Get the most recent info and news about App Guardians on HackerNoon, where 10k+ technologists publish stories for 4M+ monthly readers.

App Guardians

In the ongoing epic struggle between developers and buggy software, we need all of the tools at our disposal to hold back the ravening hordes of runtime and logic errors. But here is a warrior who holds back the evil armies of Tech Debt even as they infiltrate our own ranks: Continuous Integration. Why focus on the “CI” of the CI/CD pipeline? Continuous Delivery (CD) offers great benefits but also comes with substantial risk just by itself. A bug written at 9:35 a.m. might break production before lunch and then spend the whole afternoon demoralizing the team and possibly losing sales. is the complementary tool designed to substantially reduce the likelihood of such a scenario because a failed CI means the CD doesn’t happen. If the CI fails, the code shouldn’t even be allowed to merge into the main branch. Continuous Integration (CI) The CI process augments the code reviewer’s power to protect the repository by offering some concrete standards. It frees human eyes to focus on other things like trade-off choices and how the problem was approached. It helps keep the project in a maintainable state. Developers don’t have to be afraid to refactor when needed, even in a less familiar part of the code. A good CI process also enforces a certain level of uniform coding styles, reducing the risk of a big hodge-podge. It also reduces unpleasant surprises. A developer might run checks locally and then confidently check in their commits, believing all is well, but surprise! Sometimes, the commits don’t behave as well in a non-local environment. In short, you might think of CI as the warrior who stands tall and strong between mistakes and production. Caveats An epic hero fending off an entire army of bugs and errors needs to be properly outfitted. Such a warrior needs the finest armor and sharpest weapons to be effective — like a well-designed test suite that covers every edge case. But if your static checks ignore too many things or if your tests have been neglected, you may be sending out your hero with only a jacket and a baseball bat. It’s better than nothing, surely, but that poor hero will have an awfully hard time defending the castle. Deploying your CI Different projects will have different quality check needs, but on a high level, you will want to Run the static analysis tools for your project’s language(s) Run your tests and ideally enforce a degree of coverage Choose your tool There are a number of CI/CD tools available, including Travis, Jenkins, CircleCI, CodePipeline, etc. The major repository sites also all have their own sets of tools. My most recent project was a Django website with an app named “enterprises.” I decided to create my CI by writing a YAML workflow for GitHub Actions. Define the events on: [push, pull_request] Since it’s just me working on the project, I don’t need anything elaborate. I have defined only two events for triggering the CI workflow: push and pull requests. Whenever a PR is created, and after any pushes to that PR, the workflow will run. It also runs whenever the main branch is updated. Define the jobs A GitHub Action job is a set of steps to be taken, and any workflow can have one or more jobs. Jobs will run in parallel by default but can be configured to wait if one job is dependent on the outcome of another. First, I gave my job a name (I settled on “build”) jobs:
  build: And an operating system. jobs:
  build:
    runs-on: ubuntu-latest My project is a website, so there’s no need to support multiple operating systems. Define the services Not all jobs will need a service, but I chose to set up a PostgreSQL service for my tests. The ability to run tests locally using SQLite is wonderful. It’s lightweight and requires no maintenance. However, since the occasional problem does pop up due to database differences, I wanted a more production-like environment for my CI. services:
  postgres:
    image: postgres:15
    env:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: postgres
    ports:
      - 5432:5432
    options: >-
      --health-cmd pg_isready
      --health-interval 10s
      --health-timeout 5s
      --health-retries 5 There’s nothing fancy going on here; it’s almost a perfect copy/paste from GitHub’s documentation. To run your tests in a Postgres database, you’ll need to Specify the image you need. In my case, GitHub will pull and spin up the Docker image. postgres:15 Set up your environment variables. Map the ports you plan to use. And then add any other options you choose, like health checks. Define the steps Each job is made up of a series of steps. The first steps ought to set up your project. steps:
- uses: actions/checkout@v2

- name: Set up Python 3.11
  uses: actions/setup-python@v2
  with:
    python-version: 3.11

- name: Install Poetry
  run: curl -sSL https://install.python-poetry.org | python3 -

- name: Install dependencies
  run: poetry install Steps 1 and 2 above use predefined actions, which are very handy for common tasks like checking out the repository and setting up Python 3.11 to use with it. Next, since I use Poetry for dependency management, the next step is to install it using Poetry’s official installer. And finally, I installed my project’s requirements. And now my CI is ready to do battle: - name: Run isort
  run: poetry run isort --check-only .

- name: Run black
  run: poetry run black --check .

- name: Run flake8
  run: poetry run flake8 . The first three steps (isort, black, and flake8) comprise a common triad of style checkers. Isort is an import sorter, enforcing consistency and readability. By default, it organizes imports by standard library, third-party library, and application library imports. Black is a formatter that enforces PEP 8. Flake8 is a linter that flags things that black can’t handle automatically. Together, they make it harder for a developer to contribute unreadable code. - name: Run PyCQA/Bandit
  run:  poetry run bandit -r enterprises Bandit is a security linter that checks for common issues and reports them by severity and confidence level. - name: Setup Database
  run: PGPASSWORD=postgres psql -h localhost -U postgres -c "CREATE DATABASE test_db;"

- name: Set up environment
  run: |
    echo "SECRET_KEY=$(poetry run python -c 'from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())')" >> $GITHUB_ENV
    echo "DATABASE_HOST=localhost" >> $GITHUB_ENV
    echo "DATABASE_PORT=5432" >> $GITHUB_ENV
    echo "DATABASE_NAME=test_db" >> $GITHUB_ENV
    echo "DATABASE_USER=postgres" >> $GITHUB_ENV
    echo "DATABASE_PASSWORD=postgres" >> $GITHUB_ENV

- name: Run Tests
  run: poetry run pytest --cov=enterprises --cov-fail-under=100 And finally, the most powerful weapon of continuous integration: the tests. Since I chose to run the tests in Postgres instead of SQLite, the first two items of business are to create the database and set up the environment. I configured my workflow to generate a on the fly since it will just be thrown away. SECRET_KEY Finally, I ran my tests. The best part is that my CI job will fail if the coverage falls under a given percentage, preventing quality from falling prey to expediency. (Side note: some projects don’t necessarily need 100% coverage, and sometimes prioritizing expediency might be an unavoidable necessity. If that happens, gradually push the coverage threshold back toward its original level, or the loss will become permanent.) Implementing a to protect your project doesn’t have to be complicated. You need to know what tools to use to make it easy to keep your standards high and then define a process to apply those tools to every proposed change to the code. CI process . See the full gist here What are your experiences with designing and implementing CI/CD pipelines? Let me know! Also published . here

Code Quality Guardians: The Power of Continuous Integration in Software Development

Welcome to the thrilling realm of online , where developers like us face an ongoing battle against those pesky trolls and hackers who just can't resist wreaking havoc on the gaming experience. It's a real pain in the joystick! gaming So, in this article, let's dive into the juicy details about what this thingy is all about, how trolls and hackers are like the bad guys in a video game plot, and most importantly, why it's absolutely crucial to arm ourselves with preventive measures. Ready to level up your game? Let's go! reputation score The Notorious Trolls and Hackers - The villains we love to hate Ah, trolls and hackers, the infamous villains of the gaming world. These troublemakers have the uncanny ability to ruin our gaming experience and cause all sorts of headaches for us developers. Let's take a closer look at why they're the bane of our existence: Trolls, the stubborn 3 year old in the body of an adult. First up, we have the trolls. These mischievous creatures thrive on disrupting gameplay. They'll grief, harass, and spam like there's no tomorrow, leaving genuine players frustrated and contemplating rage-quitting. We can't let them run amok in our games, can we? Hackers, the digital ninjas with their bag of dirty tricks. They exploit vulnerabilities in our games, cheat their way to victory, and even steal precious in-game assets. Talk about playing dirty! Not only does this damage the game's reputation, but it also hurts our bottom line. We work hard to create amazing experiences, and these troublemakers are out to spoil the fun for everyone. Understanding Reputation Score - It's like having your own gaming detective Picture this: Reputation Score is like having a gaming detective who assesses the behavior and trustworthiness of players in your gaming community. It assigns a numerical value to each player based on their past actions, interactions with others, and how well they follow the rules. The higher the reputation score, the more trustworthy the player. That's where MIKROS steps in with its groundbreaking M2M (mobile-to-mobile) technology, offering a solution to curb this toxic behavior. It can sniff out potential trolls and hackers faster than you can say, "Game Over." Which significantly reduces the risk of toxic behavior and security breaches. Talk about a game-changer! The MIKROS M2M Tech At present, offenders often escape real consequences, as prevention efforts are limited to a product-by-product basis. This means that once a punishment, such as a ban, is imposed, the offender simply moves on to the next game to repeat their misconduct. MIKROS's M2M (mobile to mobile) technology, however, stands as a game-changer, providing the world's only system capable of maintaining a history of toxic behaviors across different products. It securely tracks users from one app to another, granting developers the power to prevent offenders from joining their games based on their past actions. Whether it's issuing warnings, triggering monitoring flags, or enforcing adherence to gaming etiquette guidelines. The Power of Preventive Measures - Protecting the Sanctity of Gaming Now, my fellow devs, let's talk about why it's absolutely crucial to slap some preventive measures in place. Trust me; it's like putting on a digital suit of armor to protect your game's integrity. Here's why: First and foremost, we want our players to have a blast. By keeping trolls and out of our games, we create a safe and enjoyable environment where genuine players can immerse themselves in epic adventures. Happy players mean more engagement, loyalty, and positive word-of-mouth. It's a win-win situation! hackers And let's not forget about game integrity. We spend countless hours fine-tuning mechanics, balancing gameplay, and creating a fair playing field. Hackers can throw all that hard work out the window by injecting cheats, manipulating game code, and ruining the competitive spirit. How Does MIKROS Work? Most of the stuff mentioned on their website seems to be very proprietary and under wraps, but this is what I could gather. The heart of this system lies in the Reputation Score. This unique algorithm enables developers to gauge the toxicity level of users, even if it's their first time playing a particular game or they haven't yet engaged in any wrongful activities. The Reputation Score takes into account various factors, including social interactions, sportsmanship, teammate feedback, trolling tendencies, AFK (away from keyboard) instances, offensive language usage, hacking attempts, and more. Imagine a user with a Reputation Score of 10 – they epitomize the ideal player. They seamlessly blend with the community, refrain from cheating or hacking, and radiate remarkable sportsmanship. On the flip side, a user with a Reputation Score of 1 is undeniably a cheater, hacker, troll, and a constant source of offensive behavior. As a general rule, caution should be exercised when dealing with users whose Reputation Score falls below 7. Troll-free gaming future - fiction or reality? By implementing the MIKROS Reputation Score, developers fortify their games against trolls and hackers, shielding their community from toxicity and preserving the integrity of their creations. This powerful tool not only holds offenders accountable for their actions but also fosters a fair and enjoyable environment where genuine players can thrive. Let's leverage the innovative capabilities of MIKROS and embark on a journey toward a brighter, troll-free gaming future.

Guardians of the Game: How Online Gaming Developers Continue to Combat Trolls and Hackers

Welcome to the realm where creativity meets protection—a world where digital explorers such as you embark on a journey to fortify their mobile apps against bugs and security vulnerabilities. Together, we'll uncover hidden flaws and wield powerful , ensuring your creations emerge triumphant and secure. So grab your virtual toolbelt and prepare for a dive into the magical realm of debugging mobile apps with unwavering resilience. security testing tools Understanding Mobile App Security Testing Mobile app security testing uncovers vulnerabilities, protecting user data and preventing unauthorized access. It empowers developers to fortify their apps against the ever-evolving tactics of malicious actors. Empowering App Developers By staying ahead of hackers, security testing equips developers to design robust apps that withstand sophisticated attacks. It assures users of a safe mobile experience and builds trust. Proactive Approach Mobile app security testing takes a proactive stance by identifying vulnerabilities before exploitation. Developers become guardians of their creations, creating a hostile environment for hackers. Collaboration with Security Testing Tools Leveraging advanced security testing tools, developers unveil risks from all angles. These tools provide static and dynamic analysis, penetration testing, and comprehensive features for effective vulnerability detection. Key to User Trust Investing in security testing practices demonstrates a commitment to user privacy and security. This fosters loyalty, enhances satisfaction, and establishes an unbreakable bond of trust. A Continuous Journey Mobile app security testing is an ongoing process. Developers must continuously monitor, update, and refine their security measures to keep pace with evolving threats. Selecting the Right Security Testing Tools Mobile app security requires a diverse set of tools. Look for options that cover areas such as code analysis, vulnerability scanning, encryption testing, and penetration testing. A well-rounded toolkit ensures comprehensive protection. Compatibility Matters: Evaluate the compatibility of security testing tools with your development environment. Ensure they seamlessly integrate with your existing workflow, saving time and effort. User-Friendly, Developer-Friendly: Opt for tools with intuitive user interfaces and clear documentation. Additionally, consider tools that offer automation capabilities and robust APIs for streamlined testing. The Power of Automation: is essential in fast-paced development cycles. Choose tools that offer automated security testing features to continuously monitor your app's security and protect against emerging threats. Automation Community Support and Updates: Select tools with active communities that provide regular updates. This demonstrates a commitment to staying ahead of evolving cybersecurity threats and offers opportunities for knowledge sharing. Scalability and Flexibility: Ensure the tools can scale and adapt to changing requirements as your app grows. Look for solutions that can handle both small-scale projects and enterprise-level applications without compromising performance. Budget Constraints: Consider both open-source and commercial options, striking a balance between cost-effectiveness and functionality. Many open-source security testing tools offer robust features without significant financial burdens. Setting Up the Development Environment Before diving into the intricacies of debugging, it's essential to prepare your development environment for the challenges ahead. Start by setting up a dedicated workspace, ensuring it meets the requirements of your chosen platform (iOS, Android, etc.). Organize your tools, libraries, and resources in a structured manner, allowing for seamless access and efficient development. Tool Selection: Your Armor and Weapons: Choose appropriate debugging tools based on compatibility, features, and ease of use. Consider tools like , Android Studio, Xcode, and security-focused options such as . Sentry OWASP ZAP Integrating Security Testing Tools: Identify areas requiring attention, such as authentication or data storage, and integrate specialized security testing tools seamlessly into your workflow. Embracing Automation: Automate security testing with tools like Checkmarx or AppScan to efficiently identify vulnerabilities. Static analysis and dynamic analysis tools are invaluable for code scanning and simulating attacks. Harnessing Emulators and Simulators: Utilize emulators and simulators to test your app across various configurations, platforms, and operating systems. Replicate user interactions and evaluate app security in different scenarios. Encrypted Connections: The Secure Gateway: Ensure all connections within your development environment are encrypted using secure protocols like HTTPS and SSH. Protect sensitive data during debugging. Continuous Vigilance: Staying Updated: Regularly update your tools, libraries, and frameworks to stay current with security enhancements and patches. Stay informed about emerging threats through security mailing lists and forums. Performing Static Analysis examines the app's codebase to identify potential security loopholes before they manifest. It offers developers a unique insight into their app's inner workings, enabling them to patch vulnerabilities and protect user data. Static analysis X-ray Vision: Spotting Vulnerabilities Static analysis acts as X-ray vision, revealing hidden vulnerabilities like weak authentication and insecure data storage. Armed with this knowledge, developers can strengthen their app's defenses and thwart potential attacks. Unmasking Code Complexity: Enhancing Security Static analysis untangles complex code dependencies, detects code smells, and highlights areas needing optimization. By addressing code complexity, developers can bolster app security and enhance performance. Automation: Boosting Efficiency Automated static analysis tools scan large codebases, apply security rules, and generate reports swiftly. This efficiency empowers developers to focus on security practices and user experience. Balancing False Positives and Negatives Static analysis faces challenges with false positives and negatives. Striking a balance through rule calibration helps minimize false results and ensure accurate vulnerability detection. Collaboration: Integrating Static Analysis Seamless integration of static analysis into the development workflow is crucial. Conducting checks during code reviews, continuous integration, or the build process allows early detection and prevention of vulnerabilities. Evolving Threats: Staying Ahead Static analysis tools evolve to address emerging threats. Regular updates and utilization of the latest versions help developers proactively identify and mitigate evolving security risks. Conducting Dynamic Analysis Test Case Generation: By following these steps, you'll unearth the secrets of generating effective test cases: a. Identify critical functionalities and core app components. b. Design test cases to cover a range of inputs, data types, and user interactions. c. Implement automated testing frameworks to streamline the test case generation process. d. Embrace creativity and consider edge cases that may expose vulnerabilities. Dynamic Analysis Process: This technique involves executing the mobile app and observing its real-time behavior. Here's how to embark on this thrilling adventure: a. Prepare a controlled testing environment, including emulators or physical devices. b. Execute the app while capturing critical runtime data, such as network traffic and memory usage. c. Simulate various user interactions and inputs to trigger different app behaviors. d. Monitor and record the app's responses, logging any suspicious or unexpected actions. Result Interpretation: Dynamic analysis uncovers a treasure trove of insights through the results it produces. Now, it's time to decipher these clues and understand their security implications. Here's how to interpret and act upon the results of dynamic analysis: a. Analyze runtime logs and capture data for anomalies, errors, or unusual behaviors. b. Compare the observed app behavior against the expected behavior defined by the test cases. c. Identify potential security vulnerabilities, such as data leakage, insecure network communication, or improper authentication. d. Prioritize identified issues based on severity, potential impact, and the app's core functionalities. e. Collaborate with the development team to implement necessary fixes and security patches. Monitoring and Logging Real-Time Vigilance: Monitoring and logging provide a comprehensive view of your app's activities, enabling you to track critical metrics and detect anomalous patterns or suspicious activities in real time. Unveiling Hidden Anomalies: Comprehensive log files allow you to trace and examine events, errors, and exceptions, helping you identify and address vulnerabilities, bugs, or malicious activities compromising your app's security. Proactive Issue Resolution: Insights gained from monitoring and logging empower you to take swift actions, patch vulnerabilities, and enhance security controls to ensure a resilient and trustworthy user experience. Enhanced Forensics and Incident Response: Detailed logs play a crucial role in incident response and forensic investigations, enabling you to reconstruct events, identify root causes, and bolster your app's security posture. Best Practices for Effective Monitoring and Logging: To harness the full potential of monitoring and logging, it is essential to follow the best practices: Define clear monitoring objectives aligned with your app's security requirements. Select the right monitoring tools and frameworks that suit your app's architecture and technology stack. Implement comprehensive log management practices, including log rotation, retention, and secure storage. Regularly review and analyze logs to uncover hidden vulnerabilities or emerging threats. Collaborate with security experts to establish robust monitoring and logging practices. Addressing Common Security Vulnerabilities Insecure Data Storage: Address weak data storage by using security testing tools. Encrypt data and adopt secure storage practices to protect user information. Improper Authentication: Ensure strong authentication by exposing vulnerabilities through . Strengthen password policies and implement multi-factor authentication. security testing Inadequate Network Communication: Protect against interception and tampering by identifying insecure communication channels with security testing tools. Encrypt data transmissions and use secure protocols. Code Injection Attacks: Defend against malicious scripts by identifying vulnerabilities through security testing. Improve input validation and sanitize user inputs. Insufficient Transport Layer Protection: Secure sensitive data during transit by using security testing tools to identify flaws. Implement secure transport layer protocols and proper cipher suite configuration. ** Analyzing Test Results and Reporting Leverage tools like OWASP ZAP, MobSF, and AppScan for thorough security testing. These tools identify vulnerabilities through code analysis, penetration testing, and vulnerability scanning. Analyzing Test Results: Analyze test results to understand the severity and potential impact of identified security issues. Consider the likelihood of exploitation, data sensitivity, and consequences of successful attacks. Prioritizing Security Issues: Prioritize issues based on severity, exploitability, and impact. Critical and high-severity vulnerabilities demand immediate attention, especially if easily exploitable or with high potential impact. Generating Comprehensive Reports: Effective communication with stakeholders and developers is key when reporting identified security issues. To create comprehensive reports, follow these steps: Document all identified security issues with detailed descriptions, including the affected components, the steps to reproduce, and the potential impact. This documentation will serve as a reference for developers during the debugging process. Clear Documentation: Utilize visual aids such as charts, graphs, and tables to present the overall security status of the application. This will help stakeholders quickly grasp the security posture and understand the urgency of addressing each vulnerability. Visual Representation: Provide actionable recommendations for each identified security issue. Explain the steps required to mitigate the vulnerability, including code changes, configuration updates, or additional security measures. This empowers developers to address the issues effectively. Actionable Recommendations: Engage in collaborative discussions with stakeholders and developers to clarify any doubts and address concerns. Follow up regularly to ensure that the identified security issues are being addressed in a timely manner. Collaboration and Follow-up: Conclusion In today's digital landscape, the security of mobile apps is paramount. By following the comprehensive guide outlined above, we gain the knowledge and tools to uncover vulnerabilities, protect user data, and fortify our apps against attacks. But this journey goes beyond debugging; it's about embracing a security mindset, integrating testing into our workflows, and staying vigilant as threats evolve. Together, let's create a future where innovation and security coexist, empowering users to embrace mobile apps with confidence.

A Basic Intro to Mobile App Debugging with Security Testing Tools

Una introducción básica a la depuración de aplicaciones móviles con herramientas de prueba de seguridad

Une introduction de base au débogage d'applications mobiles avec des outils de test de sécurité

सुरक्षा परीक्षण उपकरणों के साथ मोबाइल ऐप डिबगिंग का एक बुनियादी परिचय

セキュリティ テスト ツールを使用したモバイル アプリのデバッグの基本的な紹介

Uma introdução básica à depuração de aplicativos móveis com ferramentas de teste de segurança

Giới thiệu cơ bản về gỡ lỗi ứng dụng dành cho thiết bị di động với các công cụ kiểm tra bảo mật

使用安全测试工具调试移动应用程序的基本介绍

DePIN Explained: What Are Decentralized Physical Infrastructure Networks?

Dust on Crust Part Deux

ভূত্বক অংশ দুই উপর ধুলো

Staub auf der Kruste Teil Zwei

Polvo sobre la corteza, segunda parte

पपड़ी पर धूल भाग दो

クラスト上のダスト パート 2

지각 위의 먼지 2부

Poeira na Crosta Parte Dois

Пыль на корке, часть вторая

Kabuktaki Toz İkinci Bölüm

Bụi trên lớp vỏ Phần thứ hai

地壳上的灰尘第二部分

Hi everyone! My name is Michil Androsov and this is the second article in my series on the history of , where I offer an inside look at the creation of our unicorn company from the perspective of a simple developer. The first article is available . In it, I talked about how I joined the company, how we expanded the development team, and how we went international. inDrive here This article will cover the middle period of my career at inDrive—from about 2016 to 2020. At the time, the company was beginning to stand on its own two feet and rapidly develop in all kinds of new directions, which I'll discuss in more detail below. The Business After our first successful launches outside of Yakutsk, we were finally starting to recognize the power of our business idea. We began to wonder, "What if we really manage to take over the planet?" After all, living far up north, , you always feel quite separate from the rest of the world. It seems like everything's happening so far away, which actually gives us a pretty unique perspective. And at the time, all of our work with inDrive felt almost like a game to me. deep in Siberia Over this period, the company began to launch extensively. When we'd start operations in a new country, we might launch dozens of cities within a single month. We expanded beyond Russia and launched in Kazakhstan, where—despite a variety of obstacles—we quickly became the country's №1 ride-hailing service. To this day, Kazakhstan remains one of our top markets. When launching in a new city, we adopted a strategy of " ". As our CEO would say, if a city was ready for our service, it should be able to ignite from the smallest of sparks. So, if the grass in one city wasn't dry enough, we wouldn't try to soak it in gasoline. Instead, we'd just move on to the next one. This helped us expand quickly without spending too much money. burning dry grass In fact, a number of cities simply launched on their own. People would hear about this great new service, called inDrive, in a neighboring city. They'd download the app for themselves, and the city would launch without us. There were even a few self-launched cities that took off without any investment on our part. Of course, not all launches were a success. I remember our first back in 2018. We made all the preparations, recruited drivers, and advertised our service. At first, everything seemed to be working out, and our numbers were growing day by day. USA launch We were pleasantly surprised. Was it really that easy to launch in one of the world's largest markets? After all, if you can make it in the US, you can make it anywhere—at least, that's what I thought. But our joy quickly became disappointment: We were faced with a huge industry of fraudsters cashing out stolen credit cards and using them on our service. So, we decided to scrap our American plans and wait for better days—which finally came in 2023. We launched for the second time in the USA, with much better results. This launch is still ongoing. We are currently operating in Miami, and will soon expand to new cities. Looking back, we were being simple and naive. However, we continued to learn from our mistakes and push forward. The Product and Technology We've always believed that our service should be simple and fail-proof, like a . Of course, this has led to accusations that the app isn't "pretty" enough, despite being packed with features. Nokia 3310 In many countries, we had to adapt to local legislation and user needs. That’s why the inDrive app in Almaty might look completely different from the one in New York. Nevertheless, we have been working on making the app "prettier" in all countries over the past years, and I personally think it looks quite modern now. Outside of Russia, inDrive gained a range of new modules, starting with intercity rides and freight delivery, which are now available in countries across the globe. In certain markets, such as Kazakhstan, they are even more popular than our taxi vertical. During this time, our approach to product planning was simple: At the end of every quarter, our CEO would arrive back from his trips to our launch cities, open his laptop, and explain our goals for the upcoming period. Usually, these came from driver and passenger requests. We could have tasks of all different sizes, from introducing card payments to changing the color of the order button. Our CEO played (and continues to play) a crucial role in the development of the company. While he is both an excellent motivator and strategist, he’s also a skilled manager who understands how the product works. Even now, he personally flies to new launch countries, studies the market, conducts customer development, interacts extensively with users, and gathers feedback on the service. On the development side, we quickly realized that our existing code would not be able to support our rapid business growth. Soon, the app would start to lag and decline in quality. So, we decided to rewrite the more "complex" parts of the code. In addition to the PHP monolith, we eventually got ourselves a— —Golang monolith. The entirety of our infrastructure lay on the shoulders of two guys who knew all the inner workings of our enormous machine. If the service ever crashed, they were prepared to turn on their laptops and fix it at any time, day or night. ba-dum-tss We also got our first QA specialist for full-scale testing. This made our lives incredibly easier. Before our QA, we had been spending a lot of time and effort testing new functionality and updates by ourselves, and checking how they interacted with existing versions. Little by little, mobile developers began to join our team, albeit with some difficulty. After all, you needed Apple products to get into iOS development, and those could be difficult to find in Yakutsk. This meant that we struggled to recruit local iOS developers, and our iOS team would sometimes lag behind our Android team when it came to releasing new features. I remember one time in Kazakhstan, when our app was blocked at the government level. I won't get into the details, but to reverse the block, we had to introduce a number of different features, including user instructions, automatic address changes, proxies, and more. In the end, we restored our capabilities in the country and officially reversed the block after a few years. I remember writing to the CTO of a large CIS news site that had also been blocked in Kazakhstan, and asking how he had managed to keep business going. Many of our features were developed through a series of trials and errors—or stumbled upon by chance—although they might seem completely obvious in hindsight. Take our call-free ride-hailing system, for example. If you haven't read the , I'll quickly summarize it here. first article Previously, when an inDrive passenger would create their order, a driver would see their request in the orders feed and call them right away. And this wouldn't be just one driver either; these orders were being sent to anyone nearby. Of course, this led to situations where multiple drivers would see an order and try to call the passenger at once. Typically, the first person to contact the passenger would get the order. Here's where the problem came in: Drivers would click on a ride without reading the order details, and then all try to call the passenger at the same time. So, we created something called a "buffer." When drivers press the order button, there's a short delay, which gives us time to collect all potential offers. This way, drivers don't have to rush, and they have time to read the order details in full. Then, based on the drivers' ratings, the system selects which of them will be able to call the passenger first. This was a significant improvement to our old version. Although the call-free system is now used by practically every ride-hailing app, we actually came up with ours by chance. In 2016, we launched in Yekaterinburg and introduced the "Guardians," who were specially selected drivers that could accept orders that typical drivers couldn't. We would send them special push notifications about exclusive orders. However, we soon realized that these push notifications weren't working very well because they were easy to miss. And that's when we remembered one of our existing features, called "personal orders," which allowed the passenger to simply select the closest driver on the map and send the order straight to them. We decided to use this feature when sending orders to our "Guardians." It took off immediately and worked so well that we then decided to expand it to all drivers. Of course, the personal orders feature might seem obvious now, but we discovered it through a series of trials and errors. The Team Up until 2019, our team was fully made up of Yakutsk locals. At the time, we wanted to help our homeland grow — and the local people along with it. inDrive had always held a strong mission and values. These values resonated with each employee, and we strived to uphold them. This was a period of powerful drive and energy. Every day, I would wake up in a good mood, knowing that my friends and good coffee were waiting for me in the office. That and plenty of interesting work, of course. inDrive was known for being a social company. Our team was young and carefree, which meant we worked hard and played hard. Every year, we'd take a company trip abroad, whether to Egypt, Thailand, Kazakhstan, or somewhere else entirely. Imagine an entire plane of colleagues escaping the –50-degree Celsius weather in Yakutsk to visit sunny +35-degree Thailand! It was great at the time, but unfortunately, these big company trips aren't possible anymore with a workforce of several thousand employees. By 2019, we hit a hiring roadblock. Business was booming, and any professionals in Yakutsk capable of handling the tasks and workload were already working for us. So, we decided to open a development office in Moscow. As the head of the iOS team, I was charged with opening the Moscow branch. We had a lot of flexibility during this time, and employees were free to contribute to the company in any way they saw fit, as long as it benefited the business. I entered a new phase in my life. I moved to Moscow and started the process of opening the new office, from choosing a business center to installing special lights with the company logo. Now that a few years have passed, I can look back at that time fondly. But back then, I would often think: "Why did I do this to myself? Why'd I take on all this renovation work?" Our main problems had to do with the company in charge of the renovation. At one point, they were so behind schedule that I even had to help them install the electrical wiring in the workspaces. I remember one specific evening, when we stayed late to assemble furniture. I could see that my colleagues were tired and depressed, so to lighten the mood, I asked " " At the time (and to this day), Belorusskaya was one of the most expensive areas in Moscow, like Times Square in New York. It was also home to a number of impressive IT offices. Of course, we just laughed and got back to work. Why the long faces? Cheer up! Next year, we're opening an office on Belorusskaya! By the end of 2019, we had our first developers at the Moscow office. Sometimes, it would seem like they were from another planet. During their interviews, they'd say things like, "We work in sprints. I finished all my tasks, then came here" (and it'd only be Thursday afternoon). Or they'd say, "We work three days from home and two days from the office." That was something completely new for me. inDrive was entirely office-based at the time, and everyone was expected to contribute fully. We weren't working with any kind of Kanbans, scrums, story points, or sprints. Conclusion We entered 2020 with a lot of optimism. Our new development office in Moscow had opened, and we were working with a great team. I was living in the capital, business was growing, and investments were on their way! When the company received investments, we would conduct a cashout, meaning employees could sell a small portion of their stock options for real money. Everything seemed to be going our way, like we were living in a movie. Unfortunately, though, this is the point in my story where things get a little darker, like in the Harry Potter movies. Suddenly, we were faced with a huge challenge. In 2020, the world was shut down by the coronavirus. inDrive closed their offices and we started to work from home—something we had always been firmly against. Life took on new rules and we had to quickly find our footing. We developed new processes, took our first online calls, and sent laptops home to new employees. Then, in mid-2020, I became the CTO of inDrive. It was a surprise even for myself. I was placed in charge of 50+ developers, 4 distributed teams, and the two offices in Moscow and Yakutsk. Of course, there were plenty of challenges, which I'll discuss in more detail in my next article. My joke about our office on Belorusskaya quickly became reality. At the end of 2020, we opened an office in one of the best business centers in Moscow, right on Belorusskaya Square, alongside other cool IT companies. P.S.

Building a Unicorn: The inDrive Tech Journey from Local Startup to Global Phenomenon 

ইউনিকর্ন তৈরি করা: স্থানীয় স্টার্টআপ থেকে গ্লোবাল ফেনোমেনন পর্যন্ত ইনড্রাইভ টেক জার্নি

Aufbau eines Einhorns: Die inDrive-Tech-Reise vom lokalen Startup zum globalen Phänomen

Construyendo un unicornio: el viaje tecnológico de inDrive desde una startup local hasta un fenómeno global

Construire une licorne : le parcours technologique d'inDrive, de la startup locale au phénomène mondial

यूनिकॉर्न का निर्माण: स्थानीय स्टार्टअप से वैश्विक घटना तक इनड्राइव टेक यात्रा

ユニコーンの構築: 地元のスタートアップから世界的現象への inDrive テクノロジーの旅

유니콘 만들기: 로컬 스타트업에서 글로벌 현상까지의 inDrive 기술 여정

Construindo um unicórnio: a jornada tecnológica do inDrive, de uma startup local a um fenômeno global

Создание единорога: технологическое путешествие inDrive от локального стартапа к глобальному феномену

Bir Tekboynuz Yaratmak: Yerel Startup'tan Küresel Fenomen'e inDrive Teknoloji Yolculuğu

Xây dựng kỳ lân: Hành trình công nghệ inDrive từ khởi nghiệp địa phương đến hiện tượng toàn cầu

打造独角兽：从本地初创企业到全球现象的 inDrive 技术之旅

351 Stories To Learn About Data Security

What's the most vital part of web3? It's not 3D or Virtual Reality, or Augmented Reality. All these things are already in web2. is about the next step of democracy on the internet. Web3 In order to step up democracy, web3 should address being accessible for everyone in ways that will foster diversity, equity, and inclusion, such that everyone's voice can be heard. Not everyone can use a VR. Some people are blind, some people can get motion sickness, some people have low vision, color blindness, etc. Many people can't afford it. The core of the inclusivity issues is accessibility. Once accessibility is gotten right, it gets easier to build a future where barriers dissolve, diversity flourishes, and everyone–regardless of ability or background, finds a meaningful place in the digital narrative. Here are some things we need to fix to be more accessible to people: Access to Technology: According to the , people still pay more than 30% of their monthly income to purchase the cheapest smartphone available in their markets and a magnitude of people can't even afford it at all (they're hopeless). Alliance for Affordable Internet 2.5 billion You can't compare the price of the cheapest smartphones to VR headsets. Web3 should be accessible on different lower-end platforms for people who can't afford headsets till they get cheaper. Web3 builders should build solutions that keep compatibility and optimization in mind for lower-end smartphones and require less processing capabilities and less bandwidth. For me, I feel like rich people keep getting better technology and leaving the poor behind. It's a pressing concern in the digital age. As technology surges forward, there's a risk of widening the gap between the privileged and the underserved. The swift pace of technological progress can unintentionally widen this divide. This goes beyond personal convenience; it affects education, employment, and even civic engagement. There's a critical need for efforts to ensure that serves as a force for inclusivity in order to bridge the gap. web3 technology Only through collective action can we hope to build a world where technology uplifts all, regardless of economic status. Please help share this article when you're done reading--to improve visibility and foster collective action. Age (Ex. KYC4KIDS): Yes, age is often taken for granted. Just like other differences/disabilities, you may not notice if you don't come across people in the category. For example, many Web3 projects require users to upload a picture of a government-issued ID for identity verification purposes and a photo of the user themselves. It is referred to as KYC (Know Your Customer); this process is meant to stop fraud and is based on . banking laws established in 2001 As a minor myself, I can't really participate in many web3 projects because of age restrictions in the KYC (Know Your Customer) process. I was telling my friend about this and how I couldn't take part in the action, and he told me to wait till I was 18. I told him to go away. I did some thinking and realized that it was possible to conduct KYC for minors, and I asked, “Why don't these projects support it?” I built a basic demo as Proof of Concept to conduct parents/guardians supervised KYC for minors, with seamless, secure, and awesome verification powered by metamaps. I call it KYC4KIDS. Now, I'm no legal expert, but I'm hoping web3 projects everywhere could offer inclusivity for kids like me!
I'm hoping these projects can include children in their roadmaps/whitepapers and make us part of the plan.
I hope they can support minors in their in-house KYC, and I hope more KYC services will jump on this bandwagon. Let's make it happen; help get and relay the message out there so we can have #KYC4Kids. Children need to be included in web3. They say children are the future, and web3 is the future, but why are children less inclusive in web3? For all it's worth, web3 should be all about children. Fun fact: people talk about their various use cases and argue who started web3 and for what, but the truth is that Web3 was started by children: children and older gamers were the ones who opened this up with gaming, film, and animations. So don't exclude kids when you're thinking, talking, or building web3. KYC (Know Your Customer): Still on the KYC issue, while the process involved in KYC is still tedious for those with an ID, more than 3 million people in the US alone lack a government-issued ID ( ). Talk less of the rest of the world, and these KYC systems don't even support all countries. NPR The most common form of government ID is a driver's license. How many people drive today? Old people, the poor, some in big cities, and even people in rural areas don't drive. Many old people around the world don't have birth certificates, and some of their names were incorrectly typed on the documents. Which if there's a discrepancy between your birth certificate and other forms of ID, you won't be able to get KYCed or some other IDs. While there are certainly ways around these obstacles, each problem that arises will dissuade more people from accessing and taking advantage of Web3. Onboarding Process: Just think about it: you want to use a web3 site, you're asked to connect your wallet, you try to figure out what it means, and if you're really smart, you understand it is similar to "Sign up with Google.” Okay, you find a wallet app, you download it, and install it. Now you have to sign up for the wallet; you go through the email verification, phone number verification, and set a strong password and everything. Then they give you a security phrase of 12 random words and tell you it's very important for your wallet security, but you can't put it online so that it won't be hacked; writing on paper is a great choice, but you have to make sure you don't lose the paper. You do that, and some of the projects will say that you need to have some balance in the wallet to proceed. You go through all the stress of figuring out how to top up your unreadable wallet address that you can't get wrong and must be sure that it's the right token/coin on the right blockchain. Then they tell you to do KYC, and you go through the difficulties I mentioned about KYC. I don't know about you, but I can barely type this short summary of the process. Imagine doing all these for  something you can easily do elsewhere or for an app you'll probably use only once There are impressive solutions addressing the UX issues, like now you can use simpler names like vitalik.eth to make crypto transactions, and there are features to keep your 12 random words on the cloud and similar things. However, the UX issues are still massive and need more action. Thankfully, incredible solutions are being built, like , for example. Sendtokens Enter Sendtokens, a non-custodial decentralized wallet designed with inclusivity at its core. The platform reimagines how we interact with cryptocurrencies, removing the hurdles of intricate alphanumeric keys. Instead, users can seamlessly send and receive digital assets using familiar emails and phone numbers. With features like Cryptopins and a commitment to scalability, Sendtokens sets a new standard for user-friendly transactions. Its compatibility with a wide range of tokens further cements its position as a trailblazer in the Web3 landscape, offering a bridge to a more accessible and inclusive digital future. Check out Sendtokens Cognitive Overload: You need a high level of expertise to feel comfortable in Web3. The learning curve is very steep, the technology is cumbersome, things are always changing, and mistakes can be very expensive. Many of the terms used are unnecessarily confusing or abstract when they don’t need to be, and using them can stop people from trying Web3. Using terms like "HODL" and "BUIDL" has become a distinctive part of the cryptocurrency culture, reflecting a sense of community and shared enthusiasm. However, it's crucial to consider the audience and context. While these terms may resonate within the crypto community, they can be confusing or alienating to those unfamiliar with them. Striking a balance between industry-specific jargon and accessible language is key. When addressing a broader audience, opting for standard spelling and providing explanations can enhance clarity. There are more reasonable terms that are still confusing, like smart contracts, gas fees, etc. People won't understand what they mean easily unless they understand the core of how smart contracts work or how gas fees work. This is unnecessary because millions of people use web2 every day without knowing the meaning of HTTPS. But if you referred to gas fees as transaction fees instead, it's easier to understand that way. I found the following table in about how we do a bad job of this article communicating web3 It's sad, but it's true. I agree with the author when he said: "Simpler, more inviting language is an urgent first step, but it’s not enough on its own. To be impactful, the words of Web3 must be genuine, too. Less about our awesome tech and more about the user. Let’s show people we really care about solving their problems. Capturing curiosity is the key to welcoming the mainstream. Disabilities: According to the , over 1 billion people in the world have some sort of disability. So, the importance of inclusivity for these people cannot be overemphasized. World Health Organization As a web3 company, you should be conscious of being accessible to diverse individuals and kinds of people. The truth about your target audience and market segments is they're not as similar as you think. I read on Forbes that companies that are more inclusive have more ROI. In just the United States alone, 1 in 4 Americans have a disability and totally spend over $490 billion annually. The disability community encompasses a $1.2 trillion market. Businesses need to be informed that investing in diversity, inclusivity, and equity is not only about compliance but a smart business opportunity and the right thing to do. Authenticity: One very prominent issue is that people aren't what they seem like online in Web2; they only present the most ideal versions of themselves. (formerly Facebook) outline that Instagram is toxic to teenage girls. Even internal documents in Meta I salute projects that do an awesome job helping people to get authentic avatars in the metaverse, authentic NFTs (like trumiinfts), and the like. I asked chatGPT about how to promote Authenticity, and it mentioned things like raising awareness, setting examples, etc. I strongly agree that these are vital steps to driving a more authentic environment to foster inclusivity, but the thing about promoting authenticity is; the people have to want to be authentic. Now, it's difficult trying to convince people to be authentic, given what social media looks like now and statistics on mental health. If we're doing anything at all to convince them, I don't think it's working. On the other hand, in web3–would you want to be inauthentic when you're anonymous? The evolution of technology, driven by decentralization and blockchain, is revolutionizing the way we interact with the digital realm. From static profile pictures to three-dimensional avatars, we've witnessed a remarkable progression in how we present ourselves online. Web3, as the third generation of the internet, marks a monumental shift. It liberates us from the constraints of flat images and gaming environments, allowing us to fully embody three-dimensional avatars in a virtual world. This agency promises an unprecedented level of self-expression and immersion. Through avatars, we have the canvas to represent ourselves as anything we like. Authenticity takes center stage, prompting us to explore facets of our identity that may have remained hidden otherwise. Digital cosplay, for instance, offers a genuine glimpse into our inner selves. Avatars cease to be mere representations; they become windows into our passions, beliefs, and affiliations. Whether it's enthusiasts adopting on-brand avatars or individuals proudly displaying their interests on social media, avatars serve as a powerful tool for personal expression. We just need to keep directing it to encourage authenticity. Data Ownership & Ads Yet, this newfound freedom comes with a critical consideration: data privacy. to reclaim ownership of their personal data, challenging the traditional model where corporations harvest data for advertising. Web3 empowers individuals The emergence of "data unions" ensures individuals retain control, paving the way for a future where fair compensation for data becomes the norm. For brands, Web3 presents a unique opportunity for unfiltered customer insight. Platforms like Discord and Reddit, where users engage with anonymity, offer a window into authentic perspectives. This opens doors for more genuine customer engagement, allowing brands to better understand their audience. In essence, Web3 has the potential to revolutionize how brands connect with their audience, fostering a more authentic and mutually beneficial relationship. This is what's being built at Slakenet, plus the platform rewards people with internet access to make it possible to fund your internet by using it. Marginalized Groups: According to a report by in December 2021, prices for digital avatars from CryptoPunks NFTs fluctuate based on race, gender, and skin color. Mid- and dark-skinned avatars were priced lower on average than lighter-skinned NFTs. Bloomberg Bloomberg also cited data from DeGenData (a CryptoPunks sales tracker), which showed lower average prices for female Punks compared to male punks. Even on the developer side of things, A of 82,286 global software developers revealed that 91.7% of all respondents were men. 2021 Statista survey There are lots of projects out there solving these challenges, and I'm glad about the progress so far. It's also important to keep raising awareness and advocating for inclusion and equity for marginalized groups, including (but not limited to) women, racial and ethnic minorities, LGBTQIA community members, and those from economically disadvantaged backgrounds. Conclusion: In the horizon of Web3, inclusivity is not just a principle; it's a powerful force driving digital empowerment. Inclusivity is not a feature but a fundamental right. Through Web3, we have the opportunity to dismantle barriers, amplify voices, and champion a future where everyone is seen, heard, and valued. Together, let us ensure that the promise of Web3 is not just realized but celebrated as a testament to the boundless potential of human connection in the digital age. You can share some other inclusivity issues and raise awareness. I would love to hear your thoughts on the matter

Web3 Inclusivity: Replacing Digital Barriers With Bridges

App Guardians

appguardians.com

-- employees

Since n.d.

COMPANY RANKING

APP GUARDIANS

EVERGREEN INDEX #1323

App Guardians WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

App Guardians

appguardians.com

-- employees

Since n.d.

COMPANY RANKING

APP GUARDIANS

EVERGREEN INDEX #1323

RELATED COMPANIESRANK

STORIES ABOUT APP GUARDIANS

App Guardians WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!