The Esports Data Company
Bayes is the supplier of the Esports Data Industry.
Official data. distribution partner for ESL, DreamHack

Bayes Esports Solutions

309 Stories To Learn About Smart Contracts

Gaming is one of the most intriguing industries throughout the world. It’s difficult to find a person who does not love playing video games. Our tastes in games may differ, but most of us have played and continue to play video games, whether it is to pass time on a flight or just because of our love for playing games. As it stands, the current gaming industry lacks on multiple fronts. In 2020, the revenue of the gaming industry has surpassed that of the film and sports industry combined. And yet, what do the gamers get in return? Nothing. This is only one of the major issues traditional video games face today. Blockchain games bring the promise of solving these issues and putting the gamers at the center of the gaming industry economy. They have the potential to create open economies that favor the gamers without harming the profits earned by the game developers. To explore the concept of blockchain gaming and how it is changing the course of the gaming industry, I interviewed Kris Vaivods, the CEO of a blockchain gaming startup called Vorto Gaming. Without wasting any more words, let’s dive in. Q1: We all have a story of how we landed in the blockchain and crypto space. What’s your story and how did the idea of Vorto Gaming come into being? I took my first step into the blockchain and crypto space back in 2013 when I found out about the anonymous digital currency Bitcoin. I set up a small mining operation in my one-room apartment and that helped me acquire my first BTC, which I sold for around $400 to pay my electricity bill. Over the years, my journey into the crypto space slowly piqued my interest in DLT technology and the global financial access that it promised for everyone. This hobby slowly grew into my main job and in 2017, with the rise of tokenization, we saw an opportunity that had the potential to change the gaming landscape. The gaming industry has forgotten a really important point: anybody's dream is to make money through something they love doing. For us, as gamers, it is playing video games. That is why in 2017, we set out to build games with economies centered around the players and that are owned by the players. We imagined virtual worlds where participants could freely trade with each other and make real money in the process. Q2. Take us through the background of the gaming industry. How did this world of geeks grow into a multi-trillion-dollar industry and what factors played the most important roles? Nerds and geeks over the last few decades, as ridiculed as they may have been, kept to reading comic books and playing games that had a good story. People want to escape, whether it is from school, social life, politics, or other things. And we think video games provide this escape from your daily life and allow you to be whoever you want to be. This leads to many creative people from across the world to make their own games, their own stories, and in most cases, those are the ones that hit home. I believe that companies never imagined how normalized gaming would become, since there was a time when gamers were considered lazy or anti-social people. Now gamers rule. With sites like Twitch and Youtube, thousands of young adults stream their gaming experiences, and they are being followed by millions of people. So, if I had to summarize in a few words why the industry has grown so much — pride and dignity. Gamers take pride in who we are, and we have dignity for the work that we do. Q3. What problems do you think this trillion-dollar industry faces and why do you think it is not aligned to benefit the gamers? With the rise of esports and streaming, gamers worldwide more than ever see that they can monetize the time they spend playing games. The problem with existing options is that it only provides profit for a tiny amount of gamers worldwide. Blockchain gaming is changing that. It provides any player a chance to enjoy a game and through competitions and trading earn money while doing that. We call it play-to-earn! The model is simple… the more you play, the more you earn.​ The play-to-earn model gives power and control back to the player. It celebrates their dedication to creating bespoke virtual spaces and experiences with financial reward. ​You don’t have to be a competitive gamer or esports icon to succeed. You just have to invest your time in the game and the reward will come.​ Q4. Where do you see blockchain and cryptocurrency technology coming into the gaming world and what’s your personally unique vision of this? The existing games offer little ownership of in-game items to the players. There’s no use of the in-game items in the outside world. Blockchain games are set to change that as in-game items of blockchain games can have real value and they can be traded in dedicated digital marketplaces for real money. This means gamers who pay for premium subscriptions and skins will get in return something that has real value. This is possible due to asset tokenization on blockchain. With this, we can create a safe way for players to freely trade their in-game items to others for real money. Players, and not the developers, are the market makers in this scenario. It will create an economy owned by the players, and through that it will democratize the gaming landscape. Blockchain provides an open and transparent economy, where the opportunity to monetize your input is an opportunity for all. ​ Q5. Vorto Gaming is implementing blockchain technology to gaming. What solutions of Vorto will help the gaming industry and the experience it offers evolve to greater levels? Vorto Network is currently solely focusing on games, more specifically on blockchain-enabled play-to-earn games. Vorto Gaming AB believes that there are two missing links, which when added can attract mainstream gamers to blockchain technology. The first thing is user experience. We need to provide a smooth onboarding process and seamless blockchain experience. Vorto Network will provide a full package for their users: wallet, which will provide the bases of receiving NFTs through gameplay, and then with few keystrokes interacting with the P2P marketplace without unpredictable gas fees attached. The second part is content. Content is king in the gaming industry and we know that! Gamers will come for the content and stay for the immersive and financially rewarding experience. We are currently focusing on launching the well-recognized play-to-earn RTS title Hash Rush this July as our showcase title for Vorto Network MVP. At the same time, we have already activated the 1st stage of the network growth strategy, which is bringing well-established gaming studios in our existing network in the immersive world of blockchain gaming. With sharp aiming we have already identified three potential opportunities, 2 listed companies in Sweden, and 1 studio in Poland. Q6. How do you see NFTs impacting the gaming industry over the next five or ten years? What aspects of gaming with NFTs disrupt for the better? As the real world evolves and services become ever more digitized, blockchain technology will continue to innovate the marketplace, providing a variety of experiences and opportunities across the digital landscape. NFTs will provide a layer of value in areas where people initially thought it was impossible to do so. I believe that gamified NFTs in the upcoming years will provide financial freedom through something that 2.7 billion people across the world love doing! Isn't that beautiful? Q7. One of the key parts of Vorto’s vision is to monetize the gaming experience for gamers of all levels. Why do you think major players in the industry will be willing to change their existing models or transition to this one? What challenges do you see ahead in the implementation of blockchain and crypto in gaming? World Asset Exchange did a study back in 2018 that showed if they were transferable. 62% of gamers would be more likely to invest in digital assets The key thing behind a successful game is a community that feels connected, appreciated, and in control. How do traditional microtransaction models work? You as a gamer buy, for example, a limited edition item. You enjoy it and show it off to your friends. Slowly the game gets boring for you and you lose interest in it. I have been in this situation many times. This rare item that you bought just stays on this inactive account and you as a developer lost a paying customer. But what if the player could sell this limited edition item before leaving the game? If this item would live on Vorto Network, that would be easily possible. Developer receives a cut from the trade so they are able to monetize the player one last time. The player selling the item receives money, making them feel more in control and appreciated. The one who bought it receives something that they eagerly wanted and their urge to collect has been satisfied. It is a win-win situation for both the game developers and the gamer. So, why wouldn’t the companies want to implement blockchain technology to their games?

Blockchain Can Create a User-Focused Gaming Industry - Unhashed #5

183 Stories To Learn About Infographic

United States and European Union Forge Alliance to Safeguard Trade and Security

মার্কিন যুক্তরাষ্ট্র এবং ইউরোপীয় ইউনিয়ন বাণিজ্য ও নিরাপত্তা রক্ষায় জোট গঠন করে

Die Vereinigten Staaten und die Europäische Union schmieden ein Bündnis zum Schutz von Handel und Sicherheit

Estados Unidos y la Unión Europea forjan alianza para salvaguardar el comercio y la seguridad

Les États-Unis et l’Union européenne forgent une alliance pour sauvegarder le commerce et la sécurité

संयुक्त राज्य अमेरिका और यूरोपीय संघ ने व्यापार और सुरक्षा की सुरक्षा के लिए गठबंधन बनाया

米国と欧州連合、貿易と安全保障を守るための同盟を結ぶ

미국과 유럽연합은 무역과 안보를 보호하기 위해 동맹을 맺었습니다.

Estados Unidos e União Europeia formam aliança para salvaguardar o comércio e a segurança

США и Европейский Союз создают альянс для защиты торговли и безопасности

ABD ve Avrupa Birliği Ticareti ve Güvenliği Korumak İçin İttifak Kuruyor

Hoa Kỳ và Liên minh Châu Âu thành lập liên minh để bảo vệ thương mại và an ninh

美国和欧盟结成联盟以保障贸易和安全

Artificial Intelligence tools such as Bard, ChatGPT, and Bing Chat are the current big names in the category which is on the rise. Large Language Model (LLM) LLMs are trained on vast data sets to be able to communicate by using everyday human language as a chat prompt. Given the flexibility and potential of LLMs, companies are integrating them into many workflows inside the tech industry to make our lives better and easier. One of the main AI-workflow integrations is an auto-complete code plugin, providing the ability to foresee and generate matching code patterns in order to code faster and more efficiently. In the current market of AI code-generator tools, there are many players, including , , , , and more. This blog post outlines examples of common security pitfalls that developers face while using such tools. GitHub Copilot Amazon CodeWhisperer Google Cloud Code (Duet AI) Blackbox AI Code Generation The goal of this article is to raise awareness and emphasize that auto-generated code cannot be blindly trusted, and still requires a security review to avoid introducing software vulnerabilities. Note: some vendors suggest that their auto-complete tools may contain insecure code snippets. Many articles have already emphasized that auto-complete tools generate known vulnerabilities such as , SQL injection, and XSS. This post will highlight other vulnerability types that depend more on the code’s context, where there is a high probability for AI auto-complete to slip bugs into your code. IDOR AI models trained for code are usually trained on large code bases with the main mission of producing functioning code. Security and AI Code Generating Tools Many security issues have a known and defined way of mitigation without compromising the performance side (e.g. SQL injections could be avoided by not concatenating user input/parameters directly into the query) - and therefore, can be eradicated as there is no reason to write the code in an insecure manner. However, many security issues are which could be perfectly safe when implemented as internal functionality, while when facing external input from a client, become a vulnerability, and are therefore hard to distinguish through the AI’s learning dataset. context-dependent In such vulnerabilities, the specific usage of the code usually depends on other parts of the code and the application’s overall purpose. Here are some common use cases and examples that we tested, showcasing some of these types of vulnerabilities: Use Case: Fetching Files from User Input - Arbitrary File Read Use Case: Comparing Secret Tokens - Type Juggling/Coercion Use Case: Forgot Password Mechanism - Unicode Case Mapping Collisions Use Case: Generating Configuration File - Bad Security Practices Use Case: Configuration Objects - Inconsistencies Leading to Insecure Deserialization After seeing how the AI code generation tools handle the above cases, we tried to test their ability to create proper security filters and other mitigation mechanisms. Here are some common use cases and examples that we tested by deliberately requesting secure code: Secure Code Request Use Case: Reading Files - Avoiding Directory Traversal Secure Code Request - File Upload - Restricted Extensions List Use Case: Fetching Files from User Input - Arbitrary File Read Many applications include code that fetches a file back to the user based on a filename. Using directory traversal for reading arbitrary files on the server is a common method bad actors use to gain unauthorized information. It may seem obvious to sanitize file name/file path input coming from the user before fetching the file back, but we assume it is a hard task for an AI model trained on generic codebases -  this is because some of the datasets as part of their functionality (it may even downgrade performance or harm functionality) or are not harmed by unsanitized path as they are intended to be only for internal usage. do not need to use sanitized paths Let’s try to generate a basic file fetching function from user input, using Google Cloud Code - Duet AI auto-complete. We will let Duet AI auto-complete our code, based on our function & route names - AI Tool Suggestion (Google Cloud Code - Duet AI): As we can see in gray, the autocomplete suggestion is to use Flask’s “ ” function, which is Flask’s basic file-handling function. send_file But even Flask’s documentation states “ ”, meaning that while inserting user input directly to the “send_file” function the user will have the ability to read any file on the filesystem, for example by using directory traversal characters such as “../” in the filename. Never pass file paths provided by a user Proper Implementation: Replacing the “send_file” function with Flask’s safe “send_from_directory” function will mitigate the directory traversal risk. It will only allow fetching files from a specific hard-coded directory (“exports” in this case). Use Case: Comparing Secret Tokens - Type Juggling/Coercion In some programming languages, such as PHP and NodeJS, it is possible to make comparisons between two different types of variables and the program will do a behind the scenes to complete the action. type conversion Loose comparisons do not check the variable’s type behind the scenes and therefore are more prone to type juggling attack. However, the use of loose comparisons is not considered an insecure coding practice by itself - it depends on the context of the code. And again, it is difficult for AI models to tell the cases apart. The most common example of PHP type juggling is loose comparisons of secret tokens/hashes where user input which is read via a JSON request (which enables control of the input’s type) reaches a loose comparison (“ =”). AI Tool Suggestion (Amazon CodeWhisperer): ”) instead of a strict one (“ As it appears, CodeWhisperer generates loose comparison conditions in auto-complete suggestions: The loose comparison of the secret_token allows an adversary to bypass the comparison $data[“secret_token”] == “secret_token”. While submitting a JSON object with the value of “secret_token” being True (boolean), the (even on newer PHP versions). loose comparison result is True as well Even when “hinting” the tool (using a comment) to write the check “securely”, it did not generate a code snippet containing a strict comparison - Proper Implementation: Only when specifying a strict comparison (“===”) we are protected against type juggling attacks. Use Case: Forgot Password Mechanism - Unicode Case Mapping Collisions Vulnerabilities in the “Forgot Password” mechanism are very common in SaaS applications and were the root cause behind CVEs such as (Wordpress), (Django), and (GitLab). CVE-2017-8295 CVE-2019-19844 CVE-2023-7028 Specifically, a Unicode Case Mapping Collision vulnerability occurs when user input is either uppercased or lowercased in a comparison expression while its original value is also used in the code. Some different characters will result in the same char code when transformed. For example, “ß” and “SS” will both transform into “0x00DF” when uppercased. Such cases are usually used to bypass/mislead some security checks by tricking the comparison check and later using the original value which is different than expected. These cases are quite elusive to grasp, especially when many implementations are possible. A mechanism that’s particularly susceptible to this vulnerability type is the . It is common to normalize the user’s input into uppercase or lowercase (in email addresses or domain names) when performing the check in order to avoid unwelcome mismatches. AI Tool Suggestion (GitHub Copilot): forgot password mechanism As an example, taking a look at the Copilot-generated code for the forgot password function (below) shows that it is vulnerable to this issue. Copilot’s code first looks up the lowercased email address: Then, when following through with the rest of the process it suggests the following: As we can see, the autocomplete suggestion generates a random password and sends it to the user’s email address. However, it initially uses a lowercase version of the user’s email for fetching the user account, and then continues to use the original user’s email ‘as-is’ (without a lowercase conversion) as the target of the recovery email. For example, lets say the attacker owns the inbox for “miKe@example.com” (the “K” is a unicode character) and uses this email for the “Forgot Password” mechanism. The emails “miKe@example.com” and “mike@example.com”, are equivalent ‘as-is’, but after lowercase conversion they will be - Kelvin Sign not Using the email address “miKe@example.com” will fetch the account information for “mike@example.com” but the reset password will be sent to the attacker’s inbox (“miKe@example.com”), allowing takeover of the “mike@example.com” account. The email address used for fetching the user account must exactly equal the recovery email address (i.e. send_email parameter will also use email.lower()). Proper Implementation: In addition, as a precaution, it is recommended to use the value that was already stored in the server instead of the one supplied by the user. Use Case: Generating Configuration File - Bad Security Practices Another topic that could confuse auto-complete tools is writing configuration files, especially for complicated cloud infrastructures. The main reason is that indeed there are security best practice guidelines, but not everybody follows them, and in some cases, it is needed to go against them. Such code samples might find their way into the AI training dataset.  As a result, some auto-complete outputs will violate the recommended security guidelines. In the following example, we will create a configuration file for a , the smallest execution unit in Kubernetes. Kubernetes Pod In this example, we start creating a Pod configuration file. AI Tool Suggestion (Blackbox AI Code Generation): The suggestion creates the capabilities section and adds a Linux kernel capability (SYS_ADMIN) to the container which is essentially equivalent to running the pod as the root user. Is it better to just omit the securityContext then? No - since many other capabilities will then be added by default, violating the . Proper Implementation: principle of least privilege According to , the most secure setup is to first drop all Linux kernel capabilities and only afterward add the ones required for your container. Docker security best practices In order to fix the issues mentioned above, the capabilities section begins by dropping all capabilities, and will then gradually add the needed ones for our container. Use Case: Configuration Objects - Inconsistencies Leading to Insecure Deserialization Many vulnerabilities require defining a configuration object, which decides how the application will handle the required component. The example we chose is deserialization library in C#, which can be used securely or insecurely depending on the JsonSerializerSettings object’s configuration, and specifically, the . Newtonsoft’s JSON TypeNameHandling While we tested the deserialization code, we noticed that the configuration object’s definition is quite random, and subtle changes can lead to generating a different configuration set. The following examples display an inconsistent behavior that is based only on the method names used by the developer: AI Tool Suggestions (Amazon CodeWhisperer): We can see two different configurations that both result in insecure JSON deserialization due to the TypeNameHandling property being “Auto” and “ALL”. These properties allow the JSON document to define the deserialized class - letting attackers deserialize arbitrary classes. This can be easily leveraged for remote code execution, for example by deserializing the class “System.Diagnostics.Process”. The only difference in the developer’s original code are the method names. Proper Implementation: By default, a JsonSerializerSettings object is instantiated with “TypeNameHandling = TypeNameHandling.None”, which is considered to be secure. Thus, we use JsonSerializerSettings’s default constructor which will result in a safe TypeNameHandling value. Similar to the first use case, where we examined the vulnerable code produced by Copilot for fetching files, here we attempt to request a secure version of a file reading mechanism. Secure Code Request Use Case: Reading Files - Avoiding Directory Traversal AI Tool Suggestion (GitHub Copilot): We can see that the security check is really naive, only avoiding dot-dot-slash sequences that are needed for conducting directory traversal attempts. The path parameter can be an absolute path - pointing to any desired path on the system (for example, /etc/passwd), which defeats the purpose of the security check. Proper Implementation: Here, the secure_file_read function gets a (relative) filename parameter along with a directory (safe_dir) where the filename should reside (and which should not be escaped).
It creates an absolute path by joining safe_dir and filename and proceeds to get its canonicalized form by calling realpath. It then gets the canonicalized form of the safe_dir folder. Then, the file contents are returned only if the canonicalized path starts with the canonicalized safe_dir. It is a common use case to only accept specific file types for upload based on their extension. Secure Code Request - File Upload - Restricted Extensions List In the following example, we asked the AI auto-completer to generate a function tasked with filtering dangerous file extensions. AI Tool Suggestion (Blackbox AI Code Generation): The suggested Python code takes the filename, separates the extension, and compares it against a list of dangerous extensions. At first glance, this code snippet looks secure. However, forbid filenames ending with a dot, and when supplying a filename ending with a dot (“.”) during file creation, the dot will be discarded. Meaning, that the generated filter could be bypassed on Windows when submitting a file with a malicious extension followed by a dot (ex. “example.exe.”). Windows filename conventions Usually the better approach is to use a , which checks the file extension only against allowed extensions. However, since the tools took a blacklist approach (which is needed in some cases) we will outline a safer blacklist implementation: Proper Implementation: whitelist In the following snippet, we strip away as much control the user had on the input by stripping the extension from all non-alphanumeric characters and concatenating it to a newly generated filename. Automatic co-programmers are great for suggesting ideas, auto-completing code, and speeding up the software development process. We expect these tools to keep evolving as time goes on, but for now as demonstrated with the use cases in this post, auto-complete AI solutions have many challenges to overcome until we can ease our minds and trust their output without double-checking for bugs. Bottom line - use with caution A possible way to reduce the likelihood of introducing vulnerabilities is deliberately requesting the AI code generation tool to generate secure code. Although this may be useful in some use cases, it is not foolproof - the “seemingly secure” output should still be reviewed manually by someone proficient in software security. To help secure your software, we recommend both manually reviewing code produced by AI generative tools, as well as incorporating security solutions such as Static Application Security Testing (SAST) which can trustfully discover vulnerabilities as you go. As seen in the example above, SAST tools can alert and catch the unicode case mapping collision described in use case #3. This proactive approach is essential to ensuring the security of your software. JFrog Security Research Team Recommendations The security research team’s findings and research play an important role in improving the JFrog Platform’s application software security capabilities. Stay up-to-date with JFrog Security Research Follow the latest discoveries and technical updates from the JFrog Security Research team on our , and on X . research website @JFrogSecurity

Analyzing Common Vulnerabilities Introduced by Code-Generative AI

কোড-জেনারেটিভ এআই দ্বারা প্রবর্তিত সাধারণ দুর্বলতাগুলি বিশ্লেষণ করা

Analyse häufiger Schwachstellen, die durch Code-generative KI entstehen

Análisis de vulnerabilidades comunes introducidas por la IA generativa de código

Analyse des vulnérabilités courantes introduites par l'IA génératrice de code

कोड-जेनरेटिव एआई द्वारा प्रस्तुत सामान्य कमजोरियों का विश्लेषण

コード生成 AI によってもたらされる一般的な脆弱性を分析する

코드 생성 AI로 인해 발생하는 일반적인 취약점 분석

Analisando vulnerabilidades comuns introduzidas pela IA geradora de código

Анализ распространенных уязвимостей, создаваемых кодогенерирующим ИИ

Kod Üreten Yapay Zekanın Getirdiği Yaygın Güvenlik Açıklarını Analiz Etme

Phân tích các lỗ hổng phổ biến được giới thiệu bởi AI tạo mã

分析代码生成人工智能引入的常见漏洞

In a recent conversation about state management in React, the topic of scalability came up. I was disappointed, but not at all surprised to hear it written off as an unimportant buzzword. Having been a fly on the React state management wall for 8 years, I've seen this general sentiment expressed over and over: All popular React state management solutions are "scalable" and that's all you need to know. It isn't. Join me for a minute and I'll tell you why. What Is Scalability? I hate to be one of those blogs that starts off a lawn-treatment article by defining grass. But the very definition of scalability when it comes to state management has been lost in the React community. Allow me to define it. "Scalability" refers to a tool's ability to adapt to new challenges over time. Importantly, it goes both ways - scaling up . A scalable tool handles every situation well - elegance in every facet of complexity: and scaling down This would be a very idealistic state manager. In reality, there is no such silver bullet. Scalability is the art form of getting as close as possible to this perfect plateau. Elegance is largely subjective, but there are a few measurable statistics like performance benchmarks, lines of code (read boilerplate), and the number of unique concepts the user is required to know to do a given task. Still, some state managers will be more "scalable" . And that's fine! for you Just keep this in mind. The Criteria Apps grow. Teams grow. A scalable state management tool needs to elegantly solve a number of problems at every stage of an app's growth. These problems include: Performance. Bigger apps need to move data quickly and prevent unnecessary re-renders. Debugging. Are updates predictable? Can you track down unexpected changes? Boilerplate. Tiny apps don't need a bazooka and big apps don't want thousands of them. Side effects. Are these defined clearly? Are they flexible and simple? Caching/Memoization. Big apps need control over memory usage and tiny apps don't care. I'll call these the . There are more considerations like code splitting, testability, extensibility, interoperability, adoptability, even-more-abilities, and the learning curve. But these 5 will do for this article. 5 Great Scalability Criteria As a general example, an overtly simple state manager might look something like this: A naive solution becomes less useful over time, requiring you to find uglier and more complex workarounds. Such a tool can start to get in your way more often than it helps. A truly scalable state manager doesn't drown a tiny app in config files and boilerplate and it doesn't leave a big app stranded in a sea of missing features and unstructured simplicity. at the same time, I'm sure this all sounds pretty straightforward. So why do I feel like this art has been lost? React Context Don't get me started. Nope, too late. React's new(ish) context API is a thing of beauty and a joy to work with, you don't use it for state management (directly). if React context is the quintessential example of a non-scalable React state management solution. As an app grows, React context inevitably leads to performance problems and dev X nightmares like indirection, mystery updates, implicit dependencies, and lots of tightly-coupled logic that makes abstraction, testing, and code splitting difficult. React context creates as much lock-in as a real state manager - and even more, since you'll write the boilerplate yourself. All that added boilerplate also increases the surface area for bugs. // There are many potential footguns with even this many providers - e.g.
// UserProvider creating an implicit dependency on AuthProvider, Routes
// rerendering due to UserProvider's state updating, etc.
function App() {
  return (
    <AuthProvider>
      <UserProvider>
        <RouteProvider>
          <Routes />
        </RouteProvider>
      </UserProvider>
    </AuthProvider>
  )
} I've seen this happen countless times on and : Twitter Reddit Someone complains about how they regret starting with React context and asks what they should use instead. Within a few hours, someone else will say, "Hey, I'm new. Where should I start?" and we all jump on and tell the poor guy to start with React context, dooming him to the same fate. This goes on in an endless loop. Are We Ever Gonna Learn? The advice to use React context for state management is not malicious. In fact, I believe it comes from good intentions. React devs tend to recommend React context for state management because it sounds like a decent, unopinionated, neutral, objective, diplomatic solution that's readily available. And it is all of those things. But it's also really bad advice. I know that React state management is a polarizing topic. Avoiding it sounds like smooth sailing. But don't forget that competition breeds innovation. In the last 8 years, React state management has evolved in many, many ways that will benefit . Don't ignore it! you To be clear, I'm not talking about ` ` and `useReducer` by themselves. Those are great tools for keeping the local state tied to a component's lifecycle. You should use these even when you have a good state manager. useState I'm talking about the moment when you need to (which you will need to do). Simple props are totally fine, as shown in that linked doc. But when you run into prop drilling problems, have a plan from the very beginning for what you're going to use. And don't use raw React context. Just don't. You'll thank me. lift state up Doing It Right Now, I'm sure you've heard that React context can be used effectively at scale. And that's true (to an extent), you do it right. if The main principle for this is using React context for . That article is an excellent breakdown of this technique. The gist is that React context is a very powerful model that requires at least a thin wrapper to be used for state management. dependency injection, not state management low-level The "thin wrapper" can be as simple as an . RxJS BehaviorSubject Bad: function UserProvider({ children }) {
  const [user, setUser] = useState({})

  return (
    <userContext.Provider value={{ user, setUser }}>
      {children}
    </userContext.Provider>
  )
} Good: function UserProvider({ children }) {
  const subject = useMemo(() => new RxJS.BehaviorSubject({}), [])

  return <userContext.Provider value={subject}>{children}</userContext.Provider>
} This is just the (simplified) Provider. To use React context properly, you also have to learn to colocate logic, create hook wrappers, and create a system for triggering and taming rerenders using the pub/sub or similar model. Sound like a lot of work? Good, because it is! To use React context properly, you essentially have to roll your own state manager. If you're willing to tackle the 5 Great Scalability Criteria yourself, this is totally fine. Just don't go off the deep end with generators and stage 2 ECMAScript proposals. Keep concepts familiar for the sake of future team members and your own future self. Alright, you knew was coming. Redux Redux I'm talking about Redux pre- here. Due primarily to its infamous boilerplate, raw Redux has proven to not be a very scalable solution - it's clumsy for small apps to get started with and at the same time is clunkily verbose for large apps. RTK Redux did, however, make long strides over previous Flux implementations in other scalability criteria: #2 Debugging - Redux's time travel model was revolutionary #4 Side Effects - Redux's middleware finally gave these a comfortable home Redux Toolkit (RTK) finally fixed many of the boilerplate problems. This alone makes RTK a very "scalable" state management solution. Redux excels in the moderate-to-fairly-high complexity range. RTK is an overall improvement but is still a little verbose for very small apps. Overall, I'd draw its scalability like this: I'll cover that sharp drop at the end in a minute, but first: Zustand This excellent state manager removed even more of Redux's boilerplate at the cost of some debugging power. You can think of as a very simplistic RTK that scales down way better and scales up only a little worse. Zustand I'll cut to the graph: Since Zustand covers the full spectrum better, altogether, I would call Zustand more "scalable" than RTK. It's more comfortable for small apps to use and will be a steady companion all the way up almost to the extremes of complexity. I've seen many people on the RTK train bewildered about Zustand's success when RTK clearly scales up better. I hope the above graph clears this up a little - many apps don't need to scale up that far. But they do want a state manager that scales all the way to elegantly handle state in even the initial PoC/prototype phase. down Alright, it's time to talk about those steep drops at the end. Singleton vs Atomic Redux and Zustand use a singleton model. You create one store. All side effects and state derivations (selectors) hook into that store. This approach has a hard upper limit. I wrote some thoughts about this on . The gist is that an app with lots of fast-moving data can start to bottleneck a store with lots of subscribers, reducers, and deep selector graphs. this Reselect discussion introduced a new pattern for storing state and propagating updates. This atomic model has proven to scale up better than the singleton model at the cost of some hefty learning curves. Recoil Still, it can be very useful in even very small apps. I'd draw its overall scalability something like this: That slow tail-off at the end is 👌 and is why I believe atomic (or similar) models are the future. Jotai Jotai did to Recoil what Zustand did to Redux; it sacrificed a little long-term power for some short-term elegance. This makes Jotai an excellent all-around tool. The graph: Please remember that this is just a dude drawing lines on . These lines don't accurately reflect each tool's capabilities in every aspect of every app or in the hands of every programmer. I'm trying to communicate only the general "scalability" of these tools from my experience given the scalability criteria I outlined. Excalidraw With its simple APIs and very gracefully declining performance and capabilities, Jotai is the closest any of these tools have come to the "perfect plateau" at the beginning of this article. Yes, that's right. Jotai is the most scalable state management solution. The end. Well alright, the end. I wouldn't be here if there wasn't a little bit more to the story: almost We Need To Go Deeper After encountering the hard limit of the singleton model, a few coworkers and I started studying Recoil and Jotai. We loved the concepts and the performance scalability but determined that they were lacking in other scalability criteria. In 2020, I hatched a plan for an in-house solution that would sacrifice only a tiny bit of Jotai's simplicity in exchange for a much more powerful atomic model. Designed from the ground up with the 5 Great Scalability Criteria (and a lot more) in mind, this model scales up better than any of its predecessors and scales down only a little worse than Jotai. This new tool started driving our production apps in early 2021 and has been a lifesaver in the extremes of complexity. 2 years later, we have finally open-sourced this tool as . "Zedux" Zedux Besides solving better for all of the 5 Great Scalability Criteria, Zedux added many features over Recoil/Jotai like React Query-esque cache management, cross-window support, real Dependency Injection, evaluation tracing, and atom exports. These are fun to say, but I'll write more about them in a separate article. Overall, by design, Zedux's scalability looks like this: Besides a clear bias and my own experience using Zedux in data-intensive applications, the reason why I draw Zedux's scalability so generously is because of the 5 Great Scalability Criteria: Performance (benchmarks , , , ) here here here here Debugging Boilerplate Simple but completely powerful side effects model Cache control features There are many more reasons, but I'll limit it to these 5 for this article. Zedux was designed primarily to manage extremely volatile states in big fintech applications and to scale down well too. But that doesn't mean it does everything perfectly. fairly For small apps, Jotai and Zustand are certainly great options. Beyond that, personal preference can also come into play. As I said at the beginning, some tools are more scalable . for you Does Scalability Matter? Scalability is a general principle, but that doesn't mean that every extreme applies to every app. You are free to analyze your own application and determine which parts of this discussion matter for it. Just be sure to leave yourself plenty of leeway in your predictions. and will ever matter Anything with live-time data visualization may need to scale up performance-wise beyond what the singleton model can handle. Additionally an app that's "just very, very big" might need more power. This is all up to you to decide. But no, not all of this applies to every app. Conclusion All modern state managers are solid options for most apps, but they scale up and down differently for each of the 5 Great Scalability Criteria. Pick one you like that will suit the relative size and future complexity of your app. And don't use React context for state management unless you really want to make a state manager from scratch. If the decision is too hard, here's my recommendation as someone who's been using React for 8 years: Pick either Zustand or Jotai if you want something you can start with quickly and that will scale up to moderate complexity (think an e-commerce or forum app). Pick RTK if you want something that will scale very well to almost the extremes of complexity and has a solid community. up Pick Zedux if you want all your bases covered - from simplicity to ultimate complexity and everything in-between. Lastly, I know that I've omitted many great tools like , , and . These tools are utilities that are very scalable in their own right, but aren't full replacements for a good state manager. XState React Query SWR As for other global, atomic, proxy-based, and signal-based state managers, I'm sorry I couldn't get to them all in this article. Feel free to comment or start a discussion in for better details or more comparisons. the Zedux repo If you get nothing else from this article, just remember that applications grow. Plan for growth and you'll succeed. Featured photo by on Unsplash. trail

Scalability: the Lost Level of React State Management

When you have an app idea, you need to get things sorted out before you jump onto the development train. Getting the right people at the table, talking to users and defining your blueprint will help you to get things sorted out. Read on if you want to get solid advice on doing so. TL;DR Put together a group of stakeholders Talk about the pain point, the it needs to be fixed and an app can deliver value why how Involve an objective app expert to help you Talk to potential users (the target audience, if you will) about their problems and how they fix them / work around them nowadays Define solutions that might work by defining the Minimum Viable Product Create specs that you can use as a blueprint The Full Story I’ve been around the block for 6+ years now, when it comes to creating mobile applications. As as former web developer I started coding native iOS apps as soon as the first iPhone 3G landed in The Netherlands. More Than Just The Code After creating my first tiny utility — just to get the hang of it — and completing my first full implementation cycle by successfully publishing to the App Store, I got my chance to become a full-time mobile developer at a (then) small company. There, I learned quickly that developing apps for customers with a specific need — whether it is a business need or an enduser’s need — and that the real difference wasn’t being made in just the code. It was in the part where you engage and discuss the ideas of these narrow-scoped implementations and how they might result in maximum value for those that hold your application in the palm of their hands. Value First It took me a year or three, switching from native development to hybrid (Cordova, later Ionic Framework) technology and then off to cross-platform development with Xamarin, to understand that creating a solution that covers most bases in a short implementation cycle was what let people check if their idea beared real potential. Add the fact that since 2016 I listened to a lot of podcasts, audio books and read a lot of interesting stuff about The Lean Startup, user interviewing, pivoting, defining Minimum Viable Products (MVP’s) and you get where I am today. How To Define The Core Value Of Your App Having that spark, that idea for an app, is where it all starts. No matter if you’re a manager at a corporation that wants an app to speed up and support an exsting process, a company that wants to extend their services by providing smartphone based tools, or an individual with some cash to get a mobile product going. They all need to define what it is for their app idea that provides value. The steps that are necessary to get a basic understanding of the smallest version of your product that will provide enough value to support whatever business case are almost every time identical. And they all boil down to understand what you want to create, for whom you’re aiming to create it, and why it provides enough value to make it a viable product. These are all ingredients that let you sort out what the Minimum Viable Product (MVP) for your idea is and why it should be built. The Steps To Find Out What To Implement Since the last 5 years, I’ve given multiple workshops for corporations, foundations and smaller companies to define their problem, how an app could be the solution for that problem, and how that implementation would look like. Just like a blueprint helps to define the function and setup of a building, a good set of specifications for an MVP can help you to create a feasible indication of what your app is going to be about and how it is adding value. The following steps help me to work out those things into a nice set of specifications that will guide the app idea towards the implementation. Research The Pain Point Put together the people that represent all necessary parties, the stakeholders if you will (a decider from management, a security and IT colleague to cover those bases, a user/user representative, and optionally a support employee. Talk about the problem at hand: what is the motivator that sparked the app idea. Talk about who are experiencing the problem and how are they solving this now. What value will an app bring along. Will it save time, open up a process because of moment/location/device independency? Will it create more joy for an otherwise tedious process? Make an inventory the necessary components and if they’re available within the context of the app; are there systems, manual processes or knowledge available within your company, the niche or online that are of value? Check the complications within that same context of having to hook them up with your app idea. Does it cost a lot of effort, time, money to hook things up together? Define the solution What is the minimum set of functionality that needs to be implemented to be of any use. Use T-shirt sizing or MoSCoW techniques to find out what is important and what is less important. Try to distinguish things that could be nice but can be done manually at first (password resets? data exports?…) What kind of dynamic aspects require to be maintainable by non-coders? This leads to CRUD screens and administration functionality that are often required to keep the information, functionality and value in an application relevant and useful. What would a user-flow look like? Could you sketch some basic screens and line out the flow that, when put together, make up the user experience? Work out all of the above so you have an overview of the necessary components, the screen outlines with the interaction flow, and functional requirements of what is minimally needed to get this implementation to provide value. App Expertise Is Recommended The steps are all not really complex, but they are far from easy. One of the things that prevents most people from performing the mentioned steps correctly is their blessing as well: their knowledge. Knowledge biasses their thinking which prevents them from looking at the problem rationally and without emotion. Knowledge also creates blind spots which often shows when it appears to be difficult to think of innovative or fresh approaches and ideas to tackle a process. Another problem is both technical and conceptual: you need to know and understand what the possibilities and common sense for apps is in the current market. And what the trends are for the near future. If you don’t care much for mobile applications it can prove to be hard to understand what kind of interaction, common flows and types of usage could be used to make up a slim and easy workflow that is understandable for users of an Android version, or the iOS counterparts for that fact. It takes practice and understanding of a platform’s best practice, and an overview of the common denominators to fully understand how a functional discussion point could be best implemented into an app. And I didn’t even start to cover topics like security, regulations like the GDPR, ISO standards, best practices, accessibility, and hardware possibilities and limitations. By now, I think you’ll agree that there are quite some aspects that might indicate it is better to involve someone with a background in app development and/or app expertise to guide you in through this process. Get Proper Guidance In order to get the best value of your buck, it is important to involve someone that knows how to create applications, has enough experience with discussing the problem at hand and providing solutions for similar issues. But knowledge alone won’t cut it here, either. Find someone that you have a click with. Someone that can appreciate the character of your team of stakeholders (see the steps mentioned earlier) and who isn’t afraid of asking the questions that need to be asked in order to expose the best solution for the buck and added value. In short, some of the most important characteristics for an app expert should be: objective to the organisation (or at least, the stakeholders and the pain point you’re trying to solve) experience in the app (product) development field someone with one eye on the technical, one on the business side of things an investigative person someone with the proper social skills who can ask harder questions without disrespecting anyone mindset; looking to get the maximum value for the least effort valuefirst Talk To Potential Users If you glue together your problem definition, the why and how an app provides value with an expert you’ll have a nice starting point. Together you can work out the actions and define an MVP for your App. One of the best resources to read for interviewing your target audience is this book: . It gives solid advice on how to interview people without biassing them The Mom Test by Rob Fitzpatrick Just keep in mind that although setting this vision on e-paper will not suffice on its own. Even when you have the most qualified and efficiënt user-representative aboard your stakeholders team, talking to end-users will be crucial. The definition of your app — that you will have created after hooking up with the right expert and walking through all the mentioned steps — will provide a nice blueprint that you can use to discuss with users so don’t be shy of talking to users. Don’t fall into the trap of sliding the specs and screens in front and ask if they’re a good fix. Keep those behind and talk about the pain points that people are experiencing, how they fix these kinds of problems right now. And if they think there is room for improvements. You’ll be amazed about the feedback that potential users can give you regarding to the problem. Don’t assume that things provide value for the users, check them via (potential) user interviews and get to the bottom of a pain point. Concluding There you have it. A high overview of all the things that I would recommend anyone who is thinking about creating an app. The steps and advice that I mention in this article will prove to be useful for any organisation or individual to prepare and think about the app’s origin, the value it might bring, and the minimal solution. Don’t take this information light, as you’ll often find out that when it comes to creating something minimal and simple, more effort is needed to work it out properly. If I had more time, I would have written a shorter letter — Mark Twain Prepare your journey but most of all, go through the process. No preparation on earth will let you discover and learn what talking talking with stakeholders and your potential users will. Let me know if you’re struggling with bringing your app idea into this world. I’m an experienced developer with a mindset that focusses on delivering value. #valuefirst You can always check out my services at EEKAY ONLINE.com Code Hard, Ship Harder ✌🏻

From App Idea To Implementation [Guideline]

Poverty, corruption, inflation, and high unemployment levels are some of the problems that are common to developing countries around the world. Years of political instability and poor governance has plunged some nations into devastating economic crisis. With the fast-paced nature of growth and advancements in other more developed parts of the world, the prospects sometimes do seem bleak for these developing nations. However, the emergence of blockchain technology and cryptocurrency has brought renewed enthusiasm about the prospects of a revival in these countries. The focus of this article is to examine possible answers to the big question of how cryptocurrency can be of use to these countries. Reduce Remittance Cost The global remittance system is based almost entirely on the activities of citizens of developing countries who are immigrants in the developed world. From time to time, these individuals have to send money back home. In order to do so, they have to rely on intermediary services like Western Union, Money Gram, Uni Transfer etc. These platforms collect fees and charges which considerably increase the cost of such transactions. According to figures released by the , the recorded remittance to developing countries in 2016 was about $441 billion, more than half of the total recorded global remittance. The figures also revealed that global remittance fee for Sub-Saharan was an average of $20 per $200 which was the highest in the world. World Bank in 2017 With cryptocurrency, the cost of remittance can be drastically reduced as well as the hassle required to receive the international money transfer. Already, there are a number of platforms in Africa and Southeast Asia that are offering such services. , a Nigerian based blockchain-powered remittance system that will offer zero-cost, cross-border transactions launched their ICO in January 2018. In the Philippines, there is a platform called which offers more efficient remittance services. Users of the Rebit platform can send money at a much lower than rate than conventional money transfer services. SureRemit Rebit 2. Improve Financial Inclusion Lack of financial inclusion is a massive problem in many low-income countries around the world. According to the , there are more than 2 billion unbanked people worldwide. The majority of this number live in developing countries around the world. In countries like Pakistan, Chad, Burundi, Niger, Yemen, and Cameroon, less than 15 percent of the adult population have bank accounts. Even the ones that do have bank accounts are said to be underbanked meaning that they don’t have access to premium banking services. This lack of access to banking instruments precludes them from being able to participate in global commerce. World Bank With cryptocurrency services like and , millions of unbanked people can finally get access to banking services and financial instruments through cryptocurrency. These platforms are offering cryptocurrency banking services through mobile phone apps. Telecommunications has been able to achieve a much greater market penetration than banking services. These crypto banking platforms are using the reach of telecoms to take financial emancipation to the doorsteps of the unbanked and underbanked. The end result is greater financial inclusion. MPesa BitPesa There is also the added incentive of empowering small and medium-scale businesses. Local merchants can begin to think global in terms of imports and exports. Banks in developing countries like Nigeria are notorious for their unwillingness to give loans to small-scale businesses even when suitable collaterals are provided. With cryptocurrency, platforms like Mpesa, BitPesa, and Nebeus can offer crypto-backed loans to small-scale and medium-scale merchants. This will go a long way in getting them started in the import and export business which is a fundamental part of national commerce. Another aspect of financial inclusion that many places in Africa and the rest of the developing world lack is access to international payment systems. Global commerce is largely denominated in the US Dollar and it requires specialized systems for payments and receipts. This is often a challenge for many merchants in developing countries as they have no access to foreign exchange as well as the means to pay and receive money in foreign currency. BitPesa is leading the charge in providing solutions to these problems, especially in Sub-Saharan Africa. In Indonesia, there is a service called TenX that provides a digital wallet which allows users to receive Visa card payments. 3. Fight Against Corruption Corruption is one of the major banes of low-income countries around the world. Lack of economic democratization and corrupt government officials have evinced a design that has left the collective commonwealth of these countries in the hands of a few people. The middle-class has all but disappeared and more than 70 percent of the population live below the poverty line. In developing nations, misappropriation of state funds by corrupt government officials is a big problem. Nonadherence to project contracting best practices results in capital projects being handled by cabals who divert state funds for their own personal interests. The use of cryptocurrencies, especially those built upon smart contract protocol will allow for a more transparent contract system. With records on the blockchain being public, citizens will be able to monitor the way in which state funds are being utilized. Another area of interest in the fight against corruption by cryptocurrencies in developing countries is in the election process. One trademark of the political landscape of the less developed nations is the fact that electoral bodies are largely partisan and hardly ever neutral. As such, elections are fraught with discrepancies that undermine the fidelity of the process. Cryptocurrency and blockchain technology can be used to make elections in these countries to become free and fair to the citizens being able to freely exercise their franchise. These are just some of the ways in which cryptocurrencies could be of benefit to developing nations around the world. Cryptocurrency and blockchain technology continues to be at the heart of public consciousness all over the globe. It will surely be interesting to see to what extent developing countries apply cryptocurrency solutions to their problems. Keen to find out more about FundYourselfNow? Join our crowdfunding revolution conversation on our Telegram group, or follow us on Twitter.

How Cryptocurrency Can Help Developing Countries

BAYES ESPORTS SOLUTIONS

bayesesports.com

-- employees

Since n.d.

COMPANY RANKING

BAYES ESPORTS SOLUTIONS

EVERGREEN INDEX #1974

Representing this company? Click here to claim and customize this page!

Bayes Esports Solutions WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

BAYES ESPORTS SOLUTIONS

bayesesports.com

-- employees

Since n.d.

COMPANY RANKING

BAYES ESPORTS SOLUTIONS

EVERGREEN INDEX #1974

RELATED COMPANIESRANK

STORIES ABOUT BAYES ESPORTS SOLUTIONS

Representing this company? Click here to claim and customize this page!

Bayes Esports Solutions WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!