The developer behind the Red Dead Redemption: Damned Enhancement Project is fighting back against a copyright infringement lawsuit filed by Take-Two. Among other things, Johnathan Wyckoff states that he believes he was working within the rules published by Take-Two, which state that the company will not generally take legal action against non-commercial single player projects. Last August, calls for Take Two Interactive’s Red Dead Redemption (RDR1) to land on PC appeared they might be answered by the developer behind the ‘Red Dead Redemption: Damned Enhancement Project’. The supposed plan of ‘DamnedDev’ (real name Johnathan Wyckoff) was to modify the Xbox360 and PS3 versions of RDR1 and bring the game to the PC while improving the game with better graphics and additional features. In September 2019, however, Wyckoff revealed that he was being “bullied” by a corporation. A lawsuit filed at a New York court in December revealed that Take-Two was taking action to bring the . project to an end Citing breaches of its intellectual property rights (direct and contributory copyright infringement) and user licensing agreements, Take-Two said that it had repeatedly asked Wyckoff to cease and desist but when the project continued, it had no other choice than to take legal action. It did so on two grounds. Firstly, the lawsuit targeted the RDRII Project, which reportedly aimed to add the RDR1 game map to RDR2. It went on to make claims about the Damned Enhancement Project, which would reportedly enable users to play RDR1 on PC, where it isn’t officially available, “thereby destroying the market for an official, updated version from Take-Two, and creating competition for Take-Two’s PC-version of RDR2.” The case has been rolling on for several months now and this week Wyckoff filed an answer to Take-Two’s lawsuit along with a series of counterclaims. Describing himself as an “enthusiastic player” and modifier of Take-Two videogames, Wyckoff first provides a short background on what modding is all about, such as improving game graphics or changing features. He claims that this activity is accepted by gaming companies which typically publish a ‘mod policy’ to explain what type of mods are allowed. He believes that he acted within the boundaries set out in the Rockstar/Take-Two policy. “Defendant believes it was acting in accordance with the Plaintiff’s published policy on ‘PC Single-Player Mods’ which says that ‘Take-Two has agreed that it generally will not take legal action against third-party projects involving Rockstar’s PC games that are single-player, non-commercial, and respect the intellectual property (IP) rights of third parties,” Wyckoff’s answer reads, referencing the document below. From here, Wyckoff refutes many of Take-Two’s allegations, including that his RDR2 mod “did not contain maps” from the original RDR1 game and that the publisher’s description of the mod appeared to describe a previous mod he developed (RDRV) “that was abandoned in 2017 at the request of the Plaintiff.” As the above ‘mod policy’ lays out, to meet the criteria any mod must be non-commercial. In its lawsuit, Take-Two implied that donations solicited by Wyckoff were used to create the “infringing programs” which were then used to “drive followers” to his social media and streaming accounts. Wyckoff sees things differently. “Defendant asserts that it is a hobbyist and worked on the project without expecting or soliciting compensation for the mod,” he writes. “Defendant denies receiving any compensation for its mod projects.” In its lawsuit, Take-Two wrote that it had hoped to settle the dispute with Wyckoff without resorting to the courts. However, the company claims that rather than ending his activities, Wyckoff suggested that the project might get “leaked” by him or others. In his answer, Wyckoff admits to discussions with Take-Two but denies that he ever threatened to leak the project online. In any event, he says he’s in no position to do so. “Defendant no longer has access to the mod project files and does not intend to redevelop them,” he writes. “Defendant will not restart work on the now-lost mod files and has expressly agreed to same,” he adds, noting that all claims that Take-Two has been injured in any way are also refuted, not least since the mods were never released. In conclusion, Wyckoff says that since everything he did was within the parameters of Take-Two’s ‘mod policy’, all copyright infringement claims should be rejected and the court should issue a declaration to that effect or, in the alternative, determine that Wyckoff is an innocent infringer. Finally, he points to the fact that Take-Two’s ‘user agreement’ contains a clause that compels parties in dispute to enter into an arbitration process (that Take-Two must pay for) to settle their differences. Wyckoff wants that to happen. Wyckoff’s answer, affirmative defenses and counterclaims can be found here (pdf) Originally published as “ Red Dead Redemption: Damned Enhancement Modder Counters Take-Two Lawsuit ” with the Attribution-NonCommercial 3.0 Unported (CC BY-NC 3.0) license

Subscribe to our RSS feed

Read My Stories

Red Dead Redemption: Damned Enhancement Modder Counters Take-Two Lawsuit

Nowadays, as a webdeveloper, you rarely build anything from scratch: your daily job mostly consists of integrating various Javascript libraries together. If you are building a web app you are most likely going to use some framework like React, Vue or Angular for your front-end. To transmit and manage the data you will be using Redux or GraphQL. For the backend, there will be Express and probably Loopback. Then you need to cover everything with tests, so Jest, Mocha or Jasmine must be present too. Finally, there will be UI frameworks like Bootstrap and maybe some charting tools. I have already counted at least 7 core libraries and all of these are in a single project! And what about underlying technologies like Javascript itself, Node.js and, probably, Typescript? Well, that’s a lot! So how do you learn all of these tools? Of course there is a such thing as a documentation. Why documentation is important? There are two ways you can relate to documentation: you can either write or read one. Sometimes you are on both sides, but in most cases you are consuming a creation of other developers. You would not use any of the mentioned libraries, unless they were well documented, would you? Which brings us to the first point: People will not even consider your project unless it is well-documented This may seem obvious but, if your code is not documented, then the only way to learn what it does is to reverse engineer it. Would you do that yourself? Let’s consider the extreme opposite and imagine if React, for example, had no documentation. Then there would be only few geeks to try this new tool from Facebook, since it would require browsing over the source code to understand what it does and how to use it. Of course there will be no businesses or enterprises using a non-documented library. What kind of CEO or CTO would want to risk their company’s resources on a technology that has unpredictable onboarding time? Moreover, it would be hard for Facebook’s engineers themselves to support and maintain the codebase, which makes a second point: You will not be able to understand your code in 6 months I bet you know the feeling when you look at the code that you have written a few months or years ago and can not understand a single line. It is even hard to admit the code was your creation. Sounds familiar? The code may even look like it was written by someone much less experienced and may seem silly, but still you are unable to explain what is going on there. Why did you write this? At that moment an intense feeling of regret will creep in and you will start to realize the best moment to write a documentation was when you wrote the code, i.e. 6 months ago. Now, instead of reading the docs, you will have to read the code, and the code does not answer the question “why” it was written and does not explain itself. So the main purpose of documentation is to explain why you wrote this piece of software, including for yourself in the future. Documentation is a love letter that you write to your future self. – Damian Conway Documentation makes the code better You will have to think a lot about the design of your code when documenting it. Since you have to expose the whole structure of the code to the public, you will think twice about the way you built your project. Are there any parts to be refactored? Is there a way to implement some functionalities better or completely reorganize the code? So documentation process itself makes the code better. What to write? After it became clear how important documentation is, it seems that we can start creating one. However, before proceeding, I would recommend to stop for a while and do a step zero by clearly defining your target audience and understanding the value your project generates. Define your audience This one seems obvious but is often forgotten. It is better to clearly formalize who you are writing for. Who are your users? Are they mostly developers or designers? Experienced or fresh? Do they use your project in a large or small team? Etc, etc. Answering these questions will help you define an imaginary persona, which represents most of your users. Keeping this imaginary persona in mind will help you a lot, so the process of writing docs will look more like a dialog between you two. What problem your project solves The first thing to add to your document is a clear definition of what is the name of the project and what problem it solves. It is better to have one or two sentences. People are going to be visiting your page from many sources and, hence, have different perspectives. That’s why you have to be very precise and avoid vague descriptions. Simply state what your Javascript project is about, who it is for and what problem it solves. As an example of proper title and description, you can check out . Sing App React Admin Template documentation Quick start and installation steps Most people do not like to wait. So do your users. Let them launch and try your project as fast as you can. Prepare a simple short list of steps needed to setup the project and put it on top of documentation front page. Usually it may be a list of commands required to setup an environment and start the application. If it’s possible, it will be great to simply copy-paste these commands and have the entire application or library launched. Take a look at as an example: Rails Admin documentation A list of steps needed to setup the library is clear and easy to execute, which makes the whole project more attractive to use. Hopefully your users will be able to setup and launch everything, so now it is time to go a little bit deeper. Components and features documentation It is most likely that quick starting the project will not be the only option available to interact with it. There will be other parts, modules, components, features, classes, etc. You name it. E.g. pieces of your software that require separate documentation and provide an API to interact with it in some way. The first thing to do is to list all of these components and make a table of contents based on it with links following to the relevant pages. For every single piece of your documentation it is better to apply the same principle you apply to writing project description: name the component, describe what it is used for, what is the installation process, if there is one. What are the API methods and parameters, if so? Try to put yourself in a place of this imaginary persona you described earlier and imagine what would be the questions and difficulties integrating this particular component. Help them use it and leave no feature undocumented! A list of steps needed to setup the library is clear and easy to execute, which makes the whole project more attractive to use. Hopefully your users will be able to setup and launch everything, so now it is time to go a little bit deeper. is a great example of structuring docs. You can see the menu of all available documentation parts on the left side and interact with particular component in the middle of the page. Firebase documentation License and contribution instructions There must be something that guides relations between your project and its users. You have to decide under what conditions your software is distributed and can be used. There are lots of standard licenses available around the web, so it is up to you to pick the right one for your project. The most popular ones are: BSD, MIT, Apache GNU licenses. They are open source, so keep that in mind. Proprietary licenses vary a lot from project to project, so this can be a separate topic. If your project is open source then you are expecting people to contribute. Hence it will be very helpful for them to have some sort of guidance from you. Let them know where they can report issues, ask questions, what are the restrictions or prior assumption before contributing, where they can find issues, etc. Otherwise you are about to lose a great amount of thankful supporters and maintainers. Tips on writing documentation We will not be able to predict all the use cases and the way users will use your documentation. In general it is a great principle to keep imagining yourself as your user and organize everything based on this point of view. However, here is a short list of general tips every project documentation must follow: People will simply copy and paste your code. Keep this in mind and make sure to double check this yourself by executing it. Avoid placing some invisible characters to code examples. It is even better to use and tags to embed code blocks. code blockquote Keep your documentation updated. Every change in code must be followed by a relevant change in documentation. Otherwise documentation soon becomes outdated, which is equal to the absence of documentation. Code comments are a part of documentation. This is the last and very important one. If your project is open source, users are going to be reading through your code, hence inline comments will help them a lot. Furthermore, there are tools like that generate documentation based on code comments! So you do not have to write anything in a separate file. Simply feed this tool with your codebase and, voila, you have the documentation. JSDoc Tools to speed up the process Why would you want to write and create everything from scratch and by yourself if there are so many documentation tools available? Nowadays generating documentation, especially if you produce high-quality code with inline comments, is a matter of running a single command. So let’s overview documentation tools available in 2019. JSDoc JSDoc is the most popular Javascript documentation generator. All you need to do is to simply run jsdoc command with a filename as an argument. That is it. It will generate HTML file with documentation that is ready to use. The website is . https://github.com/jsdoc/jsdoc Docusaurus Docusaurus is a more complex tool that allows you to generate entire documentation website based on markdown files with documentation contents. It is based on React and supports versioning, so you can easily maintain different versions of the documentation generated in the past. Other great benefits are embedded search and multi language support, which is crucial for popular repositories. The website is . https://docusaurus.io/ apiDoc apiDoc creates a documentation from API annotations in your source code. It is a great tool to generate a documentation for a project that has and exposes lots of API methods. It allows to customize everything a lot, e.g. specify parameters, error codes, response samples, etc. The website is http://apidocjs.com/ Great examples of JavaScript project documentation When creating something new it is good to have some sort of example, something you can refer to. So here is the list of various projects you may get your inspiration from. All of them are great, so pick one you like the most. Firebase React Admin (a documentation to one of our own projects. We invested around 250 hours composing these docs); Template Bugsnag Ruby on Rails guides Cat Boost Summary I hope that you found this article useful and it will help you a lot when creating documentation for your javascript project. Googling the Internet tells that documentation is a key to success in any Javascript project, and I strongly agree with this rule. Documentation is sort of a facade that people face and resort to when using your project. So always keep it updated and put yourself in place of your users! Text source: - React, Angular, Vue, Bootstrap & React Native templates and themes. https://flatlogic.com The link to the original article: Writing Documentation For Your JavaScript Project

Apache

bugsnag

Facebook

Geeks

Target

Check out Flatlogic React, VueJS, Angular and Bootstrap Templates!

Winner of Noonies 2020 for the award Hacker Noon Contributor of the Year - REACTJS.

2020 - Hacker Noon Contributor of the Year in REACTJS

2022 - HackerNoon Contributor of the Year - Frontend

Nominated for 2022 - HackerNoon Contributor of the Year - Frontend

Creating Beautiful Documentation Website For Your JavaScript Project

The sharing economy is fast transforming how we interact as people and work. Valued at around $15 billion five years ago, the sharing economy is predicted to be worth over $335 billion by 2025. The potential for the industry is massive. Based on peer to peer (P2P) activity where individuals acquire, provide, or share access to goods and services through a platform, some skeptics believe that the blockchain’s role is minimal in this industry. But, contrary to this belief, blockchain has a more significant role to play. The Problem With The Sharing Economy According to the , a group of experts dedicated to research and development of the technology, the sharing economy suffers from a poor model where the revenue generated isn’t fairly shared with all the members involved. Also, there is an issue with how platforms like Uber and Airbnb act as intermediaries in what are supposedly peer-to-peer transactions leaving participants with no option but to follow the terms and conditions on offer. Blockchain Council Direct connections are highly discouraged. Even though these platforms may offer decent user interfaces, individuals cannot communicate with each other outside the platforms without violating the terms of service. These companies have the power to dictate prices, and they also take a considerable chunk of the earnings in a supposedly “peer-to-peer” system. Additionally, there have been cases of safety and crime. Even though incidents occur rarely, there have been reports of sexual assaults with Uber 2,936 cases in 2017 and 3,045 cases in 2018 in the US alone. Other ride-sharing companies such as Grab in Malaysia and Ola in India have seen similar cases reported. cataloging Astonishingly you can even find entire dedicated to horror stories about Airbnb from both the guests and hosts. From , theft, prostitution, and even voyeuristic hosts using spy cameras to watch guests. websites shootings during Halloween Even though a platform like Airbnb does undergo background checks to improve security, the verification process can be improved. Blockchain can help with verification of identity and background checking, thus making the process more efficient. It can even go a step further to incentivize good behavior and punish bad actors. The decentralized nature of the technology ensures databases are safer, limiting the vulnerabilities of centralized servers. Rise Of Blockchain-Based Sharing Economy Platforms With the many benefits the sharing economy stands to gain from the technology apparent, we are witnessing the emergence of blockchain-based platforms in the sector. blockchain Blockchain’s role in the sharing economy is being facilitated by protocols like that offers a platform where new projects can build a sharing economy service. The project also believes it can solve some of the issues within the gig economy. Having launched last year, the project uses “time tickets,” allowing users to tokenize their business hours. These tickets can be bought in exchange for various services, including consulting, photography, and relationship counseling. Other potential use case includes offering financial advice, fortune-telling, programming, and coaching. TimeCoinPrototol According to , “TimeTicket has already succeeded in raising $3.2 million in equity, and now, an initial exchange offering is being planned in Hong Kong to get the TimeCoinProtocol up and running. A total of 100 million TimeCoins (known as TMCN for short) are going to be issued, 58% of which will be allocated to the token sale.” Cointelegraph TimeCoinProtocol is just one platform that is utilizing the blockchain to offer benefits to the sharing economy, there are others like Origin based on the Ethereum blockchain, and a few others that can be seen on , a platform that lists top DeFi projects. Defiprime.com The sharing economy is expected to grow much faster than traditional operating companies. One found out that between 2013 and 2025, the revenue of sharing economy will grow by a mind-boggling 2233%. In contrast, companies with traditional operating models will increase their income by just 39.6%. study by PWC The study conducted in 2015 also found out that around 44% of Americans were familiar with the sharing economy business model, and 19% had already tried it. Fast forward to 2020, and this number has increased tremendously. predicted that over 86 million Americans would be taking part in the sharing economy by 2021. This number is almost double the 44.8 million Americans exposed to the sharing economy by 2016. Statista According to Credit Suisse, 17% of people were open to the idea of sharing their sofa. This goes to show how the sharing economy is gaining popularity with more people willing to share items they don’t frequently need. According to , over 700 million Chinese citizens took part in the sharing economy back in 2017. That more than half the entire population. The industry was estimated to be worth more than $760 billion at the time. China Daily According to , hotels worldwide are losing over $450 billion annually due to the platform. More people prefer using the platform since its cheaper, and while you are at it, you can even rent one of the 1,400 islands available, or choose a castle from the 3,000 available. Airbnb Ultimately, the blockchain will help platforms in the sharing economy sector reduce their reliance on corporations. By eliminating managers, intermediaries, and employees, fees will be reduced significantly. Security is guaranteed using an in-app rating system that is censorship resistant since it's based on the blockchain. Additionally, fairness is also ensured through a financial incentive as users administer the platforms collectively. Dislosure: I don't have any vested interests in any mentioned projects.

AirBnB

fees

Uber

Winner of Noonies 2020 for the award Hacker Noon Contributor of the Year - CRYPTO.

2020 - Hacker Noon Contributor of the Year in CRYPTO

2022 - HackerNoon Contributor of the Year - Defi

2022 - HackerNoon Contributor of the Year - Ethereum

Click to contact me via Telegram

Nominated for 2022 - HackerNoon Contributor of the Year - Defi

Nominated for 2022 - HackerNoon Contributor of the Year - Ethereum

How Blockchain Technology Is Aiding The Rise Of The Sharing Economy

In this article, we’ll take a look at building a secured REST API by integrating with as the identity provider via OpenID Connect (OIDC). This article is based on the DZone article , which explains how to create a Java REST API with Quarkus and Okta. We will be implementing a similar scenario here by using , and show how it’s simpler and more straightforward to implement compared to our Java counterpart. Okta Building a Java REST API with Quarkus Ballerinalang Prerequisites (>= v1.2.6) Ballerina Installation Verify the installation by typing in the command line. This should output the currently installed Ballerina version. ballerina -v Okta Developer Account: An Okta developer account can be created by navigating to . https://developer.okta.com/ CURL or another suitable HTTP client for your respective environment. Hello World Ballerina Service Let’s start off by creating a simple hello world service application as our base scenario. Add the following code to a file named hello.bal. Listing 1: Hello World Service The above service can be run by using the following command: $ ballerina run hello.bal
[ballerina/http] started HTTP/WS listener 0.0.0.0:8080 The final source code of our hello world service can be found . here Let’s invoke the service by sending a request. $ curl http://localhost:8080/secured/hello
Hello Anonymous, authScheme: N/A Here, the service is invoked through HTTP without any form of user authentication. A Secured Greeting Let’s update our hello world service in order to authenticate users who invoke it using a JWT. Listing 2: Secured Hello World Service with JWT We have done several new things to our earlier service implementation. First, our HTTP listener that was bound to the service construct has been changed from to . Earlier we created an anonymous HTTP listener object in place, and now, we have created a separate HTTPS listener object and referred to it from the service. This approach is required when we want to provide additional configurations to the listener compared to the inline creation. A Ballerina service is not limited to having only one listener, but it can have multiple compatible listeners attached to a single service at a time. The listener object simply needs to be given as a comma-separated list. HelloService new http:Listener(8080) httpsListener HTTP listener objects provide the functionality to associate a set of authentication and authorization providers. In our case, we have created a single JWT inbound auth provider and registered as an auth handler in the HTTPS listener configuration. In Ballerina, it is mandated that a secure transport should be used in an authentication scenario such as in our case. This is where a bearer token is sent through the headers and would be susceptible to a man-in-the-middle attack if a secured protocol is not used. Figure 1 shows a summary of the relationship between the Ballerina services, listeners, and authentication providers. Figure 1: Ballerina Service-Listener-Authentication Provider Relationship Let’s try invoking the updated service above. $ curl -k https://localhost:8443/secured/hello
Authentication failure. As we see above, the invocation to the updated service resource fails with an authentication failure. The service returns an HTTP 401 Unauthorized message. This can be checked by passing in the -v switch to the CURL command above. The and the files are keystore files used in the HTTPS communication. For the purpose of this demo, I’ve copied them from Ballerina default keystore files, which can be found at . can be found by executing ballerina home in the command line. For JWT signature verification, the public keys are provided using the JSON Web Key Set (JWKS) format. This is shown at line 9 in Listing 2. truststore.p12 keystore.p12 ${BALLERINA_HOME}/bre/security/ ${BALLERINA_HOME} In order to access the service, we have to send a JWT with the service request to authenticate the user. Let’s see how this can be generated using OIDC with Okta. OIDC Application Integration with Okta In this section, we will use our Okta developer account to create a new OIDC application, and then generate a JWT in order to invoke our secure service. These are the steps you need to follow: Navigate to your domain by clicking on the top-right menu and selecting Your Org Click on and then Applications Add Application Select the application type Web Provide a name, e.g., Ballerina Demo Update the with “ ” Login redirect URIs https://oidcdebugger.com/debug Under set Grant type allowed Implicit (Hybrid) Leave the rest with the default values Click Done Note down the Client ID We will also add some custom scopes to our authorization server in order to use them in our services. Click the top menu API -> Authorization Servers Select and click default Scopes Add the new scopes , , , and greet products_access products_add products_delete The updated scopes will look similar to Figure 2. Figure 2: Okta Authorization Server Scopes Now, we can execute an OIDC request in order to create an access token to authenticate users for our service. Let’s navigate to . https://oidcdebugger.com/ Figure 3: OIDC Request Generation with https://oidcdebugger.com/ As shown in Figure 3, fill in the and fields with your respective values. Note that we have provided the scopes , , , and , which is required for our service resource. After the fields are filled, click and you will be presented with a screen similar to Figure 4. <your-okta-domain> <your-client-id> openid email profile greet Send Request Figure 4: OIDC Response with the JWT Access Token Copy the access token that is generated, and set it as a shell variable. $ TOKEN=eyJraWQiOiI3... Now that we have a JWT token to authenticate the user from Okta, we will be able to use this with our service to do the authentication. $ curl -k -H https://localhost:8443/secured/hello
Hello lafernando@gmail.com, authScheme: jwt groups: Everyone "Authorization: Bearer " $TOKEN As we can see above, now the service invocation succeeds, since we provided a valid JWT token. Also, in our service implementation, we have stated that we require the scope in order to invoke the resource in the service.  We can create another access token using without this scope and see that we cannot invoke the service resource anymore. greet hello https://oidcdebugger.com/ Data Service with Access Control Now that we know the generation functionality of using OIDC in creating the JWT for our services, let’s create another general scenario for using access control in our service. We will be creating a simple data service that represents a product catalog, where we will control the reading and writing operations of it based on the authenticated user’s privileges. For this, we will be using the scopes , , and . products_add products_access products_delete Listing 3 shows the implementation of this data service. Listing 3: Product Catalog Data Service Here, we can see we have simply mapped the service resources with the service paths and respective HTTP methods in order to define the functionality. Each resource requires a specific scope in order to invoke the resource. In this manner, we can have a fine-grained access control mechanism when defining the operations in our system. The service above can be tested by creating tokens with different scope combinations to verify the access control features. Sample Run The full source code of our product catalog data service can be found . here $ ballerina run product-catalog-service.bal
[ballerina/http] started HTTPS/WSS listener 0.0.0.0:8443

$ curl -d -k -H https://localhost:8443/ProductCatalog/product
Authorization failure.

$ curl -d -k -H https://localhost:8443/ProductCatalog/product
Authentication failure.

$ curl -d -k -H https://localhost:8443/ProductCatalog/product

$ curl -d -k -H https://localhost:8443/ProductCatalog/product

$ curl -k -H https://localhost:8443/ProductCatalog/product
Authorization failure.

$ curl -k -H https://localhost:8443/ProductCatalog/product
[{ : , : , :899}, { : , : , :599}]

$ curl -X DELETE -k -H https://localhost:8443/ProductCatalog/product/id1
Authorization failure.

$ curl -X DELETE -k -H https://localhost:8443/ProductCatalog/product/id1

$ curl -k -H https://localhost:8443/ProductCatalog/product
[{ : , : , :599}] '{"id":"id1","name":"Pixel 4 XL","price":899.0}' "Authorization: Bearer " $TK_GREET '{"id":"id1","name":"Pixel 4 XL","price":899.0}' "Authorization: Bearer " $TK_PRODUCT_ACCESS '{"id":"id1","name":"Pixel 4 XL","price":899.0}' "Authorization: Bearer " $TK_PRODUCTS_ADD '{"id":"id2","name":"Pixel 3","price":599.0}' "Authorization: Bearer " $TK_PRODUCTS_ADD "Authorization: Bearer " $TK_GREET "Authorization: Bearer " $TK_PRODUCTS_ACCESS "id" "id1" "name" "Pixel 4 XL" "price" "id" "id2" "name" "Pixel 3" "price" "Authorization: Bearer " $TK_PRODUCTS_ACCESS "Authorization: Bearer " $TK_PRODUCTS_DELETE "Authorization: Bearer " $TK_PRODUCTS_ACCESS "id" "id2" "name" "Pixel 3" "price" Summary In this article, we have looked into how we can secure a REST service written in Ballerina using Okta as the identity provider. We have used OIDC when generating a JWT access token to access our service resources. For more information on writing microservices in Ballerina, check out the following resources: Ballerina by Example Ballerina API Documentation

Different

Checkout my Ballerina programming language book!

How to Build a Secure REST API with OpenID Connect

A spate of data breaches in the past year has refocused user attention on online security, particularly on cloud platforms. Cloud storage has become standard in recent years as a way to keep documents and projects conveniently synced and accessible across devices. Computer hard disks can be damaged and smartphones can be lost, but files stored in the cloud can be accessed simply by having an internet connection. Typically, cloud storage is secured with multi-factor authentication and automatic security notifications when suspicious activity is detected. These steps help protect your files or data from getting into the wrong hands. However, no system is perfect, and cloud data breaches confirm that. When the massive data breach at Dropbox happened in 2012, few people understood its severity. It was only announced four years later that hackers tapped into more than 68 million personal accounts – accessing data like email addresses and passwords – representing nearly 5 gigabytes of data. In January 2019, Apple announced that a bug in its platform had resulted in exposed iCloud user . data Following on the heels of the iCloud breach, hackers compromised Lumin PDF’s contact database in late 2019, resulting in the exposure of Lumin users’ non-sensitive details, such as gender and name. Several months later, the company reports that they have tightened security around the platform to safeguard their users’ privacy. Is Lumin PDF safe? Recent update Lumin PDF stores user data on the MongoDB . Currently, it’s one of the most popular NoSQL databases, used by Google, Adobe, Paypal, and many others. Among MongoDB’s strengths are a flexible data model, excellent query performance, and high scalability. As a rule, it’s a high-database for a variety of projects across industries. database What was not known about MongoDB initially is that it had been operating using outdated instances that opened its clients up to attack. David Kirkpatrick, security expert at SpiderLabs, says MongoDB’s multiple interfaces are inherently weak. “By default, the service will bind to all available interfaces, which can be problematic. You could essentially expose the whole database to a less trusted DMZ," says Kirkpatrick. Furthermore, the IT giant failed to provide an authentication mechanism when used in certain modes. The results of MongoDB’s negligence were catastrophic. In 2019, scores of companies that had been running on the server became the victims of a chain of attacks by cybercriminals who deleted data from the original database after copying it to their own servers. In the resulting breaches, the records of over 800 million users were stolen and held for ransom in Bitcoin. As companies rushed to meet the hackers’ demands, it quickly became clear that the hackers did not intend to return all data. Many companies that handed over the ransoms were rewarded with empty databases despite meeting the demands of the cybercriminals. Other companies, wary of falling into the same trap, refused to negotiate with the hackers. After attacks on Mongo databases, hackers successfully diversified efforts to many other servers, including Hadoop, Cassandra, ElasticSearch, MySQL, and CouchDB. MongoDB, Inc., the company behind Mongo databases has since fixed this security issue by releasing a new MongoDB 2.6.0 database version accessible only by local connections. Lumin PDF breach: Summary When Lumin PDF announced the data breach, many users of the Lumin PDF extension and Lumin PDF app panicked, thinking that their Google Drive was hacked. These fears, thankfully, were ungrounded. Ferguson later confirmed the hackers had been successful in accessing only users’ names, email addresses, gender, and language settings. Credit card details and passwords remained secure. The leaked data was from a software application that is used by the Lumin PDF team to test new features. As a result, the leaked data was at least 8 months old. Google access tokens allowing users to access their Google Drive accounts included in the leak expire about one hour after their creation, so their was no risk that any files were compromised. Because of this, the attackers gained access to a very limited range of data. Lumin’s security system blocking access to all user documents, signatures, and sensitive data remained uncompromised. Lumin PDF reviewed the incident right away, implementing strong internal security policies to prevent any similar incident being repeated. Since the breach, the Lumin PDF security team took a serious look at how they could put more teeth in their security stance. “We are always reviewing how we can strengthen protection around our databases. We employ encryption and role-based access control, as well as a rigorous set of security policies,” says Lumin PDF’s CEO, Max Ferguson. “We’ve implemented multi-layered security, a strategy that protects data by multiple strong layers of security. Out of all the companies that were targeted in the MongoDB breaches, a significant number of them are also implementing these measures.” Lumin moved immediately to fortify its defenses with: cybersecurity Role-based access control intensified. Lumin has heightened authentication requirements at the same time as narrowing access controls. This reduces the risk of a breach internally. Transport Layer Security implemented. Cybercriminals use a man-in-the-middle attack (MITM) to covertly intercept communications between two parties. Sometimes, they then alter this information without the receiving party catching on. Following the Lumin PDF security breach, the company added Transport Layer Security (TLS) onto its existing encryption. TLS is widely considered superior to other types of encryption due to its simultaneous utilization of two kinds of encryption: private key and symmetric. Secured doubly, it is able to securely send sensitive data. At the same time, TLS reduces response times by detecting possible message tampering and notifying the system automatically. Multi-layer encryption launched. Lumin PDF users now have every bit of their data doubly protected with secure session tokens. If a hacker succeeds in breaching the first layer of security around the database, data will remain protected by the encrypted session tokens. Continuous system auditing implemented. Lumin PDF has enabled round-the-clock monitoring of suspicious activity. If the system detects any unusual events, it is set to notify admins immediately and it records audit events in a file or a syslog connection. A security information and event management tool (SIEM) then analyzes security events occurring on the network and identifies in real time malicious activity. Tightened firewall protection. Beefed up firewall protection protects Lumin PDF servers and databases. Clearer link sharing policies. Now when users create a new file, they reconfirm their sharing settings each time. This helps users avoid unintentionally sharing a document. Risk is an inherent part of technology use, whether data is being stored locally or in the cloud. Shuman Ghosemajumder, Global Head of Artificial Intelligence at F5, the expectation of 100% security “untenable” because of how rapidly hackers evolve their attacks. Ultimately, the most important factor in data security is the willingness of an organization to consistently reevaluate its security stance. At the same time, it’s essential to assess risk wisely for any platform before you use it. Is Lumin PDF safe? This is a smart question to ask before entrusting your documents to any cloud platform. Lumin PDF’s intensified security measures show that the company is not taking user security lightly - and that seems to be reflected in the results. There have not been any further incidents and, if the past year is any indicator, there won’t be.

Chain

Adobe

Apple

Dropbox

Google

Is Lumin PDF Safe to Use? 

- the state of US Presidential election voter turnout since 1972 - Democracies should fairly and accurately maximize participation in order to elect a candidate of the people. The reality in America is at least 2 out of 5 eligible voters don't vote. If all the people who didn't vote, voted for one candidate, that candidate would win every year. In recent conversation, said "I'd be a lot more likely to vote if i could vote against somebody I oppose."  Got me thinking, would our elections be more closely aligned to the people's will if individuals had an option to spend their single vote against someone instead of for? photographer Mike Valigore It takes energy to vote. It takes time to research. In going through the youtubes, the personal sites, the post office, the sign in yard index, the local news stories - it all comes down to the citizen choosing to exercise their limited brain supply in order to fulfill their civic duty. In that process, voters often learn what is not right before they learn what is perfect. To endorse someone is to risk personal reputation. It's a lot easier to know you don't want something. If voters could choose to have their one vote be a downvote against Trump - instead of a vote for Biden - I believe not only would voter turnout be higher, but also, we'd have a more accurate count of the people's will.  There is time, energy and opportunity cost in going to the polls, and registering to vote for that matter. Citizens don't generally get paid to leave work to participate in democracy. That opportunity cost means citizens have to believe in candidates more to sacrifice their time to vote. Looking back on the local government meetings I've been to, when attendees speak up, more often than not, it's to oppose something than it is to advocate for something. Also consider John Bolton, he recently went to promote his book and said he'd be voting for neither Trump or Biden in 2020. Whatever your opinion on his foreign policy or decision not to testify in the impeachment hearings or his $2M book advance, here's a man that has dedicated his life to the government, worked in four presidential administrations, and is with a straight face reaching the conclusion that his 2020 vote is worthless. on the Tonight Show Now you could argue that a lot of this could be solved by abolishing the two party system, but that's a whole other can of worms, and with this piece I'm simply arguing that the downvote could move voter turnout upwards. Our current level, 49-58% voter turnout in the last 50ish years, is not the level of a healthy democracy IMHO. A healthy voter turnout rate in a pure two party system should be a minimum of two thirds. This ensures that if everyone who didn't vote, instead voted for a single third party candidate, the same candidate would still win because they'd have the majority of two thirds. While only two parties have a realistic chance to win a general presidential nomination in America, this country is not a pure two party system as independents can make it on the general ballot. Third parties have never won a presidential election in US history, but From Ross Perot to Martin Van Buren to even Theodore Roosevelt, have historical swung states by garnering votes that could have gone to one of the two main candidates.  Kanye West, who has sold , has announced , and this fall, may be able to convince a significant portion of his fanbase to give them his vote instead. third party presidential candidates 14.5 million albums in America his candidacy There are millions of Americans who are against Trump and not for Biden. There are millions of Americans who are against Biden and not for Trump. These millions will have a very low voter turnout in 2020 because they cannot vote their opinions. Life long conservatives who are against Trump probably can't stomach voting for Biden, a life long democrat. And the Bernie supporters who think Biden represents all that's wrong with the Democratic party probably can't stomach voting for Trump. If people want to be against someone instead of for someone, let their voice be heard instead of bucketing their voice into an inaccurate endorsement, or even worse, the ether.

smooke.eth

Ethereum Name Service

Try Our Next Text Editor! Smooth. AI Images. Markdown. ChatGPT Replies.

Book a call

Personal Site :-) 

Resume /ClarkKent

Growth Manifesto Interview

Clever Programming Interview

John McAfee Interview

Smooke.eth

Founder & CEO of HackerNoon

The Downvote is Democratic

Flow

Alongside

Amazon

Asana

ATLASSIAN

Ball

Basecamp

Instantly

Microsoft

Routine

Slack

Super

Trello

Velocity

Check out Codegiant 

29 Asana Alternatives: The Ultimate Breakdown

Introduction So you've decided that with your next project you are going to tread the RESTful path. But to be smart about it, you need an intelligent tool to ensure quality and productivity. With the abundance of options available, let's thumb through some of the developers' favorites. First things first - API definition is a popular choice with graphical visualization. APIs can be defined either in JSON or YAML. Additionally, you can generate a server-side or client-side stub for most of the relevant technologies (from ASP.net core and Kotlin to Nodejs and Python). Swagger Editor is an open-source project, and elegant tool with support for and YAML. What you get: Apicurio simple JSON Importing APIs from source control, file, URL Integration with your GitHub, GitLab or Bitbucket account Previewing live documentation Visual editors for designing APIs on Open API standard (no coding skills required!) Watch it go! - Tests and monitors is an intuitive and well-organized desktop tool. It is one of my personal favorites as it was the first-ever tool that I used to test my own APIs and the learning curve couldn't have been smoother. The product is well-rounded as it covers the API development from to and . Postman creation testing monitoring With Postman, you can: add mock servers, switch between environmental setups, generate documentation, apply custom styling. Medium and large teams will appreciate the personal and team workspaces, and that work similarly to that of any version control system like . You can also add a basic API monitor (runs on a minute, hour or week basis) and get about failures. fork merge features GitHub email notifications is a powerful . Minimalistic in appearance, it allows the creation of projects for HTTP API calls. After you fill in the request and response data, test code is auto-generated. You can also create in JavaScript (or CoffeeScript) that are invoked before each test. Ping API API inspector set-up scripts It has a few basic for parsing, decoding and encoding URIs. In case of failures, a notification is sent via email, Slack or Hipchat. It's especially useful for web developers whose sites need to be responsive around the globe. Tests check APIs responses from 5 locations in 3 continents: in U.S.A., Japan, Germany and Singapore. You can to run tests from 1 minute to a full day. built-in functions schedule is an easy-on-the-eye monitoring tool with and . API Science lets you check , , and of your or third-party APIs and automatically notifies about failures. The dashboard is straightforward to use and intuitive. API Science graphs charts health availability performance You can upgrade your monitoring with to run with tests (e.g. to load or parse data from JSON) or generate a report (not downloadable). A nice touch is the import option from other popular API-related tools: Postman, Swagger, RAML, HAR. Sad news for the Southern Hemisphere, servers that are located in the US, Japan and Ireland. custom JavaScript scripts -  is an advanced platform for for tight integration with your CI/CD pipeline. ReadyAPI is a combination of 3 tools available for separate licence purchase: SoapUI Pro (functional testing), LoadUI Pro (performance testing), ServiceV Pro (service virtualization). They describe themselves as "the Most API Testing Tool on the Market", and they might be right. ReadyAPI functional, security, and load testing Advanced ReadyAPI options are vast and can be intimidating to learn at first. It's not cheap as it's aimed at large companies with large products and complex tests. The projects integrate with several CI/CD tools: Git, Docker, Jenkins, Azure DevOps, TeamCity, and more. Good news for tight budgets: there are available for Windows, Linux and Mac, however, the tests are slower. open-source free versions is a desktop app for debugging your API spec with Git sync option. The "Design" section offers with detailed error messages. The auto-generated preview might remind API-navvies of Swagger Editor. In the "Debug" section you can tinker your API with: Insomnia style validation with cookies, query and header, body of request is filled in editor; Sending request Environments configured as JSONs; Support for multiple : Basic, Digest, Bearer Token, Microsoft NTLM, OAuth, AWS IAM, Hawk, Atlassian ASAP, Netrc File; authorization options Client-side code snippet generator for multiple languages, some with different library implementations. The platform can be extended with made by Insomnia community. The plugins cover JWT and token generators, environmental setups, XML-JSON translators, randomizers and UI themes. With plans, teams can collaborate and host the project in the . installable plugins paid cloud is a free tool dedicated to testing HTTP and REST APIs. The significant functionalities are: Talend API Tester Sending requests and inspecting responses Validating API behaviour Importing Postman, Swagger, OAS, OpenAPI, HAR test collections With API Tester you can create dynamic requests with custom variables, security and authentication and keep them organized as projects or services. You can run assertions against the responses of different formats (JSON, XML, HTML and others). are created in visual editors. Assertions Bringing the API out to the world is an online platform that enables you to , , APIs and expose its functionalities via a portal for your consumers. From all the online tools mentioned in this smackdown, Apigee set itself apart from the others with the most elegant web experience, analytical tools, proxy creator, and . Apigee build manage consume sweet website generator If you need to adopt a SOAP service into a REST one, or you consume API but would like to expose API's backend services via a middleman, you are presented with proxy wizards with lots of policy options (quotas, authentications, data mediation, caching). Apigee offers the consumer, neat, modern and straightforward portals including interactive sites for your APIs. The portal templates, with CSS themes, HTML and user management premade is ready to be customized or published right away. To ensure world-class API performance, their and charts cover: auto-generated documentation analytics tool latency, response time, geographical distribution of API usage, proxy performance, error code analytics. Putting the moving parts together is a sophisticated developer tool for , and . The main use scenarios are: Linx backend integrations automations web services Building, hosting and with one platform, managing multiple APIs Consuming and orchestrating data across many technology end-points, Accelerating API Development, Simplifying existing APIs. Linx is particularly powerful for creating or calling internal and external REST web services. It is on the fastest ways to extend an API that requires (e.g. you need to load or push data into a database, conjure up a rapport, push updates to notification steam, modify or encrypt data at any point, etc). integration with other technologies Alongside REST, Linx offers several other features from database to cryptography and cloud, which creates tons of possibilities for integrating your API with multiple different technologies. The Linx IDE Designer is a great, free option for carrying out tests and service calls. If you want to monitor and automatize the test suits or schedule calls either in , you will need to upgrade to the paid Linx Server. on-premise or cloud Feature smackdown Still at a lost? Use the comparison table below to help yourself decide. Conclusion With REST's and APIs' taking root in the digital world, one can only expect more tools to appear. Now that you had a glimpse of options above, tailored for different needs of various size teams, projects and capabilities. If you are not happy with your current choice, it's easy enough to hop and experiment. Let me know your favorites in the comments below. Happy hunting.

Southern

REST API Tools Smackdown

HackerNoon Tech Stories Archive July 10th, 2020

Red Dead Redemption: Damned Enhancement Modder Counters Take-Two Lawsuit

@torrentfreak
TorrentFreak

Creating Beautiful Documentation Website For Your JavaScript Project

@ana
Ana

How Blockchain Technology Is Aiding The Rise Of The Sharing Economy

@Sergeenkov
Andrey Sergeenkov

How to Build a Secure REST API with OpenID Connect

@lafernando
Anjana Fernando

Is Lumin PDF Safe to Use?

@rana-raj
Rana Raj

The Downvote is Democratic

@David
David Smooke

29 Asana Alternatives: The Ultimate Breakdown

@momchil
Momchil

REST API Tools Smackdown

@marta-krzyk
Marta Krzyk

HackerNoon Tech Stories Archive July 10th, 2020

@torrentfreakTorrentFreak

@anaAna

@SergeenkovAndrey Sergeenkov

@lafernandoAnjana Fernando

@rana-rajRana Raj

@momchilMomchil