barista AI

baristaai

Perfecting the Recipe for Robust Cloud Applications: The Barista's Approach to Shift-Left Security 

Command Line Confessions: The Embarrassing Questions I Should Have Asked Long Ago

What Three Months in Colombia Taught Me About Life

কলম্বিয়ায় তিন মাস আমাকে জীবন সম্পর্কে কী শিখিয়েছে

Was ich in drei Monaten in Kolumbien über das Leben gelernt habe

Lo que tres meses en Colombia me enseñaron sobre la vida

Ce que trois mois passés en Colombie m'ont appris sur la vie

कोलंबिया में बिताए तीन महीनों ने मुझे जीवन के बारे में क्या सिखाया

コロンビアでの3か月が私に人生について教えてくれたこと

콜롬비아에서 보낸 3개월이 나에게 가르쳐준 인생

O que três meses na Colômbia me ensinaram sobre a vida

Чему меня научили три месяца в Колумбии о жизни

Kolombiya'da Üç Ay Geçirmenin Bana Hayat Hakkında Öğrettiği Şeyler

Ba tháng ở Colombia đã dạy tôi điều gì về cuộc sống

在哥伦比亚的三个月教会了我什么生活

Corporate extraction is eating everything. The tech monopoly is destroying us. The unicorn startup model is broken. We need economies that support collective flourishing. What is an Economy of Specificity?: The Coffee Shop and Starbucks Starbucks’ strategy has been ubiquitous reproducibility. Globally, you can walk into a starbucks, and get pretty much the same product, no matter where you are. Starbucks does actually adapt some to local cultures, adding menu items exclusive to a particular place and palette. But the business model is copy and paste. And Starbucks is everywhere, at one point seeking to be visible from every office window in cities like NYC or their home of Seattle. It does not matter who is working behind the counter, nor what local bean roasters might be in business, Starbucks will produce the same cup of coffee and carry the same pre-roasted beans on the shelf. This is in contrast to the local coffee shop that roasts their own beans which they source from a few family farms in Guatemala. The person working behind the counter matters quite a bit, not just for their skill as a barista, but as a source of community news and gossip. This coffee shop might work with a local bakery, or add a menu item named after one of their regular customers. While still tied into global networks of exchange, this is an economy of specificity. They are reliant on their particular relationships and exist only in their context. But local coffee shops are a pattern, a global phenomenon. Collectively they have a greater market share than coffee chains, even though they are not organized under a single business. Their risks and rewards are distributed. Economies of specificity make communities richer. Rather than extracting wealth for global corporations, the more local, “inefficient”, flows of exchange feed back into the mutual relationships that these economies require. They also make communities richer in the sense that they increase intangible values like quality and uniqueness while knitting the social relationships that are needed for sustainability. Here is a list of a few examples, dividing between Copy-Paste Economies and Economies of Specificity. Mushrooms and Culture When Anna Tsing talks about the networks of matsutake mushroom hunters in The Mushroom at the End of the World, she is talking about an economy of specificity. These networks span the globe, but each step in their processes of discovery, exchange, pricing, and meaning making is relational and specific — not just in place, but also time. Matsutake resists industrial mushroom growing practices and in each place it grows it does so in a different way, favoring different environmental conditions. The people who hunt the mushroom do so for a variety of reasons, but each group is somehow bound to the agency that mushroom hunting gives them. And the networks of sale and exchange that set the price of the mushroom are deeply embedded in the relationships between cultures. When I think about the Indigenous “three sisters” agricultural method of planting corn, beans, and squash together so that they balance the soil nutrients and increase yields, I see that as an economy of specificity. This method doesn’t work for industrial farming because industrial agriculture scales through automation, minimizing labor. But the three sisters have to be harvested by hand. Quality and labor intensity are an intertwined pair. While it may be “inefficient” to have to employ more labor, from a societal perspective we can see the benefits of high-quality, low-waste industries that create jobs. Really, it’s just a different type of efficiency, tuned for different goals. When I think about the slow food movement I am reminded that economies of specificity support each other. One local farm has limited effect, but a network of farm-to-table restaurants, farms, bee keepers, composting services, and local artisans all working in collaboration has the power to change economic conditions for an entire region. And this can go further; groups from workers cooperatives to land stewards can be connected through something as innocuous as a matsutake mushroom. The individual businesses and actors are unique and highly specific. They are both irreplaceable and unimportant on their own. But because they are in networks of mutual support, they are powerful. Copy-Paste Economies spread through capital, hostile takeovers, and market dominance. Economies of Specificity spread through culture. They are patterns without prescription. What Does Any of This Have to Do with Tech? Well, I’ve been thinking about the Cozy Web lately. Secluded spaces like Discord servers, niche forums, and Signal group chats are where a lot of the activity of the web actually happens. These spaces allow for customization and cultural development, in contrast to the large social platforms like Meta and X. The large social platforms rely on advertising and the collection of user data. They operate through scaled, ubiquitous extraction. What is the economics of the cozy web? A lot of institutions like Signal have to rely on donations and public funding. This is one model, but we need more. And I see economies of specificity as one lens through which to find solutions. SAAS is one model that can be revolutionized from its current form. What if we were paying development teams to add custom features to open-source software? This would open up a direct line between user needs and software development. It also provides a more direct funding stream for the maintainers who keep the fundamental building blocks of our networks functional (and yes I am thinking of the XZ Utils incident and the classic xkcd comic Dependency). Additionally, as we start seeing more peer-to-peer software that can provide interconnectivity without servers, the SAAS model will need to adapt. Similarly, we need more custom web designers and less Wix sites. We need more applications built for local township governance, food waste mitigation, and citizen science. B2B applications are an opportunity for custom solutions to situated problems. Approaching development as an act of customizing open-source software lowers overhead while building more fit to purpose applications and creating a thriving developer industry. Not everything needs to be a unicorn startup that gets sold off to the same monopolies capturing the rest of the internet. We need to rewild the internet, and also our economies.** Competing with Copy-Paste Economies And I believe that technology has the power to help economies of specificity compete with copy-paste economies. When I talk about networks of mutual support, I recognize that these networks are always bounded by the friction of communication, the time it takes to transport goods, and the amount of information in the system about the needs of each of the different businesses. Amazon can have a super precise and flexible distribution network that lets you receive packages the next day, because they control all of the information about their business centrally. As I write I am watching the UPS guy unload six packages with Amazon logos that he is delivering along my block. Each of these packages has a tracking number that will be scanned as they are delivered; photos of them will be uploaded and attached to that number; and emails will be sent to customers. Amazon’s warehousing information systems let them know exactly what is on the shelf at any moment, coordinating the fastest and most efficient delivery of the thousands and thousands of products. Why were these packages delivered by UPS when yesterday it was an amazon branded van driving down the block? Rather than the central information system that lets Amazon function, imagine information tools that help the actors in economies of specificity to coordinate on both local and global scales. If a farm is suddenly unable to supply romaine lettuce to the restaurant that they are contracted with, what other farms can fulfill the order at the last minute? How does the emission of carbon in a specific development project affect the global climate? There are a number of technologies that enable this flexibility and data availability without devolving into extractive systems that require uniformity and cannot handle the uniqueness of these local networks and specific economic relationships. Mutual credit currencies and REA accounting allow for demand side value flows. Peer-to-peer software allows for shared ownership of data, supplanting centralization and silos. And local-first software means these peer networks can operate with a really small minimum viable number of actors or scale up to global levels as needed. Together, along with economies of specificity and other economic and social shifts like cooperatives, it is possible to have the benefits of Amazon and Starbucks without destroying our planet. All while enriching our local communities. Special thanks to my colleagues Camila Hanada, Jarod Holtz, and Paul d’Aoust for their enriching reviews and assistance with this article’s feature image. All mistakes and opinions remain my own. Corporate extraction is eating everything. The tech monopoly is destroying us. The unicorn startup model is broken. We need economies that support collective flourishing. What is an Economy of Specificity?: The Coffee Shop and Starbucks What is an Economy of Specificity?: The Coffee Shop and Starbucks Starbucks’ strategy has been ubiquitous reproducibility. Globally, you can walk into a starbucks, and get pretty much the same product, no matter where you are. Starbucks does actually adapt some to local cultures, adding menu items exclusive to a particular place and palette. But the business model is copy and paste. And Starbucks is everywhere, at one point seeking to be visible from every office window in cities like NYC or their home of Seattle. It does not matter who is working behind the counter, nor what local bean roasters might be in business, Starbucks will produce the same cup of coffee and carry the same pre-roasted beans on the shelf. This is in contrast to the local coffee shop that roasts their own beans which they source from a few family farms in Guatemala. The person working behind the counter matters quite a bit, not just for their skill as a barista, but as a source of community news and gossip. This coffee shop might work with a local bakery, or add a menu item named after one of their regular customers. While still tied into global networks of exchange, this is an economy of specificity. They are reliant on their particular relationships and exist only in their context. But local coffee shops are a pattern, a global phenomenon. Collectively they have a greater market share than coffee chains, even though they are not organized under a single business. Their risks and rewards are distributed. greater market share greater market share Economies of specificity make communities richer. Rather than extracting wealth for global corporations, the more local, “inefficient”, flows of exchange feed back into the mutual relationships that these economies require. They also make communities richer in the sense that they increase intangible values like quality and uniqueness while knitting the social relationships that are needed for sustainability. Here is a list of a few examples, dividing between Copy-Paste Economies and Economies of Specificity. Mushrooms and Culture When Anna Tsing talks about the networks of matsutake mushroom hunters in The Mushroom at the End of the World , she is talking about an economy of specificity. These networks span the globe, but each step in their processes of discovery, exchange, pricing, and meaning making is relational and specific — not just in place, but also time. Matsutake resists industrial mushroom growing practices and in each place it grows it does so in a different way, favoring different environmental conditions. The people who hunt the mushroom do so for a variety of reasons, but each group is somehow bound to the agency that mushroom hunting gives them. And the networks of sale and exchange that set the price of the mushroom are deeply embedded in the relationships between cultures. The Mushroom at the End of the World The Mushroom at the End of the World The Mushroom at the End of the World When I think about the Indigenous “three sisters” agricultural method of planting corn, beans, and squash together so that they balance the soil nutrients and increase yields, I see that as an economy of specificity. This method doesn’t work for industrial farming because industrial agriculture scales through automation, minimizing labor. But the three sisters have to be harvested by hand. Quality and labor intensity are an intertwined pair. While it may be “inefficient” to have to employ more labor, from a societal perspective we can see the benefits of high-quality, low-waste industries that create jobs. Really, it’s just a different type of efficiency, tuned for different goals. When I think about the slow food movement I am reminded that economies of specificity support each other. One local farm has limited effect, but a network of farm-to-table restaurants, farms, bee keepers, composting services, and local artisans all working in collaboration has the power to change economic conditions for an entire region. And this can go further; groups from workers cooperatives to land stewards can be connected through something as innocuous as a matsutake mushroom. slow food movement slow food movement The individual businesses and actors are unique and highly specific. They are both irreplaceable and unimportant on their own. But because they are in networks of mutual support, they are powerful. Copy-Paste Economies spread through capital, hostile takeovers, and market dominance. Economies of Specificity spread through culture. They are patterns without prescription. What Does Any of This Have to Do with Tech? Well, I’ve been thinking about the Cozy Web lately. Secluded spaces like Discord servers, niche forums, and Signal group chats are where a lot of the activity of the web actually happens. These spaces allow for customization and cultural development, in contrast to the large social platforms like Meta and X. The large social platforms rely on advertising and the collection of user data. They operate through scaled, ubiquitous extraction. Cozy Web Cozy Web What is the economics of the cozy web? A lot of institutions like Signal have to rely on donations and public funding. This is one model, but we need more. And I see economies of specificity as one lens through which to find solutions. SAAS is one model that can be revolutionized from its current form. What if we were paying development teams to add custom features to open-source software? This would open up a direct line between user needs and software development. It also provides a more direct funding stream for the maintainers who keep the fundamental building blocks of our networks functional (and yes I am thinking of the XZ Utils incident and the classic xkcd comic Dependency ). XZ Utils incident XZ Utils incident Dependency Dependency Dependency Additionally, as we start seeing more peer-to-peer software that can provide interconnectivity without servers, the SAAS model will need to adapt. Similarly, we need more custom web designers and less Wix sites. We need more applications built for local township governance, food waste mitigation, and citizen science. B2B applications are an opportunity for custom solutions to situated problems. Approaching development as an act of customizing open-source software lowers overhead while building more fit to purpose applications and creating a thriving developer industry. Not everything needs to be a unicorn startup that gets sold off to the same monopolies capturing the rest of the internet. We need to rewild the internet , and also our economies.** We need to rewild the internet We need to rewild the internet Competing with Copy-Paste Economies And I believe that technology has the power to help economies of specificity compete with copy-paste economies. When I talk about networks of mutual support, I recognize that these networks are always bounded by the friction of communication, the time it takes to transport goods, and the amount of information in the system about the needs of each of the different businesses. Amazon can have a super precise and flexible distribution network that lets you receive packages the next day, because they control all of the information about their business centrally. As I write I am watching the UPS guy unload six packages with Amazon logos that he is delivering along my block. Each of these packages has a tracking number that will be scanned as they are delivered; photos of them will be uploaded and attached to that number; and emails will be sent to customers. Amazon’s warehousing information systems let them know exactly what is on the shelf at any moment, coordinating the fastest and most efficient delivery of the thousands and thousands of products. Why were these packages delivered by UPS when yesterday it was an amazon branded van driving down the block? Rather than the central information system that lets Amazon function, imagine information tools that help the actors in economies of specificity to coordinate on both local and global scales. If a farm is suddenly unable to supply romaine lettuce to the restaurant that they are contracted with, what other farms can fulfill the order at the last minute? How does the emission of carbon in a specific development project affect the global climate? There are a number of technologies that enable this flexibility and data availability without devolving into extractive systems that require uniformity and cannot handle the uniqueness of these local networks and specific economic relationships. Mutual credit currencies and REA accounting allow for demand side value flows. Peer-to-peer software allows for shared ownership of data, supplanting centralization and silos. And local-first software means these peer networks can operate with a really small minimum viable number of actors or scale up to global levels as needed. Together, along with economies of specificity and other economic and social shifts like cooperatives, it is possible to have the benefits of Amazon and Starbucks without destroying our planet. All while enriching our local communities. Mutual credit currencies Mutual credit currencies REA accounting REA accounting Peer-to-peer Peer-to-peer local-first local-first it is possible to have the benefits of Amazon and Starbucks without destroying our planet. All while enriching our local communities. All while enriching our local communities. Special thanks to my colleagues Camila Hanada, Jarod Holtz, and Paul d’Aoust for their enriching reviews and assistance with this article’s feature image. All mistakes and opinions remain my own. Special thanks to my colleagues Camila Hanada, Jarod Holtz, and Paul d’Aoust for their enriching reviews and assistance with this article’s feature image. All mistakes and opinions remain my own.

Economies of Specificity 

নির্দিষ্টতার অর্থনীতি 

Ökonomien der Spezifität

Economías de especificidad 

Économies de spécificité 

विशिष्टता की अर्थव्यवस्था

特異性の経済

특이성의 경제 

Economias de Especificidade 

Экономия специфичности 

Özgüllük Ekonomileri 

Tính kinh tế của tính đặc thù 

专用经济

In today’s world, for many people, conversing with AI has become as routine as discussing one’s coffee preferences with a barista (or it soon will be!). Yet, here lies an irony: . the more we interact with AI, the more elusive our understanding of these conversations becomes This irony essentially represents a modern twist on the “black box” dilemma, which has perplexed the ML community for years. The “black box” problem refers to the opaque decision-making processes of ML models (large language models (LLMs) including), where the rationale behind any given response is shrouded in complexity. Despite advances in technology, the inner workings of these models, governed by billions or soon trillions of parameters, remain largely inscrutable. Their decision-making is a puzzle, complicated by nonlinear interactions that defy straightforward interpretation. Prompting — the buzzing word of 2023 — doesn’t make it any better: we now have obscured layers of communication activated with every prompt. What we see — the prompt we type — is merely the surface. Beneath lies a hidden dialogue, an augmented system prompt, which is a complex, coded conversation the model conducts with itself, away from our understanding. And who knows what a model whispers to itself? So, if you were confused about prompting amid the avalanche of articles, blogs, and tutorials about it — you should be. As Ethan Mollick’s reveals, contrary to intuition, , such as pretending to navigate a Star Trek episode or a political thriller, demonstrating that traditional logical or direct prompts may not always yield the best responses from AI. research the most effective prompts involve imaginative scenarios But it also reveals that it’s not coherent and might change with a new version of the model. He mentions the futility of seeking a universal “magic phrase” for AI interaction, the effectiveness of specific prompting techniques like adding context, few-shot learning, and Chain of Thought, and the significant impact that prompts can have on AI performance. But for me — and I’ve been using AI a lot — many times, the most straightforward prompts, or “magic words,” can be surprisingly effective. How to explain it? A few years back, Explainable AI (XAI) was heralded as a solution to the “black box” issue, with entities like DARPA leading the charge (they created the , which has not been updated since 2021). However, the buzz around XAI seems to have dimmed, overtaken by a broader focus on Responsible AI. Is Responsible AI the solution? XAI toolkit So, that’s what we end up with: How do machines make decisions? — We don’t know! How to talk (prompt) to them? — We don’t know as well! But, please, keep shipping to us new, larger (though we will also take smaller) models! Why? — We don’t know! But we can’t stop. Great Article Covering the Topic An explanatory article about the concept of a black box: https://hackernoon.com/deep-learning-and-artificial-neural-networks-solving-the-black-box-mystery-rl7h32wa?embedable=true 🎁 Bonus: The Freshest Research Papers, Categorized for Your Convenience Special Category: Definitely Worth Reading : Discusses the development and advantages of 1-bit LLMs, promising significant cost reductions and efficiency improvements. The Era of 1-bit LLMs Read the paper : Introduces bGPT, a model that simulates the digital world beyond traditional modalities, predicting and diagnosing algorithms or hardware behavior. Beyond Language Models Read the paper Language Models in Specialized Domains : Integrates music understanding and generation capabilities into LLMs, demonstrating LLMs’ potential in music composition. ChatMusician Read the paper : Aims to bridge LLMs’ gap in interpreting structured data, enhancing their ability to ground knowledge in tables, graphs, and databases. StructLM Read the paper : Focuses on responsibly creating Code LLMs, contributing to advancements in coding benchmarks, and emphasizing model openness. StarCoder2 and The Stack v2 Read the paper : Discusses video generation’s potential as a unified interface for diverse tasks, outlining challenges and future directions. Video as the New Language for Real-World Decision Making Read the paper Enhancing and Merging Language Model Capabilities : Proposes a method to fuse knowledge from multiple chat models, improving chat model performance through a novel merging technique. FUSECHAT Read the paper : Details a multilingual language model that showcases superior performance in coding tasks and multilingual capabilities. Nemotron-4 15B Technical Report Read the paper : Explores latent multi-hop reasoning in LLMs, revealing their inherent capabilities and limitations in complex reasoning tasks. Do Large Language Models Latently Perform Multi-Hop Reasoning? Read the paper Scaling and Efficiency in Model Training : Discusses a system for training LLMs on over 10,000 GPUs, tackling efficiency and stability challenges in large-scale model training. MegaScale Read the paper : Proposes a theory for optimizing LLM learning, aiming for reduced training steps and improved performance. Towards Optimal Learning of Language Models Read the paper : Introduces a model combining gated linear recurrences with local attention, offering an efficient alternative for language processing tasks. Griffin Read the paper : Investigates the effects of scaling on fine-tuning LLMs, providing insights into data, model, and method impacts on bilingual tasks. When scaling meets LLM finetuning Read the paper Improving Robustness and Diversity in AI : Generates diverse adversarial prompts to enhance LLM robustness, employing an open-ended search method for prompt discovery. Rainbow Teaming Read the paper : Proposes a deterministic sampling technique for code generation, improving sample diversity and model performance in compiler optimization. Priority Sampling of Large Language Models for Compilers Read the paper Generative Models and Interactive Environments : Trains a generative model to create interactive virtual worlds from various inputs, advancing generative AI and simulation capabilities. Genie r Read the pape Enjoyed This Story? I write a weekly analysis of the AI world in the Turing Post newsletter. Subscribe for free using the button below and be the first to read the latest stories. The goal of Turing Post is to equip you with comprehensive knowledge and historical insights, so you can make informed decisions about AI and ML. Join over 50,000 readers from the main AI labs, forward-thinking startups, and major universities 👇🏼

Explainable AI and Prompting a Black Box in the Era of Gen AI

JWT stands for , and it is an authorization mechanism, not authentication. So let’s figure out what the difference between those two. JSON Web Token is the mechanism that allows verifying that the user is exactly the one he claims to be. It is a login process where a user provides a username and password, and the system verifies them. So authentication answers the question: who is the user? Authentication is the mechanism that allows verification of which access rights the user has to a certain resource.  It is a process of granting users some roles and a set of permissions a particular role has. So, authorization answers that question: what rights does the user have in the system? Authorization It is important to understand that Authentication always comes first and Authorization is second. In other words, you can’t get permission before you verify your identity. But what are the most popular authorization methods? There are two main approaches to handling authorization for the web application. Sessions A traditional approach on the web for authorization users is a cookie-based server-side session. The process starts when a user logs in and a server authenticates him. After that, the server creates a session with a Session ID and stores it somewhere in the server’s memory. The server sends back Session ID to the client and the client stores the Session ID in cookies. For every request, the client sends a Session ID as a part of the request, and the server verifies the Session ID in its memory and the user’s permissions related to this session. Tokens Another popular approach is using tokens for authorization. The process starts similarly when a user enters login, and passwords and a client sends a login request to a server. Instead of creating a session, the server generates a token signed with the secret token. Then, the server sends the token back to the client, and the client has to store it in a local storage. Similar to the session-based approach, the client has to send a token to the server for every request. However, the server does not store any additional information about the user session. The server has to validate that the token has not changed since it was created and signed with the secret key. Session vs Token Session-based authorization approach can be vulnerable to an attack known as Cross-Site Request Forgery (CSRF). It is a kind of attack when the attacker points to a site they are logged into to perform actions they didn’t intend to, like submitting a payment or changing a password. Another thing is that when using a session-based authorization approach creates a stateful session between a client and server. The problem is if a client wants to access different servers in the scope of the same application, those servers have to share a session state. In another case, the client will need to be authorized on each server since the session is going to be different. On the other hand, the token-based authorization approach does not require storing session data on the server side and may simplify authorization between multiple servers. However, tokens can still be stolen by an attacker and it also can be difficult to invalidate tokens. We will see the details and how to handle invalidation further in this article. JWT JSON Web Token (JWT) is an open standard that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the algorithm) or a public/private key pair using or . HMAC RSA ECDSA JWT structure JSON Web Tokens consist of three parts separated by dots . Header {
  "alg": "HS256",
  "typ": "JWT"
} The header usually consists of two parts: the type of token, and the signing algorithm being used. Payload {
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true
} The payload contains the claims, which are statements about the user. The payload is then encoded to form the second part of the JSON Web Token. You can find a description of standard fields that are used as claims . Base64Url here Signature HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret) To create the signature part, you have to take the encoded header, the encoded payload, a secret, and the algorithm specified in the header and sign that. The token typically looks like the following: xxxxx.yyyyy.zzzzz You can navigate to and debug a sample token or your own. Just paste your token into the field and select the of the token signature. jwt.io Encoded Algorithm .NET project Now that we have theoretical knowledge of how JWT works, we can apply it to the real-life project. Let’s assume we have a simple API that represents CRUD operations for the coffee entity. We are going to create an ASP.NET Core API project that represents Coffee API. After that, we will create another ASP.NET Core API project that would represent an Identity API that could generate JWT. In real life, you would probably use or , or for Authentication/Authorization purposes. However, we would create our own Identity API to demonstrate how to generate JWT. When Identity API is done, we can call its controller and generate JWT based on the user’s data. Also, we can protect the Coffee API with an authorization configuration that requires passing JWT with each request. Identity Server Okta Auth0 Coffee API First, we are going to create a simple ASP.NET Core API project that represents Coffee API. Here is the structure of this project: Let’s start with the in the folder. It is a simple entity with an and a properties. Coffee.cs Model Id Name namespace Hackernoon.Coffee.API.Model;

public class Coffee
{
    public int Id { get; set; }
    public string Name { get; set; }
} We need to store our entities while working with the API. So, let’s introduce a simple in-memory storage. It is located in the file in the folder. Storage.cs Data namespace Hackernoon.Coffee.API.Data;

public static class Storage
{
    private static readonly List<Model.Coffee> Data = new();

    public static List<Model.Coffee> GetAll()
    {
        return Data;
    }
    
    public static bool Create(Model.Coffee model)
    {
        if (Data.Any(c => c.Id == model.Id || c.Name == model.Name))
            return false;
        
        Data.Add(new Model.Coffee
        {
            Id = model.Id, 
            Name = model.Name
        });

        return true;
    }
    
    public static bool Delete(int id)
    {
        if (Data.All(c => c.Id != id))
            return false;
        
        Data.Remove(Storage.Data.First(c => c.Id == id));
        return true;
    }
    
    public static bool Update(Model.Coffee model)
    {
        if (Data.All(c => c.Id != model.Id))
            return false;
        
        Data.First(c => c.Id == model.Id).Name = model.Name;
        return true;
    }
} We need a class that would represent requests to the Coffee API. So, let’s create in the folder. CoffeeRequest.cs Contracts namespace Hackernoon.Coffee.API.Contracts;

public class CoffeeRequest
{
    public int Id { get; set; }
    public string Name { get; set; }
} When it is done, we can implement in the folder that represents CRUD operations for the coffee entity. CoffeeController.cs Controller using Hackernoon.Coffee.API.Contracts;
using Hackernoon.Coffee.API.Data;
using Microsoft.AspNetCore.Mvc;

namespace Hackernoon.Coffee.API.Controllers;

[Route("coffee")]
[ApiController]
public class CoffeeController : ControllerBase
{
    [HttpGet]
    public IList<Model.Coffee> GetAll()
    {
        return Storage.GetAll();
    }
    
    [HttpPost]
    public IActionResult Create([FromBody]CoffeeRequest request)
    {
        var model = new Model.Coffee
        {
            Id = request.Id,
            Name = request.Name
        };

        if (!Storage.Create(model))
            return new BadRequestResult();

        return new OkResult();
    }

    [HttpDelete]
    public IActionResult Delete(int id)
    {
        if (!Storage.Delete(id))
            return new BadRequestResult();

        return new OkResult();
    }

    [HttpPut]
    public IActionResult Update([FromBody] CoffeeRequest request)
    {
        var model = new Model.Coffee()
        {
            Id = request.Id,
            Name = request.Name
        };
        
        if (!Storage.Update(model))
            return new BadRequestResult();

        return new OkResult();
    }
} Coffee API is done, and we can run the project and see Swagger UI as follows: Identity API Let’s create another ASP.NET Core API project that represents Identity API. Here is the structure of this project: Let’s start with the in folder, which represents the request for the generation of a new JWT with and properties. TokenGenerationRequest.cs Contracts Email Password namespace Hackernoon.Identity.API.Contracts;

public class TokenGenerationRequest
{
    public string Email { get; set; }
    public string Password { get; set; }
} We need to implement only that represents the logic of generation JWT. But before we do that NuGet package needs to be installed. TokenController.cs Microsoft.AspNetCore.Authentication.JwtBearer using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Hackernoon.Identity.API.Contracts;
using Microsoft.AspNetCore.Mvc;
using Microsoft.IdentityModel.Tokens;

namespace Hackernoon.Identity.API.Controllers;

[Route("token")]
public class TokenController : ControllerBase
{
    private const string SecretKey = "VerySecretAndLongKey-NeedMoreSymbolsHere-123";
    private const string Issuer = "IdentityServerIssuer";
    private const string Audience = "IdentityServerClient";
    private static readonly TimeSpan Lifetime = TimeSpan.FromMinutes(20); 
        
    [HttpPost]
    public string Create([FromBody]TokenGenerationRequest request)
    {
        var claims = new List<Claim> {new Claim(ClaimTypes.Email, request.Email) };

        var jwt = new JwtSecurityToken(
            issuer: Issuer,
            audience: Audience,
            claims: claims,
            expires: DateTime.UtcNow.Add(Lifetime),
            signingCredentials: CreateSigningCredentials());
            
        return new JwtSecurityTokenHandler().WriteToken(jwt);
    }

    private static SigningCredentials CreateSigningCredentials()
    {
        return new SigningCredentials(
            new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SecretKey)), 
            SecurityAlgorithms.HmacSha256);
    }
} Note that sensitive const such as , , and have to be put somewhere in the configuration. They are hardcoded just for simplifying this test project. The field is set to 20 minutes, which means that the token will be valid for that time. You also might configure this parameter. SecretKey Issuer Audience Lifetime Now we can run the project and see Swagger UI as follows: Let’s make a call to the endpoint and generate a new JWT. Try the following payload: /token {
  "email": "john.doe@gmail.com",
  "password": "password"
} Identity API will generate the corresponding JWT: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9lbWFpbGFkZHJlc3MiOiJqb2huLmRvZUBnbWFpbC5jb20iLCJJc0dvdXJtZXQiOiJmYWxzZSIsImV4cCI6MTcwNzc4Mzk4MCwiaXNzIjoiSWRlbnRpdHlTZXJ2ZXJJc3N1ZXIiLCJhdWQiOiJJZGVudGl0eVNlcnZlckNsaWVudCJ9.4odXsbWak1C0uK3Ux-n7f58icYQQwlHjM54OjgMCVPM Enabling Authorization in Coffee API Now, when Identity API is ready and provides us with tokens, we can guard Coffee API with authorization. Again NuGet package needs to be installed. Microsoft.AspNetCore.Authentication.JwtBearer We need to register the required services by authentication services. Add the following code to the file right after creating a builder. Program.cs var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidIssuer = "IdentityServerIssuer",
            ValidateAudience = true,
            ValidAudience = "IdentityServerClient",
            ValidateLifetime = true,
            IssuerSigningKey = 
                new SymmetricSecurityKey(
                    Encoding.UTF8.GetBytes("VerySecretAndLongKey-NeedMoreSymbolsHere-123")),
            ValidateIssuerSigningKey = true,
        };
    });

builder.Services.AddAuthorization(); It is important to remember that order in middleware is important. We enable authentication by calling method and specifying as an authentication schema. It is a constant that contains a value. AddAuthentication() JwtBearerDefaults.AuthenticationScheme Bearer namespace Microsoft.AspNetCore.Authentication.JwtBearer
{
  /// <summary>Default values used by bearer authentication.</summary>
  public static class JwtBearerDefaults
  {
    /// <summary>
    /// Default value for AuthenticationScheme property in the JwtBearerAuthenticationOptions
    /// </summary>
    public const string AuthenticationScheme = "Bearer";
  }
} We need to specify that describes which parameters of JWT will be validated during the authorization. We also specify similar to the in Identity API to verify the JWT signature. Check more details about . TokenValidationParameters IssuerSigningKey signingCredentials TokenValidationParameters here The next piece of code adds middleware to the builder that enables authentication and authorization capabilities. It should be added between the and methods. UseHttpsRedirection() MapControllers() app.UseHttpsRedirection();

app.UseAuthentication();
app.UseAuthorization();

app.MapControllers(); Now, we can use the attribute over the controller or its actions. By applying this code, now all the actions in are protected with an authorization mechanism, and JWT has to be sent as a part of the request. Authorize CoffeeController [Route("coffee")]
[ApiController]
[Authorize]
public class CoffeeController : ControllerBase
{
  .. If we make a call to any endpoint of the Coffee API, we can debug and see that it is populated and has an with claims we have specified in JWT. It is an important thing in understanding how ASP.NET Core handles Authorization under the hood. HttpContext.User Identity Add Authorization to Swagger UI We did great work to protect Coffee API with the authorization. But if you run the Coffee API project and open Swagger UI, you won’t be able to send JWT as a part of the request. To fix that, we need to update the file with the following code: Program.cs builder.Services.AddSwaggerGen(option =>
{
    option.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
    {
        In = ParameterLocation.Header,
        Description = "Please enter a valid token",
        Name = "Authorization",
        Type = SecuritySchemeType.Http,
        BearerFormat = "JWT",
        Scheme = "Bearer"
    });
    option.AddSecurityRequirement(new OpenApiSecurityRequirement
    {
        {
            new OpenApiSecurityScheme
            {
                Reference = new OpenApiReference
                {
                    Type=ReferenceType.SecurityScheme,
                    Id="Bearer"
                }
            },
            new string[]{}
        }
    });
}); After that, we will be able to see the button at the right top corner: Authorize When you click on the button you will be able to enter JWT as follows: Authorize Use Postman for testing You can not limit yourself to using Swagger UI and can perform testing of the API through the Postman tool. Let’s call endpoint of the Identity API first. We need to specify header with the value in the section since we are going to use JSON as a payload. /token Content-Type application/json Headers After that, we can call endpoint and get a new JWT. /token Now, we can copy JWT and use it to call Coffee API. We need to specify header similar to the Identity API if we want to test, create, and update endpoints. header also has to be set with the value . After that, just hit button and see the result. Content-Type Authorization Bearer [your JWT value] Send Role-based authorization As you remember, the payload part of JWT is a set of claims with values that are exactly key-value pairs. Role-based authorization allows you to differentiate access to application resources depending on the role to which the user belongs. If we update the method in the file in Identity API with the code that adds a new claim for the role; we can handle role-based authentication in the Coffee API. is a predefined name of the role claim. Create() TokenController.cs ClaimTypes.Role var claims = new List<Claim>
{
    new Claim(ClaimTypes.Email, request.Email),
    new Claim(ClaimTypes.Role, "Barista")
}; Update the attribute in the file specifying the role name: Authorize CoffeeController.cs [Authorize(Roles = "Barista")] Now, all users who make a call to Coffee API have to have the role claim with the value. Otherwise, they will get status code. Barista 403 Forbidden Claim-based authorization An attribute can easily handle role-based authentication. But what if it is not enough, and we want to differentiate access based on some user properties like age or any other? You have probably already guessed that you can add your claims to JWT and use them to build authorization logic. Role-based authorization itself is a special case of claims-based authorization, just as a role is the same claim object of a predefined type. Authorize Let’s update the method in the file in Identity API with the code that adds a new claim . Create() TokenController.cs IsGourmet var claims = new List<Claim>
{
    new Claim(ClaimTypes.Email, request.Email),
    new Claim("IsGourmet", "true")
}; In the Program.cs file in Coffee API, we need to create a policy that verifies a claim and can be used in the attribute. The following code has to be added right after the method call. Authorize AddAuthentication() builder.Services.AddAuthorization(opts => {
    opts.AddPolicy("OnlyForGourmet", policy => {
        policy.RequireClaim("IsGourmet", "true");
    });
}); Update the attribute in the file specifying the policy name: Authorize CoffeeController.cs [Authorize(Policy = "OnlyForGourmet")] Summary Congratulations! You made a great effort in learning JWT in .NET. Now, you have to have a solid understanding of JWT principles and why it is important to use it to perform authorization in .NET applications. But we just scratched the surface in the area of authentication and authorization in ASP.NET Core applications. I suggest looking into Microsoft documentation regarding the topics we discussed in this article. There are also a lot of built-in capabilities for authorization and role management in the .NET platform. A good addition to this article could be Microsoft about authorization. documentation

Why do you need JWT in your ASP.NET Core project?

কেন আপনার ASP.NET কোর প্রকল্পে JWT দরকার?

Warum benötigen Sie JWT in Ihrem ASP.NET Core-Projekt?

¿Por qué necesita JWT en su proyecto ASP.NET Core?

Pourquoi avez-vous besoin de JWT dans votre projet ASP.NET Core ?

आपको अपने ASP.NET कोर प्रोजेक्ट में JWT की आवश्यकता क्यों है?

ASP.NET Core プロジェクトに JWT が必要なのはなぜですか?

ASP.NET Core 프로젝트에 JWT가 필요한 이유는 무엇입니까?

Por que você precisa do JWT em seu projeto ASP.NET Core?

Зачем вам нужен JWT в вашем проекте ASP.NET Core?

ASP.NET Core projenizde neden JWT'ye ihtiyacınız var?

Tại sao bạn cần JWT trong dự án ASP.NET Core của mình?

为什么 ASP.NET Core 项目中需要 JWT？

My name is I'm a Product Marketing, Branding, and Communications professional working with blockchain-powered products. I create Value Propositions and build brand awareness among users, developers, and VC funds. Daria Volkova . During the last 6 months, I have constantly heard from different representatives of blockchain-powered products about the need to make their chains, DeFi apps or games more accessible and user-oriented. However, evaluating the accessibility and comprehensibility of products is based on their understanding of the blockchain ecosystem and user experience. At , this question was discussed hundreds of times, especially at the events dedicated to the crypto wallet topics, implementation of the Account Abstraction concept, interface design and interactions, and making the onboarding process more accessible. In most cases, people talked about better UX for end-users (traditional businesses and their customers), but all the speeches were from techies to techies. Devconnect The paradox of the mass adoption of blockchain Crypto and blockchain-powered products must be as popular as online banking or delivery services because their business growth is only possible with mass adoption. However, over half of the blockchain companies develop products and design interfaces that a person without technical knowledge and enthusiasm can't use. Let’s be honest: despite the idea of decentralization and transparency, where only those motivated and tech-savvy enough to be Web3 natives can enter. This makes some people feel exclusive and elitist. the Web3 community resembles a closed club, However, no one was born with the knowledge of how to write smart contracts, swap tokens, or promote blockchain products that never existed on the market. Outside of our Web3 bubble, most people do not know that such a bubble exists and what is happening in it. Most people need to understand how blockchain works and what problems it solves. I'm sure your friends and relatives associate blockchain with cryptocurrencies, only knowing about Bitcoin and that it constantly changes its price for some reason. We all talk about freedom and independence, but if you go out and ask a random person to download any crypto wallet and pay for a hot dog in USDT, only a few people can complete the task without training. Some blockchain enthusiasts and developers treat such people (which means most of the Earth's population) with techno snobbery, forgetting that these people can bring fiat and digital money. Technical snobbery does not yet allow some projects to communicate with a broad audience in the way that mass adoption requires. Some blockchain and crypto projects condemn their competitors for "too Web2-oriented advertising campaigns". Companies and VC funds that want to become leaders in mass adoption must invest in communicating the utility of blockchain to traditional businesses and individual users. There are some crucial tips on Web3 marketing: 1. The coin is not the "product". 2. Use terminology that any human can understand 3. Show, not tell. Demo your use cases. 4. Segment your audience - developers, business leaders and SaaS partners have unique needs and motivations. 5. By focusing only on your project, you will get lost in the competitive analysis. It's important to note that the community is large and diverse, with different projects and platforms. Many projects try to simplify the user experience, enhance education, and create more accessible tools and applications. Some projects are improving scalability, reducing transaction costs, and addressing environmental concerns associated with certain blockchain technologies. I can highlight , the and . They are all different projects with different audiences, but they strive to improve developers' and users' experiences. Alchemy, Gauntlet, L2Beat, Optimism, Base, zkSync, Celo, 1inch, Clave Institute of Free Technology (Logos Network, Status App), Coinbase Coinbase as a guide to mass crypto adoption You have probably seen this video or other creative materials from the "Update the system" campaign by Coinbase. The ad campaign is dedicated to the limitation of the economic freedom of Americans by traditional financial organizations, crypto restrictions, and non-clear definitions by the SEC. https://youtu.be/a4F9u8Z84YI?embedable=true It includes prints, videos, viral content and a "call maker" for connecting people to Members of Congress directly from the media and providing a tailored script to help guide their conversation. Coinbase created the Congres men and women list, dividing them by their crypto acceptance/non-acceptance. Why do many blockchain and crypto people like Coinbase's ad, even though it's for a highly regulated crypto exchange with nothing to do with decentralization? People lack inspirational stories close to reality, a.k .a. mass adoption. Can you name blockchain and crypto companies/organizations that don't appeal to degens, airdroppers, or cryptoanarchists but inspire founders to create products that millions will use? I can name only the Ethereum Foundation. And can you name blockchain and crypto companies that would appeal to ordinary people and their deep human motives - to have successful careers, happy families, be financially stable, and not feel like slaves to the system? Of course, we can name Coinbase. If you analyze crypto companies' communication, most promote fast and easy money, system hacking and meme culture. Does this vibe resonate with a 19-year-old student paying off a student loan? And does it resonate with a father of three who works two shifts to ensure his family has everything they need? Obviously not. As a creator who has worked in the advertising industry for almost five years and written advertising video scripts for international brands such as Danone, Citroen, and BNP Paribas, I can say that Coinbase has not gone further in advertising creativity than a typical bank or an insurance company. But... Creating a strategic brand platform is a classic approach for many traditional businesses, but it looks innovative and causes discussion in the blockchain and crypto industry. Long-term and global campaigns like Coinbase's "Update the system" never occur in crypto. This shows the immaturity of the sector and the distance from mass adoption due to techno snobbery. How do you like this campaign? Does Coinbase truly care about crypto users, or is it just an excellent occasion to highlight the brand during a bear market? Conclusion Achieving mass adoption involves balancing the principles of decentralization and making the technology user-friendly and accessible to a broader audience. Overcoming techno-snobbery and exclusivity within the community must be crucial in promoting wider adoption. Many blockchain and crypto companies focus on technology (and that's good), but it's time to explain what they are for and how a barista in a coffee shop or a geography teacher can use them. Read my previous article about Web3 Product-Market Fit and Marketing Strategy For Blockchain Startups in 2024. Follow me on social media if you like my content: , , and LinkedIn X . YouTube

Blockchain Techno Snobbery and What Coinbase Can Teach Us About Mass Crypto Adoption

295 Stories To Learn About Cryptocurrency

202 Stories To Learn About Blockchain Top Story

230 Stories To Learn About Blockchain

Stories, News & Mentions about BARISTAAI

Baristaai’s Stories on HackerNoon