dashboards, billing alarms , logs and metrics for his entire AWS account. Config Config allows to keep a track of the configuration of all resources in a given AWS account. It also allows any changes in the account to be tracked. By way of AWS Lambda ( serverless service) any change in configuration can be checked against compliance needs to ensure they are in order. To summarise, AWS has a wide range of services aimed at providing security to its clients. The above mentioned list is just a small list out of the same. The computing paradigm is evolving and so are the services ( its feature sets and prices). Rather than standing in the sidelines and panicking ad-infinitum, customers should take small measure steps to get the immense benefit of cloud.

Flow

Amazon

AWS for the CISO — What you always wanted to ask but were too afraid of

The merits of blockchain to ’s mission Amber Video A few years ago it became clear that of video, in a way that looks indistinguishable from authentic video, was quickly approaching. When it does, it will have a serious impact on visual evidence and specifically our ability to rely on them for facts and to make judgements. A world where video is duplicitous will delegitimize even genuine visual evidence and society will veer to the negative aspects of tribalism to help decide what is their version of “truth”. Photoshop-ing Blockchains*, the cryptography-based technology that records transactions in a verifiable and permanent way, hold a lot of promise and will positively impact the Internet in years to come. But they are not solution to this problem: writing manipulated video data to a blockchain does not make it legitimate. (In fact it may validate fake video by writing it to a blockchain because the nascent perception of the tech is that a blockchain is a “source of truth” and by extension, the data in it is “truth”. No, the only perception should be that the data is unaltered being written to a blockchain.) the since But blockchains can be part of the solution. There are multi-stakeholder environments where aural and visual evidence are critical records for what occurred in the event of a situation. They can absolve and implicate and help neutral parties earnestly unpack what happened, weighing all the evidence, of which video is one important part. Manipulating video with ease. Take, for example, police departments (where officers wear body cams) and the numerous stakeholders that exist when a shooting occurs. These could include the officer involved, investigators, the person who was shot and his/her legal team, prosecutors, judge/jury, watchdog groups, the media, and the general public. Many of these groups serve as an important part of our checks-and-balances system: how can each of these stakeholders have confidence in the veracity of the video? More specifically, how can each of these stakeholders have confidence in the veracity of the video in a world where exploited video exists? Artificial intelligence technology known as deepfakes allows bad actors to create increasingly believable maliciously-altered video with decreasing amounts of technical knowledge needed to execute. Replacing politicians’ heads in pornography videos is a common stunt these days. When manipulating video, to make it realistically appear that someone said or did something that , becomes as simple as applying an Instagram filter, we should all be highly skeptical of the non-fiction media we consume. We should not automatically trust that a video is authentic and has not been altered — unless there is a proven technological solution. he or she had not A solution that incorporates an immutable chain of custody. Amber’s video authentication iOS app: . sign up A solution to the above law enforcement scenario is where videos are fingerprinted at the source recorder, the police body cameras. These fingerprints, or hashes, are written to an immutable ledger or blockchain from the recorder itself as most modern police body cameras have a wireless connection. As the video is downloaded from the device, uploaded to the cloud, clipped and shared, each event is written to a smart contract (a transparent agreement that is part of many blockchains). This creates an audit trail of the file and rehashing throughout the process to make sure the file’s integrity permeates. When the file is shared and played by a stakeholder, the fingerprinting process is rerun or rehashed, and the fingerprints are compared to the ones in the smart contract. Either they match or they do not match: it is binary. The video is authentic or the video has been altered. Which would you trust more: a) a file sitting on the cloud server of an organization with a vested interest in the outcome of a case, and within a system where numerous people have access privileges and whose security practices are opaque; or b) a file stored in a decentralized system, the permissions of which are transparent, and whose fingerprints — which you can independently confirm yourself — and audit history are readily accessible? As the stakeholders should have more confidence in the immutability of a blockchain than the security policies and practices of a biased party, the doubt in the legitimacy of the video will recede. A key premise of blockchain design is trust-minimization. It seeks to create a secure environment between people and things (like Internet-enabled devices) and allows third parties to confidently transact with each other. Even for the organizations and departments recording the evidence: they don’t want to be tarnished by false accusations and lies. They don’t want to be on the receiving end of a faked video that purports their officers committed a violation that did not actually occur and was antithetical to their mission. And arbiters, as well as society as a whole, will need to be skeptical of body cam and bystander videos being shared that don’t have a valid chain of custody. A frequent defense at future trials, if we haven’t implemented a solution by then, will be that ‘manipulating video is commonplace and the court system can’t trust the police or the prosecution as they are biased parties who recorded and held the evidence on their own insecure systems. Thus, the evidence should be thrown out.’ Defense lawyers may not even need to prove who supposedly altered a video: just the fact that fake videos exist will delegitimize authentic videos. Coupled with genuine questions of data integrity in centralized systems could be enough to dismiss video evidence. And without that video evidence, the case may get dismissed. There will be bad actors on both sides of a controversial issue, each intent on skewing public sentiment in their favor. Bad actors will distribute faked videos via social media’s echo chambers, hoping it will spread, create controversy, generate outrage, and catalyze upheaval. We must not allow this to occur. We need the right technologies, system designs, and incentives to prevent this. Evidence-based conclusions have been critical to the advancement of societies. Regressing to negative aspects of tribalism to make judgements will chip away at democratic institutions. We can’t stop rapidly advancing technology and the people intent on wielding it for malice from creating fakes but we can prevent their impact. By securely fingerprinting video at the time of recording and tracking those hashes through to distribution, a major source of doubt among stakeholders, when fake video is prevalent, will be removed. When bad actors manipulate video and distribute them online to sow chaos, reasonable people, guided by the pursuit of facts, will be able to confirm the legitimacy of a video and then focus on what actually transpired in a recorded scene. And blockchain technology is one important technology in this process to create trust minimization (vs. trusting vulnerable systems), combat video manipulation, and preserve due process. To sign up to try Amber’s video authentication iOS app: https://itunes.apple.com/us/app/amber-video/id1358190681 To find out more about Amber Video: https://ambervideo.co *Note: there are many companies creating blockchain technologies, each with their own specifications and features. Not all blockchains are secure. Assume in this piece that the blockchain used is secure and immutable, as is the vision for the Bitcoin blockchain technology, the original blockchain which many others are based on and inspired by.’

Chain

Apple

Instagram

How blockchains can and can’t be used in authenticating video and countering deepfakes

Getting started with the MDN documentation Firefox? Source Mozillas Developer Network boasts the best Javascript documentation on the planet. What I didn’t know was that it’s community driven, and anyone can contribute to it. I’m amazed how they’ve managed to keep the docs so pure, given anyone can edit things. What I also didn’t know is that it’s the best place to build up credibility as a developer. Yes, that’s right. You can be a part of the documentation. You can get your name etched on the internet. Here’s how to begin. The first part is knowing you’re allowed to, and encouraged to contribute. I had no idea about this, and I feel this is the major restriction. People don’t know you can do this. The next part is contributing. The official MDN guide is a treasured resource. Getting started on MDN Here are the main points: 1. Don’t be afraid to make a mistake There are others to clean up after you. The process works something like this: You edit a page. Next, the maintainers look at your changes (they are easy to revert). If you’re not confident of the accuracy of your changes, you can ask for a review. This can be — a technical or an editorial review (or both). The technical review checks the technical aspects — are your code samples correct, are you using the correct APIs, etc. The editorial review checks your grammar. The place to ask for a review is at the bottom of the page you’re editing. ( Found at the bottom) 2. Use the sandbox While you don’t have to be afraid of making mistakes, please don’t test the editor on a live page. This sandbox exists to help you figure out how the editor works. When you open it, it might look different — as more people try it. Feel free to mess with this page as much as you want. 3. Follow the style guide This can be a pain to get through. Like all code you write in a team, the style guide helps maintain readability. Like every style guide, you don’t start knowing every rule — you get the basics and learn the rest as you keep going. The most basic rule to stick with is to use the predefined formatting for the editor. It has the style guide built in. See the and boxes below? note warning Further, there’s a . Almost all pages look the same, because they follow the same structure. This gives immense power to the documentation: you know exactly which part of the page to look at, when looking for something specific. Like the style guide, this doc is massive. document structure Document structures Again, start small, look at a few existing documents, copy them and edit as you deem fit — you don’t have to start from scratch. 4. There’s a plethora of things you can do! ( duh, that’ s what we’ve been talking about) Write documentation There’s more though. If you don’t want to write documentation, you could: to your own language Translate the documentation Write code — work on , the wiki platform Kuma File documentation bugs Soon, you can end up like this This is the bit . And just like that, my name’s forever in Mozilla’s Developer Wiki contributors. I worked on Feel free to reach out for help to get started! Enjoyed this? 👏 Don’t miss a post again — subscribe to my mailing list!

The Sandbox

Mozilla

Visit the blog for more cool stuff

Read My Stories

How to Get Noticed in the Javascript World?

Twitter

How to get noticed in the Javascript world

I’m working together with teams from multiple locations and creating our quarterly roadmap has been a drag for years. We’ve used Google Sheets which is great for creating tables but is very bad for effectively plan and visualize our roadmap. For Q3 I had the chance to participate in a beta version testing of ’s new Advanced PI planner. As we’ve been already using for our standups, retrospecives, story refinement and team NPS tracking, so we gave it a try. Scrumile Scrumile Planning The planning when pretty smoothly for all our teams. Here is the process we’ve been following for the this part of the quarter: We had several missions that the teams could choose from, so we gave 2 hours for all the teams to sort out the missions between themselves the most effective way they could find. It amazed me that the teams even switched team members to be able to ship the missions faster. After all the teams had a mission, every team sat down and spent the remainder of the day on understanding the mission better. We did user-story to epic mapping and came up with the Epics. On the next day every team started to break down the epics into stories with user-story to story mapping. As our release train goes to production after every sprint all teams made sure to organize the epics and sprints so that they’d deliver something meaningful in every 2 weeks. Throughout these two days teams worked together with other teams on identifying potential dependencies between them. Scrumile’s PI planner supported our planning days pretty greatly with online real-time editing of a roadmap. We’ve added epics, size and description and dependencies between them. Tracking the quarter As we all know a plan always sounds good but then reality hits in. Thankfully Scrumile’s PI planner has a nice integration with JIRA where we could track our progress against our plan. It shows if we’ve finished early with an epic or we’re delayed with one. Image from https://www.scrumile.com With this visual aid we were able to make those hard decisions way faster than we did in the past. We’ve loved the Advanced PI planner by and we’ll definitely use it in our upcoming quarters. Scrumile Phil. T

Effective online Agile Roadmap planning

Throughout every metro-city today, you can find a burgeoning blockchain community. is affecting every major industry, not only technology, but economics, politics, and society. Countries, territories, and states are using this as a chance to find their new identities. are vying to become the main “blockchain country”, , and other countries like , silently maintain dominance in the space . This renaissance movement Estonia and Malta Puerto Rico is being transformed into a Crypto Paradise China despite heavily publicized bans and regulations This series of articles will focus on different cities and the communities within. Each will highlight projects, events, services, and personalities that are uniquely shaping each local landscape. At the end, I hope that this series has shared enough from each community so next time you are in town, you’ll know who to look up and where to hang out. ranked at in 2017, but that isn’t a fair representation of . One of the the largest Chinese blockchain projects, , is based there, and a flurry of nonstop innovation has continued in its wake. With a , close proximity to other major blockchain hubs (Seoul, HongKong, Singapore), and to fuel business development, . Shanghai number 10 for ICO activity how vital the city is in the blockchain world NEO strong talent pool local government initiatives Shanghai is quickly cementing its dominance in the blockchain scene Primas — World’s First Truly Decentralized App is a Decentralized Trusted Content Protocol (DTCP) for . Created for High quality content producers, Primas is “a movement to bring quality, credibility and accountability back to the internet”. By using a related to images, text, audio, and video, the Primas protocol is able to ensure protection against plagiarism and piracy. This is essential to “bringing about an overall better and healthier Internet prioritizing quality over traffic” Primas publishing and verifying the authenticity and ownership of content proprietary rule set for examining and storing metadata upgrade to the WWW protocol With an avid interest in technology from a young age, spent much of his youth reading Western literature and repairing computers. Working at Lenovo in 2013, he lead product development for a new web browser; this is where he met fellow geek and big data expert, . Together, their team used AI to push credible content to users, but found in how information was distributed across the Internet. Things such as , thus generating more money for platform providers and perpetuating this system. Seeing credibility as a growing issue in an increasingly virtual world, . Primas CEO Wupeng Primas CTO Gan Lu actual content quality played a minimal role clickbait, fake news and plagiarized content yielded disproportionate volumes of traffic the pair looked for a technical solution and Primas was born If there is one epidemic in online content we are all familiar with, its fake news. , photos depicting hoards of Hondurans and Mexicans on buses were used to stoke fears of immigration ahead of the November election cycle. In all of the cases, the , often times completely unrelated, and dating back as far as 2012. As recently as 2 weeks ago photos were recycled from previous news events _A group of Hondurans heading toward the United States has been the subject of misinformation on social media. A group…_www.nytimes.com Debunking 5 Viral Images of the Migrant Caravan “I was an early adopter of the Internet, witnessing its evolution from a once magical place for creatives and the sharing of information, to it’s current state, a place filled with (often deliberately) misleading information and low quality content being driven by a few privately motivated players” . With the Primas Protocol, , as every image used in the network is detected. This same system not only protects against fake news, but says Wupeng fake news can’t be faked as easily also prevents plagiarism and piracy. Team Primas Today, . Users can and use it to read and publish high quality and fully protected content. for uploading their original articles, videos and images to the network, while their favorite content with their friends. As of writing, the , putting the . Primas stands as one of the few blockchain projects with a fully functional product and growing user base download the application for iOS and Android Publishers get rewarded Primas Tokens (PST) readers can also earn PST for rating and sharing PST token is valued at $0.21 market cap of Primas Token at $11 million Primas also is sharing their protocol with other projects. , other blockchains can benefit in connecting to Primas nodes, that can be operated by anyone staking enough PST tokens. by providing a secure and robust content network, . As a layer 2 solution This benefits the entire Dapp ecosystem protected from censorship and piracy As with any content ecosystem, getting new user adoption is the most critical component to growth, and Primas has started this cycle with a across the world. . popular ambassador program You can find more details about the program here Learn more about Primas at and join the conversation on www.primas.io Telegram DropChain — the new kid in blockchain logistics One of the areas of intense focus and research in the blockchain industry is supply chain logistics. has created a that seeks to solve the “systemic lack of transparency in global supply chains”. from the farm or factory to the consumers shopping cart, DropChain will be able to gather data points of what happened at which point and when. Pairing this data with the blockchain will create a publically accessible ledger for consumables, that will be able to DropChain gamified supply chain tracking system By incentivizing the different participants in a products journey guarantee product authenticity and integrity. The DropChain team came together through their common background in the food & beverage industry and their shared passion for food safety. , and his team have spent the last 3 years bridging the gap between reputable alcohol manufacturers and small businesses, gradually honing their skills and understanding of . DropChain CEO and Founder, Billy Chan China’s complex food supply network Counterfeit goods is no small problem either, its actually a . “ said Billy Chan at the announcement of their strategic partnership with (STATA) on August 10, 2018. And the has tried to solve it multiple times, with little progress in preventing the proliferation of these fake goods. $40 billion global problem There are bad actors globally who are relentlessly compromising the integrity of products with dangerous counterfeits, many of which are harmful to public health.” Sanya Travel Attraction Technology Accelerator $6T global food and beverage trade . Global brands are the most commonly copied in this ecosystem, and the take years to undo. With DropChain, the entire food & beverage industry will be able to . This isn’t just a health problem either negative repercussions to brand image get rid of this growing issue once and for all In addition, the DropChain team is betting that there will be a lot of . There are large amounts of information that are not being collected (due to this lack of transparency in the product journey) that would interest in their ecosystems data potential help make better distribution and marketing business decisions. “Speak to almost any brand in the alcohol industry, and they would be able to tell you which countries their products are sold into. However, that’s where the transparency ends for most of them. Current supply chains prevent brands from truly understanding where their products go. DropChain, in its current form, can already inform a brand which city, district, street, and even end-retailer their products are being sold into, helping them gain laser-focused understanding into their local market and customer base.” — Billy Chan Today, DropChain has earned a fair amount of buzz, placing 2nd at the , and most recently, their partnership with STATA. They’ve also solidified several partnerships with prominent food & beverage companies, like Brander Urstoff. LongHash 2018 Pitch Fest in Singapore LongHash 2018 Pitch Fest in Singapore DropChain’s next focus will be it’s new , which has “ been serving East China’s small-medium business community, providing a one-stop-shop mobile platform addressing their food and alcohol procurement needs”. Billy Chan says this rebranding and integration will . integration with Foowala reduce development time and give DropChain existing business relationships You can learn more about the DropChain Project at and join the conversation on . www.dropchainproject.com Telegram CryptoMondays — the “must attend” crypto meetup , but the Shanghai group’s events are a “ . This author at their big “back to work” event after Golden Week, with . Unlike meetups in SF or NYC (which are dominated by an investor focused crowd), half of the people were working at blockchain projects and the other half were people looking to learn more about the space. This is the that helps keep your mind fresh and focused for a week long crypto world grind. You can sign up at the link below, message me, or reach out to for more information. are hosted in over 19 countries around the world CryptoMondays must attend” when in town personally found his Shanghai crypto footing speakers like Bobby Lee, Yin Xu, and Chris Cheng perfect balance of thought-provoking discussion and education reiteration **@**michael_oath _CryptoMondays is a decentralized organization with over 9,000 members internationally across 30 cities in 15 different…_www.meetup.com CryptoMondays Shanghai CryptoMondays is a decentralized organization with over 9,000 members internationally across 30 cities in 15 different countries. CryptoMondays Shanghai will bring people together that are passionate about Crypto while sharing their views, networking, learning and having a blast. We’ll drink, we’ll laugh, we’ll learn, we’ll have fun, while driving crypto further in to the ecosystem. . Know a Shanghai based project that has been influential to the community? A must attend event or conference coming up? Someone that everyone loves to chat with? Drop me a line at my social links below or my WeChat @deanofouska Part 2 for the Shanghai Edition will be out next week Thank you for reading and I hope you enjoyed this article Feel free to add me on Linkedin here , follow my twitter there → @xldean , and send me a Telegram . New article ideas are always appreciated!

Dapp

Oracle

The Cities Leading in Blockchain: Shanghai-Part 1

The digital world is not only for Millennials. Other generations have a crucial role to play too. A few weeks ago, I wrote a “ ” in which I explained what I look for when making hiring decisions. The main message was “Millennials should be Millennial.” They need to leverage their tech literacy, remain authentic, and stay adventurous. Letter to Millennials But over the last few weeks, I get the feeling that “other” generations also need to understand what the 4th Industrial Revolution is really about. They too should embrace the new possibilities created by recent technological developments, such as artificial intelligence, robotics, sensors, and blockchain. It is time for a letter to my generation and my parent’s generation. The headline thought is that with longer life expectancies and a flatter, more decentralized and open economy, culture, and society, everybody can stay entrepreneurial longer. Life today offers more opportunities, and they shouldn’t be wasted. Everybody has a role to play in designing our digital future. So, here is my letter for Gen-Xers (like me) and Baby Boomers (like my parents). Denial is Not the Answer Denying the importance of the “new” by older generations has been around since the beginning of time. A reluctance to acknowledge change is probably hardwired into all of us. But, it continues to surprise me to come across such denial on an almost daily basis regarding the impact of digital technologies. We have always had to deal with innovation, but too many people that belong to the Gen-X and Baby Boomer generations seem to believe that the digital revolution won’t disrupt their lives or work anytime soon. This view is fuelled by reports in the traditional media that explain why artificial intelligence isn’t really intelligent or why blockchain technology is currently overrated. In one sense, these reports are correct. Many of these emerging digital technologies are still in the experimental phase. But, it goes way too far to dismiss them as hype. I have mentioned several times before that these technologies should not be looked at in . They are amplifying and accelerating each other, and I agree with many commentators in the “digital space” that the time to prepare yourself for the impact of these new technologies is now. isolation Living in denial may be comfortable, but it cannot be the answer. And this is true for , especially those like me and my parents who didn’t grow up as “digital natives.” everyone But Nor is “Retrofitting” A second common attitude amongst Gen-X and Baby Boomers that I increasingly come across is that new technologies should be used to improve “old” models, systems, and ways of doing things. This view is popular at many of the conferences that I attend. There is an acceptance that something important is happening and that everyone needs to engage with tech. But this engagement is about utilizing technology to make the old world better. There is something to this idea, and it appears to make a lot of sense. It respects the old, whilst acknowledging the new, and is thus far less threatening. It is not surprising that such “retrofitting” is becoming widely accepted and common, especially amongst those who have a stake in the way things currently operate. Moreover, such retrofitting is often used as a PR or window dressing exercise: “Look! We are working with new technologies.” Recognize & Embrace the “New” But we should realize that the new technologies are not about making the old world “better.” Instead, they are disrupting the past and creating a flatter, more dynamic and community-based reality. I see this evidence of the new everywhere. Let me give you a recent example. My wife and I were in Kuala Lumpur last week, and we opted to use (the Asian equivalent of ) rather than traditional taxis. What was surprising to us was that even the hotel staff recommended the ride-sharing app (“it is more reliable and efficient”). Grab Uber But what interests me most was what happened when our car stopped showing up on the tracking app. We didn’t give up and take one of the many available “old world” taxis that were literally parked around us. Instead, we preferred to wait for a message from the original driver that something was wrong with his car and that a replacement driver was on his way. Grab We preferred to wait the extra eight more minutes for a complete stranger driving his own car rather than take any of the available taxis. Why? Clarity about the price, the route, and the time makes us commit to new electronic systems rather than old world taxi companies. But I think there is something more going on, and it isn’t entirely rational. What seems very clear to me is that the values and structures of the “old world taxis” — a slightly shady world of government permits, rules and regulations, as well as hierarchical, “proceduralized” organizations — does not appeal to me. As long as there is a digital solution, I don’t even consider the taxis as a possibility anymore. At least, a taxi would be a measure of last resort. And this is the critical point. Technological change (in this case, networks, smartphones, and “apps”) have opened up new choices that didn’t exist before (in this case, ). And, just as importantly, they kill off, or at least disrupt, old ways of doing things (in this case, the taxi companies). Grab Of course, technological advances have always been like this. After all, who used a horse and carriage after the car went mainstream. “Retrofitting” was never an option. What is different now is the speed and complexity surrounding technological change. We can’t always identify where we are headed, and the resulting uncertainties can make denial or retrofitting seem very attractive. But there are certain recurring themes, trends and values that define a digital age. It is a flatter and more inclusive world. It is a world where open organizations and APIs (Application Programming Interfaces) are replacing stagnant and insular organizations with prescribed processes and procedures. It is a world where ability trumps formal qualifications or experience. And it is a world where everyone is willing to trade a little privacy for the conveniences and possibilities of new technology. is Relevant Everyone And this is the thing. What I learned over the last year or so is that the older generations still matter in this emerging new world. In particular, the creative tension that exists between old and new generations is vitally important in providing a coherent direction to our ongoing experiments with digital technologies. We need the widest possible diversity of views, experiences, and skills to be gathered together and integrated. It is precisely the “tensions” between such diverse views that will maximize opportunities for creativity and innovation. The resulting dialogue between generations is, therefore, essential. Participation and community-building are the core issues for ensuring that our digital futures are and remain productive. We can see examples of this already occurring in the banking industry today, for instance. Many established and traditional banks are being disrupted by FinTech (new financial technology companies) and TechFin (tech companies that expand into the financial services industry) companies. As a response, more and more traditional banks are setting up “remote” and “independently managed” subsidiaries. These subsidiaries have the task to disrupt the parent companies (while making use of the bank license of the parent). This is a clear example of how stoking the tension between the “younger generation” and the “older generation” can be leveraged in the creation of a better world. Everyone needs to embrace the new as being genuinely new and accept that they have a contribution to make in designing a new world order. 👏 Thank you so much for reading! Please click (and hold) the below, or leave a comment. There is a new story every week. So if you follow me you won’t miss my latest insights about how digital technologies are changing the way we live, work, and learn.

Different

A Letter to “Gen-X” and “Baby Boomers”

Ever wondered how Apple Siri, Amazon Alexa or Google Home responds to your questions? How does a computer understand human language which sometimes human themselves do not understand? Well, technically it is known as . Natural Language Processing Natural Language Processing (NLP) The field of study that focuses on the interactions between human language and computers is called Natural Language Processing, or NLP for short. It sits at the intersection of computer science, artificial intelligence, and computational linguistics ( ). Wikipedia Behind the tech: NLP (Basics) There are multiple techniques to process a Natural Language, I will be shedding light only on some. Disclaimer: Let me tell you an instance about Nidah. Nidah is 2 yrs old & she doesn’t know any of the languages. But when her mom asks her to drink milk, she drinks it! So how does Nidah processes the information from the language which she doesn’t know? Nidah’s mom must have shown her some hand signs or she must have trained Nidha that when she says “Nidah please drink milk”, Nidah has to drink milk. So Nidah understood it, processed it & also stored that information for future use. This entire workflow got finished as Nidah was trained. If her mom would have asked her to do something which Nidah wasn’t aware(trained) of then Nidah wouldn’t have processed the information. Now Looking into Nidah’s example, there were 2 stages of processing an information Training Stage (Pre-processing Stage) Process + Decision-Making Stage Training Stage Let me take a look into Nidah’s mom’s statement again. “Nidah please drink milk” Question 1: How did Nidah understand what task to perform?Question 2: How did Nidah understand that she has to drink milk, not coffee? Simple, while training Nidah you tell her that “drink milk” has a verb “Drink” & has a property “Milk”. Now Nidah knows what task to perform & what to drink. I would call her “Trained Nidah”. (Technically the trained data is called ) “Data model” Similarly, in the field of NLP, the verb “drink” is called “Intent” & the property “milk” is called “Entity” & method of processing the data in this fashion is known as: Named Entity & Intent Recognition. An is a property which can be used to answer the request from the user — the will usually be a keyword within the request such as a name, date, location etc. Entity entity An (Intention), is a specific action that the user can invoke such as drink, place an order, book a ticket etc Intent There are a bunch of NLP tools like Google Dialogflow, Facebooks wit.ai, IBM Watson or Microsoft’s LUIS where you can host your “trained data model”. Let me call it the “BRAIN”. These brains even provide data processing & decision making abilities. Process + Decision-Making Stage Processing looks simple from outside but it undergoes a series of a pipeline of text processing sub stages like , Stemming and Lemmatizing, TF-IDF Coreference resolution, Part-of-speech (POS) Tagging, Dependency Parsing, Named Entity/Intent Recognition & many more. With the evolution of 3 party NLP tools, developers need not worry about knowing many of the processing sub stages as these tools take care of it & make your life easier. Now going back to the Nidah’s example, if you have already trained “Brain” (3rd party NLP tools) & once the brain receives a message like “Nidah please drink milk”, the brain will process the message & understands that the intent is “to drink” & entity is “Milk”. But how the brain will know what action needs to be taken? Well, you can even train the brain based on the intent received that it has to drink milk or utter an acknowledgment “ok”. Summary: In the world of NLP, It’s all about how much-structured data( ) you have! More the data more the accuracy. Also as we humans keep updating our language dictionary, training a computer is an endless process. Corpus I hope that this post gives a good initial overview of Natural Language Processing. It is a good exercise to ask yourself questions like: How will the computer understand sarcasm which even we humans never understand? Handling synonyms, ambiguity & coreferences? How would I design an NLP workflow using Google Dialogflow? What comes next: Thank you very much for reading until here. In my next blog, I will be covering “ ”. Stay tuned. How would I design an NLP workflow using Google Dialogflow?

BUNCH

Behind the Tech: How does Siri, Alexa or Google Home respond to your questions?

This is Part 3 in an ongoing series where I go in-depth on how I successfully hack and improve my health through technology and science while having Fibromyalgia. Read Part 1 and Part 2 first if you want the full story. You intimately know what every vibration pattern and audible notification on your smartphone means. Long three-patterned vibration for a phone call, double-short for a text, BLOOP-BLEEP for an email, BEEP-BLOOP for a Facebook message. You recognize every notification it produces instantly, and you respond accordingly. But how well do you know your the evolutionary notification system our bodies have developed? Can you even recognize the differences between them? “Hey moron, body here. Pay attention to me!” That dull, aching pain in your neck? Yeah, it’s from slouching again and being hunched over your laptop at work for 4 hours, Pam. Way to go. Now we . all hurt That upset stomach after lunch that left your office bathroom’s paint peeling off the walls? Again, hello??? You had too much sodium again, Brett, and didn’t include enough carbs in your meal. Your coworkers are for you today. so grateful That morning malaise with aching legs and a dull headache? Shocker, Ian: you went to bed too late two nights ago, ate too late last night, and didn’t sleep in the proper position — again. Way to ignore my signals and binge on The Marvelous Mrs Maisel (though, OK, it’s pretty hilarious). Jerk. It’s a sad state of affairs when we understand our phone’s notification systems better than our own body’s. After all, we can’t upgrade these meat socks every year (. . . yet). So unlike our iPhones, we’re stuck with the ones we have. Your Body’s Four Notification Types Your body has essentially 4 signals that you need to begin listening to and deciphering in order to understand what it needs and wants: Pain Resistance Fatigue Mental Clarity The best way to do this is by practicing the mental exercise of what I call signaling. In order to know the difference between a real alarm and a simple notification (e.g., your alarm clock for work vs a new tweet from Elon Musk (just stop following him already)), you need to start taking time to listen and log what you observe. (No, this is a diary. I don’t particularly care about your dear diary entries. This is about collecting data and developing the habit of an essential mental exercise. Though is a fantastic habit that you should start if you don’t already.) not journaling Get a small notebook that’s easy to carry around with you, download Evernote or use whatever app you prefer. If you’re logging your meals like you should be (I use MyFitnessPal religiously and have for 4 years. Every day.), then you can add a note in every meal while you log your food. Regardless, use a time, such as eating, when you typically have a break and can use the time for good. Put away social media, YouTube, and other completely useless and life-wasting apps, and practice listening and writing down the signals you are experiencing. You can use the traditional 1–10 scale (1 being least and 10 being most) or describe it with a tag system like I use (see below) — whichever way you prefer. The key here is not so much the data (as we’ll learn how to track that later in a more advanced fashion through some cool new systems I’m developing) but the mental exercise of learning to feel and notice your body’s notifications. I don’t know, I just like goats. 1. Pain There’s good news and bad news about your pain. The good news: it’s your body’s primary notification method (think of it like your phone’s vibration pattern) that something is wrong. The bad news: it’s the suckiest notification system ever. So when you take your signaling break (preferably while eating), here are the questions you should ask yourself: Where does it hurt? Picture your body going through an MRI or CT-Scan. Start at the top of your head and mentally scan your way down to your toes. Pay attention to every part. Your head, eyes, ears, mouth, jaw, neck, shoulders, etc. As you cover each area, stop and focus on it. Does it hurt? Is there pain here? When you reach an area that is tense or painful, focus on letting your muscles relax. Breathe in deeply and let them fall. You’ll be amazed at how much this simple little exercise reveals muscle areas that you unconsciously keep tight due to stress or bad posture. What kind of pain is it? Stabbing (e.g., someone has a needle or knife and is repeatedly stabbing you in a small, precise spot. Over. And over. And over.) Aching (e.g., a low, throbbing, broad surface area similar to sore muscles after working out) Burning (e.g., a cross between nerve shooting pains and broad aches combined with the sensation of being near a fire) Flashing (e.g., that weird chronic pain that feels like your pain points are a string of flashing Christmas lights that turn on and off for no apparent reason) How long has it been like this? A few minutes An hour All day My entire life (probably being a little dramatic, here. Reel it in, Anne.) Start doing this at lunch EVERY SINGLE DAY. I’ve done this for 6 years. By doing it over and over and over again, you start noticing the different kinds of pain notifications your body gives without having to stop and listen for them. It becomes second nature, just like the sound of a new Facebook message. And with this skill, you’ll be able to start building fortitude in knowing when to push through and when to back off ( ). see Part 2 to understand what fortitude is and how to use it Like doing rope exercises while attempting to perform the simplest activities. 2. Resistance In addition to pain, your body also has a notification called resistance: that heavy, gravity-pulling malaise you feel when you attempt a new or difficult activity. For example (this only applies to people who suffer from chronic conditions. Otherwise, you’ll think I’m crazy): That moment of the day has come: the dreaded shower. You’re in pain, yes, but it’s not as bad today. You’re starting to pick up a whiff of overripe fruit, so you realize you should probably take a shower. You’re tired, yes, but you got a nap in and you have some energy. You look over towards the bathroom and you suddenly feel this sensation of a heavy weight throughout your body. Gravity is pulling you harder and the air seems thicker as you begin walking towards the bathroom. You could swear you just gained 50 lbs or the Earth suddenly tripled in size. Or You’ve been sitting on the couch binge-watching (or binge-reading if you’re a book nerd!) for 3 hours. You haven’t moved. Standing up would be a Herculean feat of physical triumph. The bathroom is so . . . far . . . away. This is resistance. It’s not pain, it’s not fatigue, . it’s friction It’s your mind resisting against expending energy on something it’s telling you isn’t crucial for survival. When you are in perpetual fight or flight mode, even the smallest things can bring formidable resistance. And resistance is incredibly difficult to overcome. Pay attention to this whenever it happens. Write it down in the same journal or app. Here are some questions to ask yourself: What activity or action is causing resistance? What happens when I push through and do it anyways? Resistance is the most closely linked signal with developing fortitude. Fortitude is the ability to perform actions through resistance, because you know your body well enough to see when resistance should be pushed back against and when it should be heeded. We’ll talk about this later. For now, just start tracking it. Guess I should probably rest now . . . 3. Fatigue There are two tones for the fatigue notification. First, you have the ordinary fatigue when you don’t sleep well, had too much to eat, are being lazy, haven’t exercised or just are being a fat ass. This is a milder notification, like the short little beep of an incoming email. The second is much more severe. This is that all-encompassing malaise that feels like jet lag or a hangover. It envelops you and doesn’t depart. This is that obnoxious alarm clock sounding that keeps repeating every time you hit snooze until you want to chuck it across the room . . . if you had the energy to do so, of course. But the sneaky trick with fatigue is that the more you rest, the worse it gets. Sure, your body is telling you you’re tired, but if you have a chronic condition, guess what: you’re not. It like you are, but you’re well aware that you can’t possibly need 24 hours of sleep. You don’t really have to rest all day. (We’ll get into how to hack your sleep for maximum optimization later. You could very well be exhausted for good reason.) feels We’ll get into how to know the difference between needing rest and ignoring fatigue. For now, start paying attention to your fatigue levels. Ask: How tired am I right now? Am I more or less tired after waking up or taking a nap? Did I do a physical activity that increased my fatigue? Nope, these glasses don’t even help 4. Mental Fog Your body also has physical notifications that affect your brain and your capacity to focus, think critically, and problem solve. Again, this varies in severity and cause, with differing notification signals for each. The first is a lack of clarity, such as when you can’t focus or problem solve. It’s what happens after studying for a long period of time, working on a difficult coding challenge or being at a social gathering for hours. You just can’t bring your brain to think clearly. You’re working through a haze. With Fibromyalgia, a second kind of mental fog is far worse. It’s referred to colloquially as Fibro Fog. It’s that mental state you have when you come down with the dreaded flu. It takes so much effort to focus on even the smallest of tasks. It’s completely debilitating, and for me, it’s my biggest struggle. So start listening and paying attention to this state. When did it start? What was I doing? How severe is it? Again, by hearing this signal, you’ll begin to start noticing degrees of it. Every signal has varying degrees of intensity, just like your phone notifications have different volume and vibration levels. When you’re ill, it’s easy to just throw it all to a 10 and complain on Facebook (STOP WHINING ON FACEBOOK GROUPS! GROUP WHINING IS CONTAGIOUS! IT’S A PLAGUE). But that’s like playing every measure of a song at . It’s obnoxious and no one wants to hear it! fortissimo So start noticing the subtleties of the notifications, including mental fog. Is this really as bad as earlier this morning? Is it better than yesterday. Shhhh . . . cut out the noise and listen to your body. Let’s recap. Set aside 10 minutes at lunch to listen to and decipher your body’s 4 notification types: Pain_Where is it?What kind is it?How long have I had it?_ Resistance What activity or action is causing resistance?What happens when I push through and do it anyways? Fatigue How tired am I right now?Am I more or less tired after waking up or taking a nap?Did I do a physical activity that increased my fatigue? Mental Fog When did it start? What was I doing?How severe is it? I promise you, after doing this over and over and over again, you’ll begin to understand not only your body is telling you, but you’ll also be prepared to begin hacking your health to determine it’s happening in the first place. what why Eventually, you won’t even need to write it down anymore. Just like your smartphone’s notifications, your brain immediately recognizes the pattern and associates it with the information it represents. You instantly know the difference between a text, a WhatsApp message, an email, and a phone call. All of this will become second nature and you’ll welcome every notification (within the normal range, of course) as information that guides you to a series of habits and responses you’ve developed to maintain and improve your health. Have questions on signaling or how I specifically track things? Ask in the comments! What’s your signaling story? What have you learned by listening to your body’s notification system? Share and comment!

Instantly

YouTube

Making the world's first all-natural smart clothing!

Stop dismissing your body’s notifications.

In Darwin’s evolutionary theory, the concept of survival of the fittest stands for the phenomenon that the traits of life forms that have the biggest reproductive success will, over time, become prevailing, while other traits disappear. I would like to adopt this framework for the age of algorithms. On the leading tech platforms such as Facebook, YouTube, Twitter, Instagram, LinkedIn and TikTok ( ), algorithms play a key role in selecting what information people get to see, and who gets to be seen. Since these services’ business models are centered around advertising, their algorithms are optimized for making people spend as much time as possible on them. gotta be inclusive here Thanks to the vast amounts of usage data generated by billions of daily users as well as the ever-improving capabilities of machine learning (or “ ”), one has to expect this optimization process to eventually become highly effective, if not truly perfect. Artificial Intelligence The result, then, would be something akin to an “algorithmic survival of the fittest”. The algorithms will reward those characteristics of information and traits of people who convey information — e.g. journalists, Instagram influencers, YouTubers, traditional celebrities, political pundits, Twitter opinion leaders — with reach and monetary incentives that generate the biggest attention and thus ad revenue. This causes a feedback loop in which creators and information curators are observing and learning which type and style of information the algorithms want, followed by an increased supply of that kind of material. Then the whole cycle starts again. While this is happening, algorithms are shaping the habitual patterns and minds of producers and consumers of that information alike. Over time, producers and consumers become what and who the algorithms “want” them to be. Technically of course it is not an actual “want”, but a consequence of their task to optimize for attention and user engagement. For example, as a creator, if you realize that the algorithms reward you for screaming, being angry, being outraged, being controversial, or for actively behaving unintelligent, this is what you might keep doing. After a while, due to , this will have an actual impact on your brain structure, your mental models and who you are as a person. Even if it is a simplified way of putting it, you might become that angry, outraged, controversial, unintelligent-behaving person that the algorithm trained you to be (if you chose that path initially). Neuroplasticity Another example: If the algorithms figure out that feeding you with ever more extreme ideological content makes you stick around longer and longer, they’ll keep doing that, casually turning you into a full-blown radical. It’s worth mentioning here that as with the original evolutionary theory, algorithmic survival of the fittest is not about individual survival in the physical world. It is about survival of certain traits that serve the algorithms’ needs. If a person that got radicalized on gets killed while committing a mass shooting, this doesn’t go against the algorithms’ interest. On the contrary: Perversely, algorithms will then leverage the increased polarization of the society and radicalization of individuals that follows the shooting for another round of maximizing people’s attention. Where do many people go after major incidents to express their sorrow, anger, and to look for information? Social media, of course. social media As an individual and as a society, noticing how algorithms are taking over the minds while it happens is as hard as noticing your hair growing when you have a daily look in the mirror. One day you see yourself in the mirror and realize “I need a haircut. How could I even let my hair get that long??”When it comes to the power of algorithms over us, we might already be way past that moment. ======= Sign up for my weekly email , loaded with great things to read about the digital world.

Algorithmic survival of the fittest

The world is moving towards decentralization. At least tries. The word “decentralization” itself became popular after the rise of a blockchain and cryptocurrencies phenomenon but in fact, this process takes place for decades on a governmental level already. What is decentralization? We understand decentralization by different means. The world is moving towards decentralization. At least tries. The word “decentralization” itself became popular after the rise of a blockchain and cryptocurrencies phenomenons but in fact this process takes place for decades on a governmental levels already. , Merriam-Webster dictionary. “Decentralization is the process by which the activities of an organization, particularly those regarding planning and decision-making, are distributed or delegated away from a central, authoritative location or group” Despite the reformation power of decentralization the process sometimes leads to recentralization and turns back on decentralized path. This happens not only today but took place back to the French Revolution. “ ”, Wikipedia. In the mid-1800s Tocqueville would write that the French Revolution began with “a push towards decentralization…[but became,] in the end, an extension of centralization In other words, decentralization became deconcentration. If decentralization is seizing decision-making from central government, deconcentration is decentralized only in operations. Tocqueville was a strong advocate of decentralization in a civic dimension as it gives more opportunities to use freedom on a personal and collective will levels. Decentralization is a live process. It is not something well formed you can put on rails to be sure it drives the right route to success. Taking into account the heterogeneity of countries decentralization should increase effectiveness of governance due to the focus on local diversity, richness and needs rather than statists’ “one-size-fits-all”. Financial decentralization can’t be the only piece of a decentralized cake for effectiveness. If subnational governments can be different in a financial sense it implies ability to be different in administrative and political senses too. Decentralization is a necessity Sustainable development, risk management, climate change and disasters prevention are in a global, urban agenda as goals for the next 30 years. This agenda affects not only formation of subnational governments but financial systems as well. Financial decentralization implies local financial systems to be coherent, viable and efficient without the constant, normative governments’ observation. One reason of decentralization necessity is the wide range of countries' history, culture, mentality, geopolitics, regional specifics. They all influence administrative principles and require different approaches on the deeper, local levels inside central governments. In the end any central or subnational government can’t exist without financial system. With decentralization the number of local financial systems will increase but the world in general still doesn’t have a clear, unified picture of their current state. Developed countries have close to perfect national accounting systems comparing to the third worlds'. There finances even on a central government level lack transparency and heterogeneity. The last two qualities are the fundamentals for carrying out responsibilities towards decentralization. Understanding subnational governments There are more than 522 000 subnational governments in 101 countries. When we talk about decentralization we don’t imagine subnational governments to be the trumpets of central points. Also, we don’t imagine them to be delegated by central points in organizational structures and decisions or agendas. Despite possible full-sufficiency subnational governments deal with limited areas of major control. They are education and public services and take up to 50% of subnational governments’ expenditures. Areas such as security, environment, recreation and housing take the least in the split of economic function. These areas usually used by central governments for propagation back to different historical events. Subnational governments are one of the biggest employers especially in high income countries. Staff expenditure usually takes up to 35% of budget in average. The revenue comes mostly from grants or subsidies and taxes depending on particular country. Loans and debt securities and forms up to 68% of total debt. In third world countries subnational governments often exist in a deconcentrated manner to cover up corruption, absence of strategy and insufficient management or simply signaling resistance to decentralization despite economic necessity. Such resistance is understandable. Together with opportunities decentralization brings risks to political governance and may cause separatism in specific circumstances. The effects of decentralization The same as globalization we can’t say decentralization is good or bad itself but recent reports and studies are extremely positive about its effects. The list is excessive (not limited to) and self-explanatory as provided by Asian Development Bank’s publication “The Impact of Fiscal Decentralization”: Public investment in in Bolivia (Faguet, 2004). education and other services became more responsive to local needs due to decentralized education program in Nicaragua (King and Özler, 1998). Test scores much improved The proportion of in Spain (Peña, 2007; Solé-Ollé and Esteller-Moré, 2005). successful students of secondary education improved due to revenue decentralization in Argentina (Habibi et al., 2003). Infant mortality decreased due to higher share of public expenditures management by subnational governments (Robalino, Picazo, Voetberg, 2001). Lower mortality rates achieved due to decentralized participatory budgeting by citizens in Brazil (Santos, 2005). Access to water and sewage services increased due to decentralization in Philippines and Uganda (Azfar, Kähkönen, and Meagher, 2001; Azfar and Livingston, 2002). Local budgets better matched citizens’ priorities achieved due to greater subnational fiscal autonomy in Switzerland (Feld et al., 2004) and in Peoples' Republic of China (Qiao et al., 2008). Faster economic growth in selected developing countries due to political and administrative decentralization (Crook and Manor, 1998; Crook and Sverrisson, 2001), by the Human Development Index (Von Braun and Grote, 2002; Lindaman and Thurmaier, 2002). Poverty reduced positive impact on poverty captured The overall (Fiszbein, 1997; Kuncoro, Arikan, 2000; Fisman and Gatti, 2002; Gurgur and Shah, 2005). level of corruption decreased On the contrary, IMF have warned about macroeconomic dangers of decentralized governments but in fact where macroeconomic instability took place (e.g. Argentina, Brazil) decentralization didn't make it worse. Are we ready for it? Today we hear many people discussing decentralization, opinion leaders stand for it and call for it. But do we understand what does it mean for us together and each one personally? Do we understand that decentralization does not happen by itself? That no one will do it for us? That it implies involvement? This in turn requires consciousness of planet inhabitants and their will to build lives with own hands. Studies show that (Tarrow 1994, Hooghe and Marks 2003). It means that people will have a room to participate, create and do. People will become responsible for decisions made if there is no central authority to tell them what to do. People will define priorities, goals, targets and the route to achieve them. decentralization encourages more interaction, involvement and collective action If we are afraid of centralized technocracy and high-tech solutions to replace human labor, we should be serious about decentralization. It may be the right answer to keep us needed and prosperous. It may change the way of life. Perhaps we will find ourselves where we would like to be, to do what we would like to do and not to serve the time from 9 to 5 for the sake of paying taxes and maintaining our own such life. Every single sphere of life potentially will be influenced by collective desires and finding consensus on the questions like local economic activity development, public services efficiency, labor-intensive production technologies growth and more. It may lead to further fragmentation towards decentralized society clusters and increase the quantity of local micro-governments united by absolutely different principles. If to assume that officials may lack knowledge and experience it opens more potential to redirect management and legal functional responsibility to individuals, collectives, experts in specific spheres and entrepreneurs (whatever fits best for the purpose) for better results. Thus, the question arises: if this is what we talk about and want, are we ready to build it? Because no one will give us this in a gift wrapping. Thoughts or questions? Share them with me here: | Twitter LinkedIn

Are You Ready for Decentralization?

Social media has become a huge part of everyone’s lives. As of 2017, daily social media usage of global internet users amounted to 135 minutes per day. When it comes to extreme averages, teenagers take the prize. Their daily average time spent on social media is nine hours a day. That’s longer than most people spend sleeping or in school. As we spend increasing amounts of time online, and new technologies allow us to connect further in the virtual world, the further we connect, the further we create online issues. One such major issue is . online harassment In a survey of over 3,000 Americans, 47% reported experiencing some sort of online harassment or abuse. To curb this issue, one of the steps taken from Google is to come up with a technology which could help improve online conversations. Introducing Google Perspective. Google Perspective: Perspective is an API that makes it easier to host better conversations. The API uses machine learning models to score the perceived impact a comment might have on a conversation. Developers and publishers can use this score to give real-time feedback to commenters or help moderators do their job, or allow readers to more easily find relevant information. Perspective identifies whether a comment could be perceived as “toxic” to a discussion. How to use Google Perspective? Well, first you need access to Google’s Perspective API. Which can be availed by getting whitelisted by the perspective team. Apply here Once you get whitelisted, go ahead & create a . Google Cloud project Search for ‘Perspective API’ from the list of Google API’s, then go to the and click . Perspective API’s overview page Enable To authenticate your requests, you’ll need to generate credentials for your project. Using an API key is the simplest option. Go to the , click , and choose “API Key”. API credentials page Create credentials Now you have everything, except a nodejs client to find “Toxicity/Profanity” of a comment using Google Perspective. Tada…. & here is your open source nodejs client for Google Perspective: I, open sourced a nodejs client for Google perspective with a clear-cut documentation for a quick start. Click on the below link, use it & feel free to raise an issue if you find any. _Comment Toxicity/Profanity Analyzer, will help help increase empathy, participation and quality in online conversation…_github.com sandeshbsuvarna/Comment-Toxicity-Profanity-Analyzer The Internet Should Be a Good Place

Find “Toxicity/Profanity” of a comment using Google Perspective

It’s safe to say ICOs are very popular nowadays. In 2017 alone over $4 billion got invested through ICOs and they have proven to be capable of raising massive amounts of capital in ridiculously short times. But what are ICOs, what are the pros and cons, and aren’t there better alternatives available? What are ICOs? An Initial Coin Offering (often referred to as ICO) is a mechanism for new blockchain projects to raise funds by offering the tokens of their project to investors before the tokens are listed on any exchange. These ICOs are similar to the more renowned Initial Public Offerings (IPOs), in which investors have the ability to purchase shares of a company. These ICOs are often carried out by smaller teams in order to raise funds for their new project. Just like with IPOs, a certain portion of all available tokens is offered to the public. ICOs are often big happenings and usually consist of multiple phases: The first phase of an ICO is the pre-sale, where a portion of the tokens is privately offered to major and influential investors. The tokens are often offered with big bonuses or discount to gain the support of these early investors. After the pre-sale has concluded, the public token sale starts. As soon as this sale starts, everybody has a chance to buy the tokens at the predefined ICO price. Buying these tokens is generally very easy and can be done with a single transaction to the ICO smart contract. The smart contract then automatically sends the new tokens to the corresponding address. The amount of tokens one receives depends on the amount of tokens invested and the exchange rate. All ICOs have a soft cap. The soft cap of an ICO is the minimum amount of funds that needs to get invested in order for the ICO to be a success. If this soft cap is not reached by the end of the ICO, the ICO is deemed unsuccessful and the funds are returned to the investors. Most ICOs also have a hard cap. The hard cap of an ICO is the maximum amount of funds they are willing to accept. Once this cap is reached the ICO ends. This hard cap is imposed as only a limited amount of tokens can get issued to investors. Pre-sale: Public token sale: Soft cap is reached: Hard cap is reached: Some ICOs are for existing products or by teams that have already proven themselves on previous projects, most ICOs however, present nothing more than a whitepaper. A whitepaper gives a detailed description of the project and is very important for a project. The pros and cons of ICOs ICOs have already turned many into millionaires thanks to massive token price increases. But ICOs have also left many scammed without any way to retrieve their initial investments. What are the pros and cons of ICOs? Pros **High liquidity**This is as much of a pro as it is a con. ICOs provide investors with tokens that are usually easily exchangeable for other assets or fiat shortly after the ICO has been concluded. If an investor is unhappy with the course the project is taking they are able to quickly exchange their tokens. Because these tokens have high liquidity, investors can also have ‘real-time’ pricing of their token. **High accessibility**Unlike IPOs, ICOs are accessible to anyone, anywhere, anytime. No major initial investments, great connections with the right people, or other things one is not able to obtain easily are needed to invest in ICOs. This makes ICOs very accessible to anyone, which is one of the reasons why ICOs have gotten so massively popular. ICOs are essentially crowdfunding campaigns for blockchain startups, which has various benefits. First and foremost these projects will have massive community support. All investors have a vested interest in seeing the project succeed, as this will likely increase the price of the token of the project. Because of this massive support these projects have to spend less money on marketing which can then be used to fund innovation. Instant community support **Easy to conduct**Just like high liquidity, this property of ICOs is as much of a con as it is a pro. Currently, conducting an ICO is by no means difficult and therefore a very viable option for a relatively new and small company to raise funds to materialize their ideas. By conducting an ICO a new company has the ability to potentially raise a lot of funds in a short amount of time. Cons As said above, high liquidity has pros, but also many cons. Many tokens issued during ICOs will only be exchangeable on (relatively small) DEX’s (decentralized exchanges) for the first couple of months, and sometimes for the first couple of years. These DEX’s provide the project teams with the ability to (secretly) sell the tokens of the project thus ‘leaving’ the project before anyone else notices. High liquidity There have been plenty of debates about how to regulate ICOs, but so far no proper universal measures have been taken, making ICOs prime territory for scammers. Since most countries have dealt with ICOs in their own way, it is difficult to conduct an ICO that is fully compliant with the rules in all countries which is why the legality of many ICOs is often questioned. Poor regulation IPOs are usually only accessible to a small, certain group of people. These people are usually seasoned investors who know which things to look for in new projects. Scams and poor projects There are going be lots of great investment opportunities, but with that will come lots of scams. This is not kindergarten, there is no teacher to run to when you get in trouble. -Sharif Bouktila, Stop The Maddness ICOs however, are accessible to anyone and easy to conduct, meaning almost everyone can conduct an ICO with ease. This has lead to an abundance of funds ending up in the hands of inexperienced, undeserving project teams, or even worse, scammers. **Speculative nature**ICOs are very risky, speculative investments, with often nothing more than a whitepaper and a common believe that the project will succeed to keep the price of the token stable. More than 90% of all startups fail, and blockchain startups are by no means an exception to this rule. While some ICOs are insanely successful and get hundreds of millions of dollars, most successfully conducted ICOs get much smaller amounts of money. Making it ‘easy’ for certain people hold significant percentages of the token supply, which they can then abuse to manipulate the market, through insider trading for example. Due to the lack of proper regulation it’s also relatively easy to get away with such malpractices. Market manipulation Are ICOs still worth it? Now you are more familiar with the vices and virtues of ICOs, you are probably wondering if ICOs are still worth the risks they bear with them. The answer to that question is unfortunately not simple. It really depends on the project, but we’ll give you a few rules and questions to keep in mind when analyzing an ICO. These will help you stay away from scams and will also help you estimate the actual value of a project. Here are 3 simple rules.1. Do your research.2. Be Skeptical3. Own your decision. Some questions to ask when evaluating a project.1. Who are the team? Can you talk with them on a Zoom call? If not, why not?2. Why are they raising the money?3. What are their delivery milestones?4. Why should you care about this idea?5. What are they doing different to the other opportunities.6. Which trusted community members or Block Producers are working with them. If not, why not?7. Where is the business located? Check that it is real.8. What references are they able to provide?9. How long have the team been working together?10. Can you meet them face to face at an upcoming event? If not, why not?Taken from “Stop The Maddness”, EOS Dublin Although ICOs can be an unregulated mess full of opportunities for scammers to trick you out of your precious funds, they can also be a great opportunity for a new company to raise funds and a great opportunity for investors to financially back their favorite projects from the start. Just remember, stay vigilant. About us We are Blockgenic, a network of world class technology entrepreneurs and investors looking to make a positive impact on blockchain technology. You can find us here:EOS Block Producer name: ‘blockgenicbp’ Website Twitter Youtube Reddit *Disclaimer: Always be cautious when investing in ICOs. Don’t invest money you can not afford to lose*

The vices and virtues of ICOs

Most blockchains have a lot of things in common and function in similar ways, but one of the ways in which blockchains can be unique is the way consensus is reached. Which transactions are legitimate and which transactions are added to the blockchain? Blockchains do this using various consensus mechanisms, we will explain the most important ones and some others below. What are consensus mechanisms? In short, consensus mechanisms are protocols that make sure all nodes (device on the blockchain that maintains the blockchain and (sometimes) processes transactions) are synchronised with each other and agree on which transactions are legitimate and are added to the blockchain. These consensus mechanisms are crucial for a blockchain in order to function correctly. They make sure everyone uses the same blockchain. Everyone can submit things to be added to the blockchain, so it’s necessary that all transactions are constantly checked and that the blockchain is constantly audited by all nodes. Without a good consensus mechanisms, blockchains are at risk of various attacks. There are many ways to reach consensus, so we’ll jump right into the most popular ones. Proof Of Work (POW) Proof Of Work (POW) is the first blockchain consensus mechanism and was first used by Bitcoin. Many cryptocurrencies have followed Bitcoin’s example and have also adopted this consensus mechanism. The Proof Of Work process is known as mining and the nodes are known as miners. Miners solve complex mathematical puzzles which require a lot computational power. The first one to solve the puzzle gets to create a block and receives a reward for creating a block. These mathematical puzzles have some interesting properties. First of all, they are asymmetric, meaning it takes a lot of time to find the answer, yet it’s easy to verify if an answer is correct. Secondly, the only way to solve these puzzles is to ‘guess’ the answer. It is not possible to solve the puzzles quicker using any other method than trial and error. This also means that the if one wants to find the solution to the puzzle faster, they would need more computational power, which can get very costly. Lastly, the difficulty of these puzzles changes depending on how fast blocks are mined. To maintain a consistent supply of new coins, blocks have to be created within a certain time frame. If blocks are created too fast, the puzzles get harder, and if they are created too slow, the puzzles get easier. This process ensures that in order to be able to create a block, one will need a lot of computational to solve the puzzle first. But how are miners mining these blocks? Miners can mine blocks using a lot of different hardware: — Using a normal computer’s CPU to validate transactions in a proof of work consensus protocol. — This is not dissimilar to CPU mining, however in this case a graphics card is used. Graphics cards are more powerful whilst relatively using less electricity. — Otherwise known as “Field-Programmable Gate Array mining”. An FPGA is a circuit tailored for a specific computing task, making them several times faster at mining than normal processors. — Is an “Application-specific integrated circuit”, a circuit customised for a particular use. ASICs easily outperform CPUs, GPUs and FPGAs in both speed and efficiency, they are generally only really used for Bitcoin mining. — To increase the likelihood of successfully mining a block miners pool together their resources, sharing any potential rewards dependent on how much each miner contributed. — Some miners rent out their processing power to other miners for a allotted period of time. CPU Mining GPU Mining FPGA Mining ASIC Mining Mining Pools Cloud Mining Taken from lisk.io There is a major drawback to this consensus mechanism though. Proof Of Work uses a lot of resources and is said to be unsustainable in the future, which is why some blockchains are moving to different consensus mechanism. Bitcoin Energy Consumption index, https://digiconomist.net/bitcoin-energy-consumption To give you an idea of just how much energy blockchains using Proof Of Work can consume we have included the above graph, which estimates how much energy Bitcoin has consumed over the past 2 years. Digiconomist estimates that just over the last year, Bitcoin consumed roughly 73.12 TWh, with an estimated cost of $3,656,073,069. Proof Of Stake (POS) Proof Of Stake (POS) is the more environmentally friendly brother of the Proof Of Work protocol. Proof Of Stake makes use of the premise that those who own most coins in a network have a vested interested in keeping the network maintained and the value of it’s coins high. In a system that uses Proof Of Stake a randomized process is used to determine who gets to produce the next block. Users can stake their tokens to become a validator (someone who can produce blocks), which means they lock their tokens up for a certain time. After doing so they are eligible to produce blocks. The process that decides who gets to produce the next block takes a couple of factors into account, what these factors are depends on the design of the blockchain, but in general, the person who has the biggest stake has the highest chance to produce a block. An example of another factor that can be taken into account is how long the coins have been staked. Validators are also rewarded for their work. The reward that the validator receives for creating the next block depends on the design of the blockchain yet again. Usually, they either receive all, or part of, all the transaction fees of all the transactions in the block they created, or they receive a fixed amount of coins (generated through inflation). Proof Of Stake is not only much more energy efficient than the Proof Of Work system, it also has another major distinction. In a Proof Of Work system a miner may own none of the coins they are mining, meaning they only seek to maximize their profits without actually improving the network. In a Proof Of Stake system validators have a much bigger incentive to actually maintain the network as they actually hold the coins of the blockchain on which they are validating. Delegated Proof Of Stake (DPOS) Delegated Proof Of Stake (DPOS) is a very fast consensus mechanism and most known for it’s implementation in EOS and is often referred to as a digital democracy, thanks to it’s stake-weighted voting system. In a Delegated Proof Of Stake system users can stake their coins to vote for a certain amount of delegates. The weight of their vote depends on their stake, for example, if A stakes 10 coins for a delegate and B stakes 1 coin for a delegate, A’s vote weighs 10 times heavier than B’s vote. But what is a delegate? A delegate is a person or organisation that wants to produce blocks on the network. The delegates that receive the highest amount of votes get to produce blocks and are rewarded for creating these blocks. Just like with Proof Of Stake, they are either paid from the transaction fees or they are paid a fixed amount of coins, which are created through inflation. How many delegates get to produce blocks depends on the design of the blockchain, generally, this is either a fixed amount or all delegates above a certain pay grade. Who the top delegates are can constantly change. Rather than simply taking a pay cut to be a delegate, delegates may get voted in because they use the delegate pay on other tasks like marketing, legal work, or lobbying. They can thus perform some of the duties that employees of other types of companies would do. Thus, there are strong incentives for all delegates to not just secure the network, but also to provide value to shareholders in other ways.-Daniel Larimer Since delegates want to receive as much votes as possible, they are constantly incentivized to create things valuable to the community, as they are likely to receive extra votes for doing so. Blockchain activity index including consensus mechanisms, blocktivity.info The Delegated Proof Of Stake protocol is also much more efficient at processing transactions than the above protocols. As you can see in the image above, the most active blockchains, ordered by the amount of transactions in the last 7 days, all use the Delegated Proof Of Stake protocol, or a variant of it. You can also see the CUI index on the right of the image, which shows how well a blockchain is handling the amount of transactions it’s receiving. The blockchains that use the Delegated Proof Of Stake protocol are having no trouble handling all the transactions they are receiving, yet the blockchains that are using the Proof Of Work protocol have a very hard time handling a relatively small amount of transactions compared to the amount of transactions the bigger blockchains are handling. Other consensus mechanisms Now you have read about the 3 most popular consensus mechanisms, you might be wondering what other consensus mechanisms exist. We have explained some of these below. Proof Of Capacity (POC) Proof Of Capacity is a consensus mechanism that uses a process called plotting. With Proof Of Work miners use computational to guess the correct solution, with Proof Of Capacity however, solutions are pre-stored in digital storages (like hard disks). This process is called plotting. After a storage has been plotted (meaning it has been filled with solutions) it can take part in the block creation process. Whoever has the fastest solution to the puzzle of a (new) block, gets to create the new block. The more storage capacity you have, the more solutions you can store, the higher your odds of creating a block are. Proof Of Elapsed Time (POET) Proof Of Elapsed Time is a consensus mechanism that aims to randomly and fairly decide who gets to produce a block based on the time that they have waited. To decide who gets to produce a block, the process assigns a random wait time to each node. The node whose wait time finishes first gets to produce the next block. This consensus mechanism can only work if there is a system in place to verify that nobody can run multiple nodes and that the assigned waiting time is actually random. Without a system like this in place the consensus mechanism has major flaws. At the end of the day all of these mechanisms have the same goal: reaching consensus in a decentralized network. Though, despite these mechanisms having a common goal, they vary wildly in their approach to reaching consensus. While the perfect consensus mechanism does not exist yet, it’s interesting and inspiring to see how consensus mechanisms have evolved and adapted over time to the ever changing needs of a protocol like this, and it will certainly be enthralling to watch new ideas materialize. About us We are Blockgenic, a network of world class technology entrepreneurs and investors looking to make a positive impact on blockchain technology. You can find us here:EOS Block Producer name: ‘blockgenicbp’ Website Twitter Youtube Reddit

fees

Lisk

Different Blockchain Consensus Mechanisms

Coalesce

Data Mastery: SQL — Subqueries

Data Mastery: SQL — Left & Right Outer Join

There are various approaches to implement dynamic permission-based authorization; In this post I want to implement Custom AuthorizationPolicyProvider to simplify permission-based authorization mechanism in ASP.NET Core. Introduction According to the authorization infrastructure in ASP.NET Core, you can use the following piece of code to apply claim-based authorization with custom permission claim-type: services.AddAuthorization(options =>{    options.AddPolicy("View Projects",        policy => policy.RequireClaim(CustomClaimTypes.Permission, "projects.view"));}); And you can use it like below: [Authorize("View Projects")]public IActionResult Index(int siteId){    return View();} This approach is integrated and very simple and you don’t need to do any customization; but, in one real project or in enterprise scale, it is hard to define all permissions as claim-base policies. Fortunately, and register it in DI system. One of its uses is: ASP.NET Core supports to implement Custom AuthorizationPolicyProvider Using a large range of policies (for different room numbers or ages, for example), so it doesn’t make sense to add each individual authorization policy with an AuthorizationOptions.AddPolicy call. Implement AuthorizationPolicyProvider For this purpose, we can implement AuthorizationPolicyProvider or inherit from DefaultAuthorizationPolicyProvider that registered in DI system as default provider. public class AuthorizationPolicyProvider : DefaultAuthorizationPolicyProvider{    public AuthorizationPolicyProvider(IOptions<AuthorizationOptions> options)        : base(options)    {    }    public override Task<AuthorizationPolicy> GetPolicyAsync(string policyName)    {        if (!policyName.StartsWith(PermissionAuthorizeAttribute.PolicyPrefix, StringComparison.OrdinalIgnoreCase))        {            return base.GetPolicyAsync(policyName);        }        var permissionNames = policyName.Substring(PermissionAuthorizeAttribute.PolicyPrefix.Length).Split(',');        var policy = new AuthorizationPolicyBuilder()            .RequireClaim(CustomClaimTypes.Permission, permissionNames)            .Build();        return Task.FromResult(policy);    }} In this implementation, GetPolicyAsync is responsible to find and return one policy based on policyName. However, we can automate the process of defining the policy by overriding it and using an instance of AuthorizationPolicyBuilder. In the body of GetPolicyAsync method, first checked that received policyName starts with “PERMISSION:” or not; then split policyName with ‘,’ character to retrieve permission names. Finally, define policy with retrieved permissions and return it. Now, To replace this implementation with default registered, use the following code in startup: services.AddSingleton<IAuthorizationPolicyProvider, AuthorizationPolicyProvider>(); Implement PermissionAuthorizeAttribute As the last step, we need to implement custom AuthorizeAttribute to manipulate Policy property and store permission-names as a comma-separated string in this property. public class PermissionAuthorizeAttribute : AuthorizeAttribute{internal const string PolicyPrefix = "PERMISSION:"; /// <summary>/// Creates a new instance of <see cref="AuthorizeAttribute"/> class./// </summary>/// <param name="permissions">A list of permissions to authorize</param>public PermissionAuthorizeAttribute(params string[] permissions){Policy = $"{PolicyPrefix}{string.Join(",", permissions)}";}} And to use it: [PermissionAuthorize(PermissionNames.Projects_View)]public IActionResult Get(FilteredQueryModel query){   //...}[PermissionAuthorize(PermissionNames.Projects_Create)]public IActionResult Post(ProjectModel model){   //...} Conclusion With approach that explained in this post, you can simply and with minimum customization, apply dynamic permission authorization in your ASP.NET Core project. Also, you can find complete implementation . in DNTFrameworkCore repository

Permission-based Authorization in ASP.NET Core with AuthorizationPolicyProvider

Sanity is the perfect companion for when you want to get started with the JAMstack, or just need API for your project. In this tutorial you’ll learn how to get started with using Sanity — from configuring the React editor with JavaScript , to querying the API and migrating the content datasets. If you find yourself in need of some backend, the chances are that Sanity is one of the quickest ways to get started without later punishing you. Spin up a new Sanity project for your weekend project. For that time you need an API to test something quickly. Or you can use it for more serious stuff. For example, when you need a conduit between a legacy system and the technology you prefer to use. And when you need humans to be in control of digital content, Sanity has an open source editor, that you can configure with simple JavaScript, customize with React, and host anywhere you want — be it on , , or on Sanity’s cloud. Netlify Now It’s one of the best and well thought-through content backends I’ve worked with, and that’s why I now work for Sanity — and loving every single day of it. Watch the video “Getting Started with Sanity” You can create as many free Sanity projects you want and get a lot done within the developer tier, and the is transparent and flexible. pricing You should be up and running within minutes — just use your Google- or GitHub-login, accept the , and that’s it. Begin with installing the Sanity CLI and initiate a new project with: Terms of Service npm i -g @sanity/cli && sanity init The instructions of the command will take you through creating a project and downloading the Sanity Studio locally. If you run in your project folder, the CLI will open a local server with hot-module reloading so you can configure it without having to refresh the browser manually. The Studio is always connected to the hosted real-time backend, which means, that as soon as you begin working with content in it, that content will also be available and queryable in the API. In other words, it's swift to get a project going where your editor can begin working with content, that you can fetch and use in your project. sanity init sanity start It can be useful to try some of the preconfigured templates the first time, but to show you how easy it is to configure the Studio , let me show you the code for a simple post entry with a title field: using schemas export default {  name: 'post',  title: 'Post',  type: 'document',  fields: [    {      name: 'title',      title: 'Title',      type: 'string'    }  ]} The Studio will now look like this: If you don’t care about the Studio, that’s completely OK. You can just as easily use Sanity’s patch API to create documents and edit them. To make a queryable document, it just needs a , a key, and there are some conventions for different data types that you'll learn pretty quickly. Using the , you can create a document like this: write token _type JavaScript client import sanityClient from '@sanity/cli'const client = sanityClient({  projectId: '<projectId>',  dataset: '<datasetName>',  token: '<tokenWithWritePermissions>'})

client.create({ _type: "post", title: "Hello World" }).then(console.log)

> { _createdAt: '2018-11-10T20:06:56Z',_id: 'wK0NtpsoCZRvwU3EDtEub2',_rev: 'wK0NtpsoCZRvwU3EDtEuYI',_type: 'test',_updatedAt: '2018-11-10T20:06:56Z',title: 'hello world' } And if you want to change (or add another) value: client.patch('wK0NtpsoCZRvwU3EDtEub2').set({ title: 'Hello Worlds!'}).then(console.log)

> { _createdAt: '2018-11-10T20:06:56Z',_id: 'wK0NtpsoCZRvwU3EDtEub2',_rev: 'FUGFhuJJo756q4bO12e29f',_type: 'test',_updatedAt: '2018-11-10T20:10:31Z',title: 'Hello Worlds!' } You can use Sanity CLI and create a new document with sanity documents create and write the data in your favorite text editor. Example of ” sanity documents create” Querying data with GROQ Now that you have a document you can query it with the API using GROQ (GRaph Oriented Query language). It is a declarative language designed to query collections of largely schema-less JSON documents. Its primary design goals are expressive filtering, joining of several documents into a single response, and shaping the response to fit the client application. To try it out, you can also do this right in the CLI when you are in a project folder, like this: sanity documents query "*[_type == 'post']" When you want to query content from your frontend, you can use one of the client libraries. There are libraries for , , and , with the latter one, you fetch documents like this: PHP .NET JavaScript client.fetch("*[_type == 'post']").then(documents => console.log(documents)) You can also type this into your browser and see the data there, or use anything that can send HTTPS requests: https://<yourProjectId>.api.sanity.io/v1/data/query=*[_type == "post"] With GROQ you can also do something called , where you have a lot of control over how your data is formatted. It’s used by inserting curly brackets after a filter, where you can select the fields you want inside them. For example, if we wanted to only include the `title` field for our posts, we could do this: projections {} sanity documents query "*[_type == 'post']{_id, title}" Migrating your content is easy The whole point of a hosted content backend is that it should be simple for you . Especially if you want to use it for something in production, you should have an easy way of duplicating that content into an environment where you can test and experiment. In Sanity, it’s straightforward to export all your content and assets in a neat (and a folder with all your assets), using the CLI: to migrate, duplicate, and move your data ndjson-file sanity dataset export <datasetName> And vice versa: sanity dataset import datasetExport.ndjson You can even get an instant ndjson dump of all your content using the export API (it’s 🚀 fast too!): https://<yourProjectId>.api.sanity.io/v1/data/export/<datasetName> Next steps… You should now have a basic understanding of the stuff you can do with Sanity. There’s a lot more to discover, but the nice thing is that you can do it step by step as your needs and ambitions rise. You may want to learn more about how you can , or , or dive into some advanced . You can also check out the frontend example in , , , and . completely tailor your studio for your clients need take advantage of the rich image metadata patching and mutation techniques React Native Vue Next.js Nuxt Whatever you choose to use Sanity for, there is also a that would love to hear about it and offers help if some roadblock comes in your way. community Originally published at www.sanity.io .

HackerNoon Tech Stories Archive November 10th, 2018

@wtfmitchelMitchel Lewis

@hnshahHiten Shah

@hpant81Himanshu Pant

@ShamirAllibhaiShamir Allibhai

@neilkakkarNeil

@neilkakkarNeil

@phil.taylor.mePhil Taylor

@bob_the_grownupBobTheGrownUp

@erikpmvermeulenErik P.M. Vermeulen

@b.sandeshSandesh B Suvarna

@senorcodecatCory Decker

@martinweigertMartin Weigert

@cryptokatiakatoshi ₿

@b.sandeshSandesh B Suvarna

@blockgenicBlockgenic

@blockgenicBlockgenic

@laurenjglass9Lauren Glass

@laurenjglass9Lauren Glass

@rabbalGholamReza Rabbal

@kmelveKnut Melvær

@whatbitcoindidPeter McCormack

@wtfmitchel
Mitchel Lewis

@hnshah
Hiten Shah

@hpant81
Himanshu Pant

@ShamirAllibhai
Shamir Allibhai

@neilkakkar
Neil

@neilkakkar
Neil

@phil.taylor.me
Phil Taylor

@bob_the_grownup
BobTheGrownUp

@erikpmvermeulen
Erik P.M. Vermeulen

@b.sandesh
Sandesh B Suvarna

@senorcodecat
Cory Decker

@martinweigert
Martin Weigert

@cryptokatia
katoshi ₿

@b.sandesh
Sandesh B Suvarna

@blockgenic
Blockgenic

@blockgenic
Blockgenic

@laurenjglass9
Lauren Glass

@laurenjglass9
Lauren Glass

@rabbal
GholamReza Rabbal

@kmelve
Knut Melvær

@whatbitcoindid
Peter McCormack