Being Zero

beingzero

What are ZK Proofs and How are They the Future of Verifiability

The FOSDEM conference on February 3rd, 2024, featured a presentation on Manticore Vector Search by Peter Zaitsev, co-founder of Manticore, and Sergey Nikolaev, CEO of Manticore. This event showcased the latest about vector search in databases. For a closer look, a recording of Zaitsev’s talk is available above. Below, you can see a more detailed summary of the topic in the form of an article. https://youtu.be/sHwUgxztcqs?si=uqOUnQoaopRodgbL&embedable=true Introduction In the past two to three years, the database landscape has seen several key changes: A new category of ‘vector databases’ has emerged, featuring open-source platforms such as Milvus in 2019, Vespa in 2020, Weaviate in 2021, and Qdrant in 2022, as well as cloud solutions like Pinecone, introduced in 2019. These databases are dedicated to vector search, focusing on the use of various machine learning models. However, they may lack traditional database capabilities such as transactions, analytics, data replication, and so on. Elasticsearch added vector search capabilities in 2019. Then, from 2022 to 2023, established databases, including Redis, OpenSearch, Cassandra, ClickHouse, Oracle, MongoDB, and Manticore Search, in addition to cloud services from Azure, Amazon AWS, and Cloudflare, started offering vector search functionality. Other well-known databases, like MariaDB, are in the process of integrating vector search capabilities*. For PostgreSQL users, there is the ‘pgvector’ extension, which has implemented this functionality since 2021. While MySQL has not announced plans for native vector search functionality, proprietary extensions from providers such as PlanetScale and AlibabaCloud are available. Vector space and vector similarity Let’s discuss why so many databases recently enabled vector search functionality and what it is at all. Let’s begin with a tangible example. Consider two colors: red, with an RGB code of (255, 0, 0), and orange, with an RGB code of (255, 200, 152). To compare them, let’s plot them on a three-dimensional graph, where each point represents a different color, and the axes correspond to the red, green, and blue components of the colors. We then draw vectors from the origin of the graph to the points representing our colors. Now, we have two vectors: one representing red and the other - orange. If we want to find the similarity between these two colors, one approach could be to simply measure the angle between the vectors. This angle can vary from 0 to 90 degrees, or if we normalize it by taking the cosine, it will vary from 0 to 1. However, this method does not consider the magnitude of the vectors, which means that the cosine will yield the same value for colors A, A1, and A2 even though they represent different shades. To address this issue, we can use the cosine similarity formula, which accounts for vector lengths - the vector’s dot product divided by the product of their magnitudes. This concept is the essence of vector search. It’s straightforward to visualize with colors, but now imagine that, instead of three color axes, we have a space with hundreds or thousands of dimensions, where each axis represents a specific feature of an object. While we can’t easily depict this on a slide or fully visualize it, mathematically, it is feasible, and the principle remains the same: you have vectors in a multi-dimensional space, and you compute the similarity between them. There are a few other formulas to find vector similarity: for example, the dot product similarity and the Euclidean distance, but as the OpenAI API docs say, the difference between them typically doesn’t matter much. Vector features: sparse vectors So, an object may have various features. The color with Red, Green, and Blue components is the simplest example. In real life, it’s typically more complex. In text search, for instance, we may represent documents as high-dimensional vectors. This leads us to the concept of “Bag of Words.” This model transforms text into vectors where each dimension corresponds to a unique word, and the value may be a binary indicator of the word’s presence, a count of occurrences, or a word weight based on its frequency and inversed document frequency (called TF-IDF), which reflects how important a word is to a document in a collection. This is so called sparse vector since most values are zero as most documents don’t have many words. When talking about full-text search in libraries and search engines like , , and , sparse vectors help make searches faster. Basically, you can make a special kind of index that ignores documents without the search term. So you don’t have to check every single document against your search each time. The sparse vectors are also easily understandable. They can be, in a sense, reverse-engineered. Each dimension corresponds to a specific, clear feature, so we can trace back from our vector representation to the original text. This concept has already existed for about 50 years. Lucene Elasticsearch Manticore Search Vector features: dense vectors Traditional text search methods like , which have been around for decades, produce sparse word vectors that depend on term frequency. The main issue? They typically overlook the context in which words are used. For instance, the term “apple” could be associated with both fruit and the technology company without distinction, potentially ranking them similarly in a search. TF-IDF But consider this analogy: In a vector space, which two objects would have closer proximity: a cat and a dog or a cat and a car? Traditional methods that generate sparse vectors — like the one shown at the top of the image below - may struggle to provide a meaningful answer. Sparse vectors are often high-dimensional, with most values being zero, representing the absence of most words in a given document or context. Then came the revolution of deep learning, introducing . These are dense vector representations, as illustrated by the lower part of the image. In contrast to sparse vectors, which may have tens of thousands of dimensions, dense vectors are lower-dimensional (such as 784 dimensions in the image) but packed with continuous values that capture nuanced semantic relationships. This means the same word can have different vector representations depending on its context, and different words can have similar vectors if they share contexts. Technologies like and use these dense vectors to capture complex language features, including semantic relationships, distinguishing synonyms from antonyms, and comprehending irony and slang — tasks that were quite challenging for earlier methods. contextual embeddings BERT GPT Moreover, deep learning extends beyond text, enabling the processing of complex data like images, audio, and video. These can also be transformed into dense vector representations for tasks such as classification, recognition, and generation. The rise of deep learning coincided with the explosion in data availability and computational power, allowing the training of sophisticated models that uncover deeper and subtler patterns in data. Embeddings The vectors such models provide are called “embeddings.” It’s important to understand that unlike the sparse vectors shown previously, where each element can represent a clear feature like a word present in the document, each element of an embedding also represents a specific feature, but in most cases, we don’t even know what the feature is. For example, and used the GloVe model to vectorize Wikipedia and then visualized the values for some words with different colors. We can see here that: Jay Alammar made an interesting experiment A consistent red line appears across various words, indicating similarity in one dimension, though the specific attribute it represents remains unidentified. Terms like “woman” and “girl” or “man” and “boy” display similarities across multiple dimensions, suggesting relatedness. Interestingly, “boy” and “girl” share similarities distinct from “woman” and “man,” hinting at an underlying theme of youth. Except for one instance involving the term “water,” all analyzed words pertain to people, with “water” serving to differentiate between conceptual categories. Distinct similarities between “king” and “queen,” apart from other terms, may suggest an abstract representation of royalty. So, dense vector embeddings, generated through deep learning, capture a vast amount of information in a compact form. Unlike sparse vectors, every dimension of a dense embedding is generally non-zero and carries some semantic significance. This richness comes with a cost - with dense embeddings, since each dimension is densely populated with values, we can’t simply skip documents that don’t contain a specific term. Instead, we face the computational intensity of comparing the query vector with every document vector in the dataset. It’s a brute-force approach that is naturally resource-intensive. However, specialized indexes tailored for dense vectors have been developed. These indexes, such as KD-trees, Ball trees, or more modern approaches like (Hierarchical Navigable Small World) graphs, are pretty smart, but they sometimes have to guess a bit to be fast. This guessing can mean they don’t always get the answer 100% right. The most popular index that databases adopt is HNSW, which stands for Hierarchical Navigable Small World. It’s used by the extension for Postgres, , , , , , , and . Its algorithm builds a multi-layered graph structure. Each layer is a graph where each node (representing a data point) is connected to its closest neighbors. HNSW pgvector Lucene Opensearch Redis SOLR Cassandra Manticore Search Elasticsearch The bottom layer contains all nodes (data points), and each successive upper layer contains a subset of the nodes from the layer below. The topmost layer has the fewest nodes. Searching starts from the upper layers and gradually moves down to the lower layers. This hierarchical approach makes the search process efficient. In a nutshell, HNSW, like any other index, just pregenerates some shortcuts that you then can use for faster query processing. There are other vector indexes, such as maintained by Spotify and others, each with its own set of pros and cons in terms of performance, resource consumption, and accuracy loss. Annoy Image: https://cdn.sanity.io/images/vr8gru94/production/d6e3a660654d9cb55f7ac137a736539e227296b6-1920x1080.png K-nearest neighbours Vector search is actually an umbrella term that includes various tasks such as clustering and classification and others. But commonly, the first feature a database adds for vector search is the ‘K-nearest neighbor search’ (KNN), or its close relative, the ‘Approximate nearest neighbor search’ (ANN). It is appealing because it enables databases to find documents that are most similar to a given document’s vector, which enhances databases with the powerful capabilities of a search engine, which they previously lacked. Traditional search engines like Lucene, Elasticsearch, SOLR, and Manticore Search handle various natural language processing tasks — such as morphology, synonyms, stopwords, and exceptions — all aimed at finding documents that match a given query. KNN accomplishes a similar goal but through different means - just comparing the vectors associated with documents in the table that are usually provided by an external machine-learning model. Let’s explore what a typical vector search looks like in databases, taking as our example. Manticore Search First, we create a table with a column titled : image_vector create table test ( title text, image_vector float_vector knn_type='hnsw' knn_dims='4' hnsw_similarity='l2' ); This vector is of a , which is important because databases that don’t support this data type must first add it, since dense vectors are usually stored in float arrays. At this time, you also usually configure the field by specifying the vector dimension size, vector index type, and its properties. For instance, we specify that we want to use the HNSW index, the vector will have a dimensionality of 5, and the similarity function will be , which is the Euclidean distance. float type l2 Then, we insert a few records into the table: insert into test values ( 1, 'yellow bag', (0.653448,0.192478,0.017971,0.339821) ), ( 2, 'white bag', (-0.148894,0.748278,0.091892,-0.095406) ); Each record has a title and a corresponding vector, which, in a real-world scenario, could be the output from a deep learning model that encodes some form of high-dimensional data, such as an image or sound, an embedding from text, or something else from the OpenAI API. This operation stores the data in the database and may trigger rebuilding or adjusting the index. Next, : we perform a vector search by utilizing the KNN function select id, knn_dist() from test where knn ( image_vector, 5, (0.286569,-0.031816,0.066684,0.032926) );

+------+------------+
| id   | knn_dist() |
+------+------------+
|    1 | 0.28146550 |
|    2 | 0.81527930 |
+------+------------+
2 rows in set (0.00 sec) Here, we’re querying the database to locate the vectors that are closest to our specified input vector. The numbers in parentheses define the particular vector we’re seeking the nearest neighbors for. This step is critical for any database that aims to implement vector search capabilities. At this step, the database can either utilize specific indexing methods, such as HNSW or perform a brute-force search by comparing the query vector against each vector in the table to find the closest matches. The results returned show the titles of the nearest vectors to our input vector and their respective distances from the query. Lower distance values indicate closer matches to the search query. Embedding computation Most databases and search engines so far rely on external embeddings. This means that when you insert a document, you must obtain its embedding from an external source beforehand and include it with the document’s other fields. The same applies when searching for similar documents: if the search is for a user query rather than an existing document, you need to use a machine learning model to calculate an embedding for it, which is then passed to the database. This process can lead to compatibility issues, the need to manage additional data processing layers, and potential inefficiencies in search performance. The operational complexity of this approach is also higher than necessary. Along with the database, you may have to keep another service running to generate embeddings. Some search engines like OpenSearch, Elasticsearch, and Typesense are now making things easier by automatically creating embeddings. They can even use tools from other companies, like OpenAI, to do this. I think we’ll see more of this soon. More databases will start to make embeddings on their own, which could really change how we search for and analyze data. This change means that databases will do more than just store data; they’ll actually understand it. By using machine learning and AI, these databases will be smarter and able to predict, adapt, and handle data in more advanced ways. Hybrid search approaches Some search engines have adopted a method known as hybrid search, which combines traditional keyword-based search with advanced neural network techniques. Hybrid search models excel in situations that require both exact keyword matches, as provided by traditional search techniques, and broader context recognition, as offered by vector search capabilities. This balanced approach can enhance the accuracy of search results. For example, measured by comparing it to the classical BM25 ranking and the ColBERT model individually. In their approach, they used the classical BM25 as the first-phase ranking model and calculated the hybrid score only for the top-ranking K documents according to the BM25 model. It was found that the hybrid search mode outperformed each of them in most tests. Vespa the accuracy of their hybrid search Another simpler method is Reciprocal Rank Fusion (RRF), a technique that combines rankings from different search algorithms. RRF calculates a score for each item based on its rank in each list, where higher rankings receive better scores. The score is determined by the formula 1 / (rank + k), where ‘rank’ is the item’s position in the list, and ‘k’ is a constant used to adjust the influence of lower rankings. By summing these modified reciprocal ranks from each source, RRF emphasizes consensus among different systems. This method blends the strengths of various algorithms, leading to more robust and comprehensive search results. Conclusion Vector search is more than just a concept or a niche functionality of search engines; it’s a practical tool transforming how we retrieve data. In recent years, the database field has seen major changes, with the rise of new vector-focused databases and established ones adding vector search features. This reflects a strong need for more advanced search functions, a need that vector search can meet. Advanced indexing methods, like HNSW, have made vector search faster. Looking ahead, we expect databases to do more than just support vector search; they’ll likely create embeddings themselves. This will make databases simpler to use and more powerful, turning them from basic storage spaces into smart systems that can understand and analyze data. In short, vector search is a significant shift in data management and retrieval, marking an exciting development in the field. Also published . here

Vector Search in Databases: FOSDEM's Presentation on Manticore Vector Search

Zero-Day Vulnerabilities | All-Day Stress Encountering a zero-day vulnerability can feel like navigating through a fog of unknowns. This kind of vulnerability, previously undetected and unaddressed, often brings a mix of anxiety and urgency. Questions whirl through your mind: How severe is it? What havoc can it wreak? Who might exploit it? And crucially, is it lurking in our systems? These initial questions are just the tip of the iceberg. As the reality sinks in – you're facing an unfamiliar foe – the real challenge emerges: "How do I deal with something I've never seen before?" The reactions vary – from the near-panic of tearing one's hair out to the extreme thoughts of obliterating everything to prevent a breach, and in some cases, people simply giving up. But here's the silver lining: while a zero-day might be an unknown threat, our response doesn't require unknown measures. We can leverage our existing knowledge and past experiences in security and incident response to tackle these new threats effectively. Understanding Zero-Day Vulnerabilities Imagine the world of cybersecurity as a high-stakes game of hide and seek, and zero-day vulnerabilities are the ultimate hiders – unseen, unknown, and unpredictably dangerous. These digital gremlins are the nightmares of IT professionals, lurking in the shadows of code and systems. They are the loopholes that nobody knew existed, until, of course, someone malicious discovers and exploits them – and that's when the real game begins. But what makes a zero-day so special and feared? It's the element of surprise. These vulnerabilities are like the plot twists in a thriller movie – you never see them coming until they hit you. When a zero-day attack is revealed, it's akin to a magician revealing his trick – there's awe, shock, and a bit of "how did we not see that coming?" To truly grasp the essence of zero-days, let’s step into the history books of cybersecurity. Remember ? This devious little worm, discovered back in 2010, wreaked havoc on Iran's nuclear facilities. Stuxnet It’s the poster child for zero-day exploits – sneaky, sophisticated, and with a punch that left the world reeling. Stuxnet used not one, but several zero-days to infiltrate and sabotage its target. It’s like finding out the quiet kid in class is actually a chess grandmaster – unexpected and a little bit unsettling. In the grand scheme of things, zero-days are a harsh reminder of our digital vulnerability – the unknown threats that lurk in the shadows, waiting for their moment in the spotlight. They're a testament to the fact that in cybersecurity, sometimes the biggest threat is what you don't know you don't know. But fear not, for as daunting as these hidden threats are, they are not invincible. The Power of Existing Knowledge So, a zero-day has just dropped into your lap like an uninvited guest at a party. Now what? It's easy to feel like you're up the creek without a paddle, but hold on – you've got more tools at your disposal than you might think. First off, let’s demystify this beast. Zero-days aren't some alien technology; they are vulnerabilities, plain and simple. Think of them as the hidden doors in a fortress that the architect forgot about. Now, the key lies in using what we already know about fortresses – or in our case, cybersecurity – to find and secure these doors. It’s like realizing you’ve been holding the treasure map upside down all along. Our past experiences with cybersecurity are like gold. Each past threat, each breach, and every little anomaly we've encountered and resolved – they've all been building up our arsenal. We've learned to monitor, to analyze, to patch, and to respond. These aren’t just random skills; they are the very weapons we need to combat zero-days. It's like being a chef in a kitchen – you might not know what surprise ingredient you'll have to cook with next, but you know your way around the kitchen, and that’s what counts. Consider this: the basic principles of securing a network against known vulnerabilities apply just as effectively to unknown ones. Regular system monitoring, rigorous security protocols, and a culture of constant vigilance – these are your shields against the onslaught of zero-day attacks. It’s like the age-old adage in martial arts – the best form of defense is a strong foundation. In the next sections, we'll dive deeper into the specific tools and strategies that make our existing knowledge a formidable force against the enigmatic zero-days. Remember, in the world of cybersecurity, knowledge isn’t just power – it’s your best defense. Strengthening the Process You've identified the zero-day lurking in your system. Now, comes the critical part: beefing up your defense. Think of this as fortifying your digital castle against the siege of unknown threats. It's not about reinventing the wheel; it's about reinforcing the wheels you already have. First and foremost, let's talk about patch management. In the world of cybersecurity, patches are like the armor plating on your castle walls. When a zero-day is discovered, vendors often release patches to fix the vulnerability. It’s crucial to apply these patches promptly. Think of it as a race against time, with hackers on one side and your patching team on the other. Fast, efficient patch management isn’t just good practice; it’s your knight in shining armor in the fight against zero-days. Next up, we have threat intelligence. Knowledge is power, and in cybersecurity, it’s your eyes and ears on the digital battleground. Staying updated with the latest threat intelligence feeds can give you the upper hand. It’s like having scouts reporting back on enemy movements – the more you know about potential threats, the better prepared you are to defend against them. But here's the kicker: the process of strengthening your defenses is never truly complete. Cybersecurity is a dynamic field, constantly evolving. This means your strategies and processes must evolve too. Regular security assessments and audits are crucial. They help you identify potential weaknesses in your defenses – the chinks in your armor, so to speak – before they can be exploited. In essence, strengthening your process against zero-days is about being proactive rather than reactive. It's about building a culture of continuous improvement, where your defenses are always one step ahead of potential threats. In the next section, we'll explore the human factor – how training, awareness, and a robust cybersecurity culture can be your strongest allies in this ongoing war against digital threats. The Human Factor At the heart of every great cybersecurity strategy lies its people. The human element in managing zero-days is akin to the knights in the cybersecurity kingdom. It's about more than just skills and knowledge; it's about cultivating a mindset. Training and awareness are the twin pillars of this approach. Imagine every member of your team as a sentry, vigilant and ready. Regular training ensures that everyone is not just aware of the standard protocols but also the latest threats – including zero-days. It's like each person holds a piece of the puzzle; when put together, you get the full picture of your security posture. Creating a security-minded culture within your organization is akin to building a fortress with a strong foundation. It's not just about the tools and technologies; it's about how people think and act every day. Encouraging open communication about potential threats, fostering an environment where security is everyone’s responsibility, and rewarding proactive security behaviors – these are the building blocks of a resilient cybersecurity culture. Moreover, collaboration extends beyond the walls of your organization. Engaging with the wider cybersecurity community is crucial. Sharing experiences, learning from others’ incidents, and staying informed about emerging threats – this collective wisdom is a treasure trove in the fight against zero-days. Think of it as a council of cybersecurity wizards, each bringing their own magic (aka expertise) to the table. Wrapping This Up In our journey through the mysterious and often intimidating world of zero-day vulnerabilities, we've uncovered a fundamental truth: . Like a well-navigated labyrinth, the path to managing zero-days becomes clearer when we use the light of our existing knowledge, tools, and experiences. these unknown threats are not as invincible as they may seem We've seen how understanding zero-days, leveraging our existing expertise, adapting our tools, and continuously strengthening our processes form the bedrock of an effective defense strategy. But, perhaps most importantly, we've recognized the invaluable role of the human element – the vigilance, the culture, and the community collaboration that turn our collective efforts into an impenetrable shield against these hidden digital threats. As we part ways in this discussion, remember that in the ever-changing landscape of cybersecurity, adaptation and resilience are your truest allies. Zero-day vulnerabilities, daunting as they are, offer us opportunities to learn, grow, and fortify our defenses. So, as you navigate this challenging terrain, carry with you the knowledge that with the right approach, even the unknown can be tamed.

Struck by a Zero-Day: What's Your Next Move?

একটি জিরো-ডে দ্বারা আঘাত: আপনার পরবর্তী পদক্ষেপ কি?

Von einem Zero-Day getroffen: Was ist Ihr nächster Schritt?

Golpeado por un día cero: ¿cuál es su próximo paso?

Frappé par un Zero-Day : quelle est votre prochaine étape ?

एक शून्य दिवस से प्रभावित: आपका अगला कदम क्या है?

ゼロデイに襲われた: 次の行動は何ですか?

제로데이의 충격: 다음 단계는 무엇입니까?

Atingido por um dia zero: qual é o seu próximo passo?

Пораженный нулевым днем: каков ваш следующий шаг?

Sıfır Gün'ün Etkisi: Bir Sonraki Hamleniz Nedir?

Bị mắc kẹt bởi một ngày không: Bước đi tiếp theo của bạn là gì?

遭受零日攻击：您的下一步行动是什么？

Zero-knowledge proofs (ZKPs) and Quantum Computing are two phenomenal discoveries in the advancement of technology and great solutions for absolute data privacy and security, higher processing power, and faster transactions. While are heavily embraced in the blockchain realm for scaling, there are several stereotypes of Quantum Computing being the "blockchain destroyer,” considering the adverse effect it could potentially have on the cryptographic technology. However, on a broader spectrum, Quantum Computers possess unparalleled processing power to perform massive calculations at unimaginable speeds, and this ability can be harnessed to improve and boost blockchain technology. ZKPs Sandwishing ZKP and Quantum Computing can create a force whose magnitude will be felt way beyond the realm of blockchain technology to accommodate state-of-the-art privacy, security, and scalability solutions to an array of industries. Now think for a moment about the magnitude of the synergy these two giants can create in our world! Think how this can revolutionize our tech space, driving innovations and achieving light-year progress in a decade! Zero-Knowledge Proofs The term "Zero-Knowledge Proofs (ZKPs)" refers to an interactive scheme where protocols or people in a communication process can prove the ownership or validity of information without revealing the information. In this process, we have the sender of the message (the "prover") and the receiver of the message (the "verifier"). The prover must prove that the information is true and exists enough to convince the verifier beyond reasonable doubt that the information does exist and can be verified. Here is an illustration: You and I are in communication, and I tell you I have 100 million dollars stored up somewhere. That is hard to believe, but I will not reveal where the money is stashed. However, I can prove to you that it is enough to get you confident in the veracity of this claim and verify that the information is true without revealing any other information aside from the claim being true. No, not VOODOO, but ALGORITHMS. Every ZKP transaction must have these three key ingredients to make it wholesome: The prover must be able to honestly prove and convince the verifier through the ZKP protocol with a high probability that the claim is true. Completeness: The ZKP protocol should be able to detect false and true claims with a high probability for a verifier. So, a verifier can only be persuaded that the claim is true if it is true. Soundness: If the claim is true, the verifier can only verify that it is true but will not, under any circumstance, be given any extra information apart from the fact that the claim does exist. Zero Knowledge: There are two classes of ZKPs: The Interactive ZKPs and the Non-interactive ZKPs. In the verifier maintains an interactive dialogue with the prover, presenting questions and challenges the prover must be able to solve to validate their claims. This is, however, an outdated type of zk-proof as it relates to tech. Interactive ZKPs, For , cryptographic algorithms are used instead with in-built parameters that have been agreed upon to verify the validity of a claim. The claim is fed into the algorithms, and the algorithms verify the claim. Non-interactive ZKPs Non-interactive ZKPs also have various types, but the most popularly adopted ones are: The Zero-Knowledge Succinct Non-interactive Argument of Knowledge (zk-SNARK) used in , , and . ZCash zkSync Polygon zkEVM The Zero-Knowledge Scalable Transparent Argument of Knowledge (zk-STARK) is used in . StarkNet ZKPs incorporate encryption techniques such as Elliptic Curve Cryptography or RSA to ensure that information is kept encrypted and secure during data transmission. This technology is the most feasible and practical solution amidst the data privacy and security concerns in distributed ledger and blockchain technology. Quantum Computing Quantum computing is a new form of advanced scientific computing language that employs the laws of quantum principles and mechanics to break down and solve problems that are too complex or large for traditional computers. While traditional computers carry out calculations in bits (which are the smallest units of a computer – 0 and 1), quantum computers ditch these classical units and take on superpowers. Quantum computers process data in qubits (i.e., quantum bits), which can be 0 and 1 simultaneously. They carry data in multidimensional quantum states that can exist at the same time. While a classical computer would measure the state of an object before calculating it, quantum computers would carry out calculations based on the probability of the state of the object before carrying out calculations. Hence, quantum computers are exponentially faster with an unimaginable speed that process data multiple times faster than traditional computers. A case study is the . This computer processed and completed a data computation in about 200 seconds. By earlier estimations, the same computation would have taken the world’s most powerful supercomputer 10,000 years to complete. Now, that's a boomer! 53-qubit Sycamore processor developed by Google This technology is capable of disrupting the classical systems of solving, breaking down, and transmitting data above its limit. It is way faster than our average computers with exponential power that can be used to improve everything in the scientific field. Theoretically, quantum computers are considered a huge threat to today's technological systems. Classic cryptography could be easily eroded by the supercomputing power of quantum computing. Highly sophisticated quantum computers could crack high-end encryptions which would increase the vulnerability of current systems and impact security, privacy, or trust negatively. published in 1994, has the potential to decrypt and break down the security enforced by most asymmetric cryptography algorithms. , Shor's quantum algorithm However, putting aside the risks, quantum computing can be used to enhance cybersecurity and data privacy. Because this computing is at the edge of revolutionizing the way data is processed, it can be used to improve technology. Instead of quantum attacks on encryption, it can be used to build new types of encryptions – post-quantum resistance algorithms that are resistant to quantum computer attacks. It can also develop quantum cryptography and improve machine learning algorithms to enable quick detection and prevention of cyber attacks. Synergising Zero-Knowledge Proofs & Quantum Computing For Advanced Data Privacy & Security in Blockchain. Zero-knowledge proofs and quantum computing may feel like two distinct technological concepts but when placed side by side, you realize that these two can be knitted together for an improved experience and accelerated innovation in various areas such as: The purpose of ZKPs is to conceal and protect the vulnerability of data while proving that the data exists. Incorporated into a blockchain, identities, wallet addresses, wallet holdings, and information about transactions can remain very confidential and hidden from the public but verifiable. That way, sensitive data are kept safe and private, and trust is maintained. Quantum computing can additionally contribute to the enhancement of blockchain security. In this case, quantum-resistant cryptographic algorithms and protocols are created to protect the system from quantum attacks, which could break the existing cryptographic encryption schemes and compromise the data. Data Privacy, Security, and Trust: Furthermore, with more development, there is a possibility of quantum-enhanced ZKPs being created. This means that the encryption techniques used to prove and verify a claim can be quantum channels, and this can improve the efficiency and security of the proof. ZKPs is also creating scalable solutions for blockchain users. Using zk-rollups, users from a major blockchain can carry out transactions meant for that chain on another chain with proof of validity/zero knowledge. Scalability: A major example is the Polygon zkEVM, which is a . Considering how congested and slow Ethereum is, which is another reason for very high gas fees, Polygon created this roll-up to enable users to conduct transactions meant for Ethereum on Polygons with proof. zk-rollup for Ethereum The zk-rollup gives users access to faster transaction time and lesser fees while also reducing the load and congestion on Ethereum. Quantum computing possesses unimaginable processing power and, if integrated into the blockchain, can enhance the processing speed of these chains. Transaction speed can be multiple times faster than the fastest blockchain, hence improving scalability. Another theory is using quantum interactive proof systems. These are presumably zero-knowledge proofs that allow the prover and the verifier to exchange quantum messages with proof systems that can be based on quantum computational assumptions. With zero knowledge quantum messaging and proofs, transactions become way faster. Beyond Blockchain ZKPs and Quantum Computing are not limited to only blockchain. These two powerful technologies are applicable in every industry that exists, and together, they can be a formidable force. Some instances include: B Quantum computing can speed up the execution of complex financial algorithms, and with zero-knowledge proofs, it can enable fast and secure verification of transactions without revealing sensitive details. It can prevent counterfeiting and double-spending and enable fast and anonymous transactions. anking and Finance: The accuracy and privacy of medical diagnosis, treatment, and research can be improved through quantum computing and ZKPs. Quantum computing can enhance the performance of machine learning and artificial intelligence techniques and with zero-knowledge proofs, can enable doctors to verify the authenticity and validity of medical records, prescriptions, and test results without exposing the personal information of the patients. Medicine: With other technologies, developers can create more immersive and realistic gaming experiences, as well as prevent cheating and fraud. Quantum computing, which carries out complex calculations, can be used to generate more complex, advanced, and dynamic graphics and AI systems. Combining zero-knowledge proofs, players can prove their identity, achievements, and skills without revealing their strategies, preferences, or personal data. Gaming: End Note Zero-knowledge proofs and quantum computing are key technologies in enabling data privacy and security, trust, and scalability. ZKPs are already an active part of scientific developments in many sectors. Blockchain is a major sector where its strides are mostly seen and felt, and it has become a very reliable solution for scaling blockchain networks. Quantum computing, on the other hand, still rides on possibilities of implementation. It has been labeled a huge risk to cryptography but also a preferred solution to quantum attacks with quantum encryptions. However, these are theories and hardly practical because only a handful of big corporations in the world own quantum computers, making their rate of research and adoption lower than usual.  This does not curb the fact that quantum computers hold immense potential to reinforce transparency, scalability, security, and privacy in blockchain technology. As quantum computing continues to develop and the research in quantum-resistant cryptography and post-quantum algorithms progresses, it is essential to understand that it can be quickly adapted into blockchain technology. Furthermore, to enhance and reinforce data privacy and security, both in blockchain and beyond, there is a possibility of quantum computing being integrated with ZKPs. By combining the inherently privacy-preserving nature of ZKPs with the unparalleled data processing and computation power of quantum computing, blockchain and other technological sectors can keep the data of their users and internal datasets private, have enhanced quantum-encrypted resistant environments for these data, and still have immeasurable transaction speed. Think of all the sectors in the world; and ZKPs can notably impact them positively. quantum computing

ZKPs and Quantum Computing: Formidable Allies for Lightyear Innovations

Zero-knowledge Proof Meets Machine Learning in Verifiability: Background

Suppose Peggy needs to prove to Victor that she is in possession of a secret without revealing the secret. Can she do so in a way that convinces Victor that she really does know the secret? This is the question at the heart of one of the most powerful cryptographic processes we can employ in identity systems: . (ZKPs) zero-knowledge proofs Suppose for example that Peggy has a digital driver's license and wants to prove to Victor, the bartender, that she's over 21 without just handing over her driver's license or even showing him her birthdate. ZKPs allow Peggy to prove her driver's license says she's at least 21 in a way that convinces Victor without Peggy having to reveal anything else (i.e., there's zero knowledge). excess This problem was first explored by MIT researchers Shafi Goldwasser, Silvio Micali, and Charles Rackoff in the 1980s as a way of combatting information leakage. The goal is to reduce the amount of information the verifier, Victor, can learn about the prover, Peggy. extra One way to understand how ZKPs work is the story of the Cave of Alibaba, first published by cryptographers Quisquater, Guillou, and Berson1. The following diagram provides an illustration. The Cave of Alibaba has two passages, labeled A and B, that split off a single passageway connected to the entrance. Peggy possesses a secret code that allows her to unlock a door connecting A and B. Victor wants to buy the code but won't pay until he's sure Peggy knows it. Peggy won't share it with Victor until he pays. The algorithm for Peggy to prove she knows the code proceeds as follows: Victor stands outside the cave while Peggy enters and selects one of the passages. Victor is not allowed to see which path Peggy takes. Victor enters the cave and calls out "A" or "B" at random. Peggy emerges from the correct passageway because she can easily unlock the door regardless of which choice she made when entering. Of course, Peggy could have just gotten lucky and guessed right, so Peggy and Victor repeat the experiment many times. If Peggy can always come back by whichever passageway Victor selects, then there is an increasing probability that Peggy really knows the code. After 20 tries, there's less than one chance in a million that Peggy is simply guessing which letter Victor will call. This constitutes a that Peggy knows the secret. probabilistic proof This algorithm not only allows Peggy to convince Victor she knows the code, but it does it in a way that ensures Victor can't convince anyone else Peggy knows the code. Suppose Victor records the entire transaction. The only thing an observer sees is Victor calling out letters and Peggy emerging from the right tunnel. The observer can't be sure Victor and Peggy didn't agree on a sequence of letters in advance to fool observers. Note that this property relies on the algorithm using a good pseudo-random number generator with a high-entropy seed so that Peggy and third-party observers can't predict Victor's choices. Thus, while Peggy cannot deny to Victor that she knows the secret, she can deny that she knows the secret to other third parties. This ensures that anything she proves to Victor stays between them and Victor cannot leak it—at least in a cryptographic way that proves it came from Peggy. Peggy retains control of both her secret and the fact that she knows it. When we say "zero knowledge" and talk about Victor learning nothing beyond the proposition in question, that's not perfectly true. In the cave of Alibaba, Peggy proves in zero-knowledge that she knows the secret. But there are many other things that Victor learns about Peggy that ZKPs can do nothing about. For example, Victor knows that Peggy can hear him, speaks his language, walks, and is cooperative. He also might learn things about the cave, like approximately how long it takes to unlock the door. Peggy learns similar things about Victor. So, the reality is that the proof is zero knowledge not zero knowledge. approximately perfectly ZKP Systems The example of Alibaba's Cave is a very specific use of ZKPs, what's called a . Peggy is proving she knows (or possesses something). More generally, Peggy might want to prove many facts to Victor. These could include propositional phrases or even values. ZKPs can do that as well. zero-knowledge proof of knowledge To understand how we can prove propositions in zero knowledge, consider a different example, sometimes called the . Suppose Peggy and Victor want to know if they're being paid a fair wage. Specifically, they want to know whether they are paid the same amount but don't want to disclose their specific hourly rate to each other or even a trusted third party. In this instance, Peggy isn't proving she knows a secret, rather, she's proving an equality (or inequality) proposition. Socialist Millionaire Problem For simplicity, assume that Peggy and Victor are being paid one of $10, $20, $30, or $40 per hour. The algorithm works like this: Peggy buys four lock boxes and labels them $10, $20, $30, and $40. She throws away the keys to every box except the one labeled with her wage. Peggy gives all the locked boxes to Victor who privately puts a slip of paper with a "+" into the slot at the top of the box labeled with his salary. He puts a slip with a "-" in all the other boxes. Victor gives the boxes back to Peggy who uses her key in private to open the box with her salary on it. If she finds a "+" then they make the same amount. Otherwise, they make a different amount. She can use this to prove the fact to Victor. This is called an and proves the proposition true or false in zero knowledge (i.e., without revealing any other information). oblivious transfer VictorSalary = PeggySalary For this to work, Peggy and Victor must trust that the other will be forthcoming and state their real salary. Victor needs to trust that Peggy will throw away the three other keys. Peggy must trust that Victor will put only one slip with a "+" on it in the boxes. Just like digital certificates need a PKI to establish confidence beyond what would be possible with self-issued certificates alone, ZKPs are more powerful in a system that allows Peggy and Victor to prove facts from things others say about them, not just what they say about themselves. For example, rather than Peggy and Victor self-asserting their salary, suppose they could rely on a signed document from the HR department in making their assertion so that both know that the other is stating their true salary. provide a system for using ZKPs to prove many different facts alone or in concert, in ways that give confidence in the method and trust in the data. Verifiable Credentials Non-Interactive ZKPs In the previous examples, Peggy was able to prove things to Victor through a series of interactions. For ZKPs to be practical, interactions between the prover and the verifier should be minimal. Fortunately, a technique called SNARK allows for non-interactive zero-knowledge proofs. have the following properties (from whence they derive their name): SNARKs the sizes of the messages are small compared to the length of the actual proof. Succinct: : other than some setup, the prover sends only one message to the verifier. Non-interactive this is really an argument that something is correct, not a proof as we understand it mathematically. Specifically, the prover theoretically could prove false statements given enough computational power. So, SNARKs are "computationally sound" rather than "perfectly sound". ARguments: the prover knows the fact in question. of Knowledge: You'll typically see "zk" (for zero-knowledge) tacked on the front to indicate that during this process, the verifier learns nothing other than the facts being proved. The mathematics underlying zkSNARKs involves homomorphic computation over high-degree polynomials. But we can understand how zkSNARKs work without knowing the underlying mathematics that ensures that they're sound. If you'd like more details of the mathematics, I recommend . Christian Reitwiessner's "zkSNARKs in a Nutshell" As a simple example, suppose Victor is given a hash, , of some value. Peggy wants to prove that she knows a value such that without revealing to Victor. We can define a function that captures the relationship: sha256 H s sha265(s) == H s C C(x, w) = ( sha256(w) == x ) So, , while other values for will return . C(H, s) == true w false Computing a zkSNARK requires three functions , , and . is the key generator that takes a secret parameter called and the function and generates two public keys, the proving key and the verification key . They need only be generated once for a given function . The parameter must be destroyed after this step since it is not needed again and anyone who has it can generate proofs. G P V G lambda C pk vk C lambda fake The prover function takes as input the proving key , a public input , and a private (secret) witness . The result of executing is a proof, , that the prover knows a value for that satisfies . P pk x w P(pk,x,w) prf w C The verifier function computes which is true if the proof is correct and false otherwise. V V(vk, x, prf) prf Returning to Peggy and Victor, Victor chooses a function representing what he wants Peggy to prove, creates a random number , and runs to generate the proving and verification keys: C lambda G (pk, vk) = G(C, lambda) Peggy must not learn the value of . Victor shares , , and with Peggy. lambda C pk vk Peggy wants to prove she knows the value that satisfies for . She runs the proving function using these values as inputs: s C x = H P prf = P(pk, H, s) Peggy presents the proof to Victor who runs the verification function: prf V(vk, H, prf) If the result is true, then the Victor can be assured that Peggy knows the value . s The function does not need to be limited to a hash as we did in this example. Within limits of the underlying mathematics, can be quite complicated and involve any number of values that Victor would like Peggy to prove, all at one time. C C This article is an excerpt from my book , published by O’Reilly Media. Learning Digital Identity Notes Quisquater, Jean-Jacques; Guillou, Louis C.; Berson, Thomas A. (1990). How to Explain Zero-Knowledge Protocols to Your Children (PDF). Advances in Cryptology – CRYPTO '89: Proceedings. Lecture Notes in Computer Science. 435. pp. 628–631. doi:10.1007/0-387-34805-0_60. ISBN 978-0-387-97317-3. Also published here.

Zero-Knowledge Proofs: It's Like Magic, but I'll Explain It

জিরো-নলেজ প্রুফ: এটা ম্যাজিকের মত, কিন্তু আমি এটা ব্যাখ্যা করব

Zero-Knowledge-Beweise: Es ist wie Magie, aber ich werde es erklären

Pruebas de conocimiento cero: es como magia, pero lo explicaré

Preuves sans connaissance : c'est comme par magie, mais je vais l'expliquer

शून्य-ज्ञान प्रमाण: यह जादू की तरह है, लेकिन मैं इसे समझाऊंगा

知識ゼロの証明: 魔法のようなものですが、説明します

영지식 증명: 마술과 같지만 설명하겠습니다.

Provas de conhecimento zero: é como mágica, mas vou explicar

Доказательства с нулевым разглашением: это похоже на волшебство, но я объясню это

Sıfır Bilgi Kanıtları: Sihir Gibi, Ama Açıklayacağım

Bằng chứng không có kiến thức: Nó giống như phép thuật, nhưng tôi sẽ giải thích nó

零知识证明：就像魔法，但我会解释它

Digital Public Infrastructure (DPI) is like the digital ID to rule them all — over people, places & purchases to power a social credit system: perspective Digital Public Infrastructure (DPI) is a mechanism for surveillance and control that combines digital ID, CBDC, vaccine passports, and carbon footprint , paving the way for 15-minute , future lockdowns, and systems of social credit. tracking data smart cities “Three major types of protocols that facilitate digital public infrastructure: digital identity, digital payments and data exchange. Collectively, we refer to these as the civic technology stack” United Nations, Building & Securing Digital Public Infrastructure Playbook, June 2022 On the surface, DPI might seem like something that could benefit people greatly, and it certainly has the potential to do so. However, that would require the people to have trust in governments, corporations, and unelected globalists working in lockstep to keep their best interests at heart. Sold as a mechanism for financial inclusion, convenience, improved healthcare, and green progress, DPI is an all-inclusive phrase applied to looming technocratic governance over people and the “ ” in which they’ll live. 15-minute smart cities The latest G20 India describes DPI as an evolving concept run by public and private entities — the fusion of corporation and state: Leaders’ Declaration “Digital public infrastructure (DPI), as an evolving concept and as a set of shared digital systems, built and leveraged by both the public and private sectors, based on secure and resilient infrastructure, and can be built on open standards and specifications, as well as opensource software can enable delivery of services at societal-scale” G20 India Leaders’ Declaration, September 2023 These “shared digital systems” include the desire to adopt Central Bank Digital Currencies (CBDCs) on a global scale, as well as establishing a “ ,” that will include vaccine passports, which were already championed by last year’s G20 Bali Leaders’ Declaration. WHO-managed framework to build a comprehensive digital health ecosystem In fact, EU Commission President Ursula von der Leyen told the G20 that vaccine passports, aka “digital health certificates,” were of DPI in action. one example “ The trick is to build public digital infrastructure, that is interoperable, open to all and trusted. Let me give you one example that is reality today. “* Many of you are familiar with the COVID-19 digital certificate. The EU developed it for itself.\The model was so functional and so trusted that 51 countries on 4 continents adopted it for free Ursula von der Leyen, G20 India Summit, September 2023 https://twitter.com/vonderleyen/status/1700760352437178427?embedable=true “We endorse the voluntary and nonbinding G20 Policy Recommendations for Advancing Financial Inclusion and Productivity Gains through Digital Public Infrastructure. We take note of the significant role of digital public infrastructure in helping to advance financial inclusion in support of inclusive growth and sustainable development” G20 India Leaders’ Declaration, September 2023 https://twitter.com/Spiro_Ghost/status/1700190385535107402?embedable=true On the “financial inclusion” front, the G20 India Leaders’ Declaration wholeheartedly welcomes the adoption of programmable s led by the Bank for International Settlements (BIS) and the International Monetary Fund (IMF), stating: CBDC “We welcome discussions on the potential macro-financial implications arising from the introduction and adoption of Central Bank Digital Currencies (CBDCs), notably on cross-border payments as well as on the international monetary and financial system. We welcome the BIS Innovation Hub (BISIH) Report on Lessons Learnt on CBDCs and look forward to the IMF Report on Potential macro-financial implications of widespread adoption of CBDCs to advance the discussion on this issue” G20 India Leaders’ Declaration, September 2023 This year’s G20 Leaders’ Declaration also rubber-stamped digital ID recommendations that emerged from last month’s , which called for G20 nations to rollout Digital Public Infrastructure as a means to “ .” B20 India Communique promote the digitization of identities at the individual, enterprise, and farm levels that are both interoperable and recognized across borders https://twitter.com/TimHinchliffe/status/1696590065328165040?embedable=true “Roll out digital public infrastructure to boost financial inclusion and healthcare access” B20 India Communique, August 2023 Speaking at the B20 India Summit in August, India’s digital identity architect Nandan Nilekani boasted how India had adopted Digital Public Infrastructure at scale and how other nations could follow suit and use DPI for everything from vaccine passports, tax collection, and toll payments to climate adaptation and the move towards a circular economy. “We reiterate our commitment to achieve global net zero GHG emissions/carbon neutrality by or around mid-century, while taking into account the latest scientific developments and in line with different national circumstances, taking into account different approaches including the Circular Carbon Economy, socioeconomic, technological, and market development, and promoting the most efficient solutions” G20 India Leaders’ Declaration, September 2023 Earlier this year, Nilekani spoke about DPI to the IMF, saying that digital ID, smartphones, and bank accounts were the three “tools of the New World” that everybody should have. https://twitter.com/TimHinchliffe/status/1648733976687673362?embedable=true “If you think, ‘what are the tools of the New World?‘ — Everybody should have a digital ID; everybody should have a bank account; everybody should have a smartphone. Then, anything can be done. Everything else is built on that” Nandan Nilekani, IMF Spring Meetings, April 2023 “ “ This digital identity determines what products, services and information we can access – or, conversely, what is closed off to us World Economic Forum, 2018 “People-centered smart cities need accessible, secure, and fair digital public infrastructure that powers digital services, and ensures everyone has equal opportunity to fully participate in civic life” United Nations, Building & Securing Digital Public Infrastructure Playbook, June 2022 For the unelected globalists, there can be no Digital Public Infrastructure, including CBDC, without digital ID, and there can be no “people-centered smart cities” without DPI. The World Economic Forum (WEF) envisions digital identity being linked to everything from financial services and healthcare records to travel, mobility, and digital governance — all of which are components of DPI. Likewise, the on Digital Public Infrastructure is pushing digital ID as being inseparable from DPI, stating, “ . United Nations playbook Broadly, there are three major types of protocols that facilitate digital public infrastructure: digital identity, digital payments, and data exchange “ .” These three protocols are typically required for most digital service transactions such as permitting, issuing licenses, or providing records that often require validating a user’s identity, enabling exchange of data across agencies and users, and finally authorizing payments online “ ,” the UN says that “ .” By prioritizing these three protocols local governments can set the stage for the successful development of an entire ecosystem of digital services in alignment with their community’s unique needs https://twitter.com/TimHinchliffe/status/1674105699897311253?embedable=true With G20 nations committing to net-zero carbon emissions policies by around 2050, many DPI initiatives are geared towards reaching that goal, meaning restrictions will be placed on what we can consume, what we can purchase, and where we can go thanks to the widespread implementation of digital ID and CBDC to track, trace, and control our every move in our people-centered, 15-minute smart cities. Think individual carbon footprint trackers, Ultra Low Emission Zones ( ), and to restrict “less desirable” purchases — all of which have been pushed by the unelected globalists at the WEF and elsewhere. ULEZ CBDC programmed by governments https://twitter.com/AndrewLawton/status/1529045188764921856?embedable=true Digital Public Infrastructure is like the digital ID to rule them all — over people, places & purchases in order to power the coming system, along with where health and/or climate lockdowns can be mandated whenever governments decide to grant themselves emergency powers for any given “crisis” — real or perceived. social credit 15-minute, people-centered smart cities This article was originally published by on Tim Hinchliffe The Sociable.

Digital Public Infrastructure: Transforming 15-Minute Smart City Governance 

ডিজিটাল পাবলিক ইনফ্রাস্ট্রাকচার: 15 মিনিটের স্মার্ট সিটি গভর্নেন্সের রূপান্তর

Digitale öffentliche Infrastruktur: Transformation der Smart City Governance in 15 Minuten

Infraestructura pública digital: transformando la gobernanza de las ciudades inteligentes en 15 minutos

Infrastructure publique numérique : transformer la gouvernance des villes intelligentes en 15 minutes

डिजिटल सार्वजनिक अवसंरचना: 15 मिनट के स्मार्ट सिटी प्रशासन में परिवर्तन

デジタル公共インフラストラクチャ: 15 分間のスマート シティ ガバナンスの変革

디지털 공공 인프라: 15분 안에 스마트 시티 거버넌스 혁신

Infraestrutura pública digital: transformando a governança de cidades inteligentes em 15 minutos

Цифровая общественная инфраструктура: трансформация управления умным городом за 15 минут

Dijital Kamu Altyapısı: 15 Dakikalık Akıllı Şehir Yönetişimini Dönüştürüyor

Cơ sở hạ tầng công cộng kỹ thuật số: Chuyển đổi quản trị thành phố thông minh trong 15 phút

数字公共基础设施：改变 15 分钟智慧城市治理

You may have seen some suggestions that cyber security started with the first antivirus, and a date given of 1987 as the first year of commercial antivirus. Sorry to say that it’s wrong (at least I find it wrong). If we try again, then we could say 1971 when the first worm (Creeper) was released, along with arguably the first antivirus in the single-purpose Reaper in 1972. While Reaper was designed to remove copies of Creeper, it did move and replicate through the ARPANET, so arguably was another worm itself. While I can see the argument for Creeper and Reaper as a start date, I can’t bring myself to agree. Either we point at arbitrary events to describe when cyber security started, which could take us back to 1966 (the time-sharing mainframe CTSS suffered a password breach as the welcome message got switched with the master password file), 1971 (the launch of the ARPANET), or even 2003 when the US government established the National Cyber Security Division. The Beginning of Cybersecurity Cyber security began between 1970 and 1972 with the publications of the Ware and Anderson reports. I will explain below how I came to this conclusion and the important historical points you need to be aware of for this answer to make sense. To get to the start, we need to decide what cyber security really means. I go with the definition that it’s the discipline of security applied to the cyber domain. The cyber domain is ‘a global domain within the information environment consisting of the interdependent networks of information, technology infrastructures and resident data, including the internet, telecommunications networks, computer systems, and embedded processors and controllers’. ( ) NIST Security on the other hand is protection of assets from threats. Assets can be anything, including people, information, or physical systems. Threats (when we’re dealing with security) can ultimately always be traced back to a person. If Cyber Security Didn’t Start in 1987, Then When? I tend to stick to a few different dates. 1969 was when the first two nodes of the ARPANET came online, even if it wasn’t declared operational until 1971. Just because something exists, though, doesn’t mean that a formal security discipline exists around it. Really we need to look at when people started formally considering approaches to security in the cyber domain. That leaves us with a couple of reports which were the first to formally consider the aspects of security. The Ware Report The first of these is the creatively named ‘ ’ by Willis H. Ware (and others), published in 1970. Published here is a generous word, as originally the report was classified as Confidential until DARPA declassified it in 1975. The Ware report set out a number of different controls which would be recognised as fundamental by any cyber security professional today. Even where some terminology has changed over time, concepts are familiar to anyone who has studied or practised cyber security. Security Controls for Computer Systems: Report of Defense Science Board Task Force on Computer Security The Ware report set out a number of what it calls vulnerabilities, although nowadays we would refer to them as threats since they are external and uncontrolled rather than weaknesses within a system. - what we now might call a negligence threat, the result of failure of some component or control whether hardware, software, or configuration by an operator Accidental Disclosure - a malicious threat, although the report then makes a distinction between a passive approach (such as wire tapping, covered under Passive Subversion) and an active approach referred to as Active Infiltration which includes compromise or elevation of privilege by a legitimate user Deliberate Penetration - mentioned by the report, but specifically called out as outside the scope Physical Attack What’s fascinating about the Ware report, and the next ones we’ll be talking about, is how modern many of the approaches taken in them are. As an example, (or modelling) is often considered to have started in 2004 when Frank Swiderski and Window Snyder wrote the ** **on it. There are some earlier references, but most consider it to have begun at the earliest in the 90s. Given that (good) threat modelling is now seen as essential to designing secure systems (though far too often overlooked, leaving us in the insecure world we inhabit), we’d expect to see it popping up fairly early on in the timeline. threat modeling first book Image taken from the Ware Report, showing something anyone aware of threat modelling should find very familiar. The diagram above should be recognisable to anyone as at least a basic threat model, showing different attacks and vulnerabilities of a system. Further in the report we have recommendations for controls, what we might now recognise as architectural principles for secure system development, consideration given to risk management and costs, and far more. Some terminology has changed over the years, and the report itself considers multi-use systems (i.e. what we’d now consider mainframes and terminals) rather than the true peer to peer networking that would come along shortly, but even a brief reading shows the foundational thinking that underlies even the most modern cyber security approaches. The Anderson Report So we’ve got an argument for 1970 as the date cyber security started. The only problem is that while there’s mention of networks, in 1970 the ARPANET wasn’t really in an operational state so the definition of network was more about a multi-user mainframe with remote terminals. Lets step a little further into the future-past, with the publication of the equally creatively named ‘Computer Security Technology Planning Study’ and . Volume I Volume II https://www.youtube.com/watch?v=4djue-tOaFY?embedable=true James P. Anderson also worked on the Ware report previously, and his two-volume follow up drew heavily from and expanded upon it. Many of the recommendations he made for designing and implementing secure systems have, frankly, been ignored over the decades to the detriment of the cyber security ecosystem, and some are being rediscovered and renamed. To take an example, if you’ve heard of zero-trust network architecture, you can find the core concepts that lead to the approach in volume 2 of the report. More importantly for those of us trying to define a conception date for cyber security, the Anderson Report talks a lot more about the ‘movement toward the establishment of large dispersed networks of related computer systems’. This gives us a more modern perspective of networks being key to cyber security. So When Did Cyber Security Start? We’ve got our answer. Admittedly, it might cover a range, but there’s a stronger argument for it than there is for saying it began with the first software tool of a particular type. Cyber security is about a methodical, considered approach to security within the cyber domain. Since the cyber domain didn’t exist (in any practical way) before the 1970s, we’re not going to need to look back further, but the pioneers of the field were very much active and thinking about the problems we still struggle with today back in that time. My answer - cyber began in the years between 1970 and 1972 with the publications of the Ware and Anderson reports. And if you read those reports carefully, it’s changed surprisingly little since then.

When Did Cyber Security Start?

¿Cuándo comenzó la ciberseguridad?

Quand la cybersécurité a-t-elle commencé ?

साइबर सुरक्षा कब शुरू हुई?

サイバーセキュリティはいつ始まりましたか?

Quando surgiu a segurança cibernética?

An ninh mạng bắt đầu khi nào?

网络安全是什么时候开始的？

This is basically the : I wanted and guide I wish I had what why. What With the rise of Google's approach, the concept of "Zero Trust" brought the Identity Aware Proxy to the world. beyond-corp In a nutshell, internal resources or tools sit in private inaccessible areas of the cloud, while a reverse proxy on top of them offers access to permitted users only. The authentication often relies on an OAuth2 provider, but any kind of user directory does the trick. Why Rarely do you enjoy a combination of more than two of these: Security. Quality user experience. Ease of management/maintenance. The magic of “Zero Trust” lies in benefiting from all of the above with the same solution. Security The key feature in an identity-aware proxy is the redundancy of VPN servers. VPN by its nature offers a single point of access to the internal network. Once authenticated, the user has the keys to the kingdom; all internal systems are reachable. In some cases, when is correctly implemented, authentication is still in the way and protects user access. RBAC However, the system is still accessible network-wise, making it susceptible to scans and attacks that might bypass the standard access point. With a reverse proxy, before the request is authorized, all access is blocked as the routing didn't take place. The request was blocked before being rerouted forward. Another aspect of security comes from the fact that the user has one identity source to manage. If has been enabled ( ), it stands for all future user authentication methods. More on that on the ease of access, and, ease of management. MFA / 2FA and it should!!! One clarification before moving on though; this is not to say that VPNs are in the past, or that's something is broken with the concept of having one. Deployed correctly, VPN servers are incredible at what they do. They're ubiquitous for a reason. That said, most implementations lack basic access control, and those that do, more often than not, do not monitor internal queries once a user has been authenticated. In some cases, there are usually not too many alternatives. But for others - e.g. back-office web services, we can do better. Ease of Access This is the more straightforward aspect of things; a user with the organization directory only has to manage one identity. Assuming the user is keeping their passwords safe with something like , and a mandatory , it makes everyone's life easier. 1Password 2 step verification The cookie generated from one successful authentication can be used to access all other systems under the proxy (given the user is permitted to do so). Ease of Management One of the key pain points engineering / IT / Ops teams struggle with is user management when multiple systems and tools are involved in the development. Instead of managing a growing number of directories and user sets, offers a single point of authentication, allowing the management of only one directory. SSO All that's left is to integrate SSO with the identity-aware proxy to leverage both a single access point and the reuse of a cookie. to the rescue! SSO While is simply wonderful in terms of concept and implementation, its docs are somewhat for the lack of a better word. The issue amplifies when trying to deploy on ECS Fargate. (Somewhat surprising given the nature of Buzzfeed's workload on ECS but 🤷). Buzzfeed's SSO incomprehensive The How With that in mind, here's a guide / better-docs for implementing a  "Zero-trust proxy with SSO and cookie reuse on ECS Fargate" ... Probably the world record for the single-line title with most buzzwords ever Buzzfeed's SSO is an implementation of two proxy entities, one service as a proxy to underlying systems and the other as an auth provider. The reason for the local auth provider is being able to serve one login for all systems, instead of having to re-authenticate with every different upstream. This is a cookie-reuse for the same purpose, which is a super elegant solution on behalf of Buzzfeed. Here's a complex, yet comprehensive visual diagram of the system As said, the system comprises of a proxy and an auth provider, namely and (or in short). Both systems are configured by a set of environment variables, where the backend routing is described in an . With growing usage, additional features, switches, parameters, and updates the project kind of grew out of basic understandable configuration docs. This is why we're here today. sso-proxy sso-authenticator sso-auth upstream Yaml config file The Proxy This is the entity that serves as the front gate for incoming requests. If the incoming request is identified as valid, the request goes through and is routed based on . Otherwise, requests are redirected to the authenticator. upstream_configs.yml I've chosen to build the container image with the environment wrapping Buzzfeed's image. This is for convenience only and can be shifted to any other method. Building the image with docker build --build-arg client_id=xxx client_secret=xxx ... FROM buzzfeed/sso

ARG client_id \
    client_secret \
    session_cookie_secret

ENV UPSTREAM_CONFIGFILE="/sso/upstream_configs.yml" \
    UPSTREAM_CLUSTER="" \
    PROVIDER_URL_EXTERNAL="https://sso-auth.domain.co" \
    CLIENT_ID=$client_id \
    CLIENT_SECRET=$client_secret \
    SESSION_COOKIE_SECRET=$session_cookie_secret \
    SESSION_TTL_LIFETIME="1h" \
    UPSTREAM_SCHEME=http

COPY ./upstream_config.yml /sso/upstream_configs.yml

ENTRYPOINT ["/bin/sso-proxy"] The Authenticator Receiving unauthenticated requests from the proxy, the authenticator is in charge of contacting the OAuth2 provider for authorization. According to configuration, if the requesting user has the relevant permissions i.e. authorized domain, correct sub-group, and so on, a cookie is set and redirected to the proxy, which in turn lets it through. Built-in the same manner as its twin, the authenticator is based on the same image, only uses a different and a different set of configuration variables: ENTRYPOINT FROM buzzfeed/sso

ARG client_id \
    client_secret \
    session_cookie_secret \
    session_key

ENV AUTHORIZE_EMAIL_DOMAINS=domain.co \
    AUTHORIZE_PROXY_DOMAINS=domain.co \
    SERVER_HOST=sso-auth.domain.co \
    CLIENT_PROXY_ID=$client_id \
    CLIENT_PROXY_SECRET=$client_secret \
    SESSION_COOKIE_SECURE=true \
    SESSION_COOKIE_SECRET=$session_cookie_secret \
    SESSION_COOKIE_EXPIRE=1h \
    SESSION_KEY=$session_key \
    PROVIDER_X_CLIENT_ID=$client_id \
    PROVIDER_X_CLIENT_SECRET=$client_secret \
    PROVIDER_X_TYPE=google \
    PROVIDER_X_SLUG=google \
    PROVIDER_X_GOOGLE_IMPERSONATE=admin@domain.co \
    PROVIDER_X_GOOGLE_CREDENTIALS=/sso/credentials.json \
    PROVIDER_X_GROUPCACHE_INTERVAL_REFRESH=1m \
    PROVIDER_X_GROUPCACHE_INTERVAL_PROVIDER=1m \
    LOGGING_LEVEL=debug

COPY ./credentials.json /sso/credentials.json

EXPOSE 4180

ENTRYPOINT ["/bin/sso-auth"] OAuth2 Provider of choice - Google Not much to elaborate on Google. Its workspace directory offers a wide range of user management features and is considered a standard choice. Specifically, Buzzfeed's SSO offers either Google or Okta as providers. If these are not the way your organization is managing users this post might be irrelevant for the most part. You can, however, make use of the underlying system - , which will provide a similar experience, except the solution of a single locally managed authentication mechanism. Instead of having two components, the proxy is one system that operates against the backend provider. OAuth2-proxy Instructions (although far from perfect) can be found .
Important notes: here Please do go through all steps, even if some seem unnecessary; like not following step three and forward if group segregation is not a requirement. Do go all the way through it, and make sure you get the .json file at the end. Read carefully, make sure is enabled as shown admin SDK Make sure that from Google's workspace security side, the API controls Make sure the is set with an admin user PROVIDER_X_GOOGLE_IMPERSONATE=admin@domain.co Upstreams Upstreams are a configuration file where proxy routes are set. They take a public request from the web, and, if authenticated is routed to an internal (or not) service given some conditions are met. The configuration below describes two services and their internal routes: - service: vault
  default:
    from: vault.sso.domain.co
    to: vault.local:8200
    options:
      allowed_groups:
        - production@domain.co
- service: snappass
  default:
    from: secrets.sso.domain.co
    to: secrets.local:5000
    options:
      allowed_email_domains:
        - domain.co Notes: Each entry have a setting, other custom settings can follow must default & are the base, while are optional one of the are set. from to options only if top three I've learned this one the hard way... Note how or are set and sufficient on their own. The first is permitting access for a specific directory group, while the latter offers domain-wide access with allowed_groups allowed_email_domains The entire set of can be found options here Deployment The two services above should be deployed together in an internal network just as any other service would. The best practice here dictates a load balancer on top, to route traffic into the proxy/authenticator. The only thing to consider here is the of upstream services; a system that's considered "internal" and will be accessed through the proxy has to be accessible from the proxy itself. On the network level, this means that they either have to sit in the same virtual private network or have a between the networks. From the proxy's perspective, the IP the port should be in reach and open. "Open" also means that they would be part of the same security group, or open a rule in the respective groups to be able to provide back and forth communication. reachability peering and ECS and Service Discovery Once the proxy is set, the user gains access, they should be able to communicate with endpoints only accessible internally within the private network, the . While we can redirect the request to an IP, those tend to change and the connection is then lost. An improvement can be an elastic IP that's guaranteed to stay fixed with the resource it was attached to. This brings a few new issues though; a. the resource itself can (and should) be rotated within time - we are dealing with containers after all. b. Elastic IPs will once their underlying resource no longer exists. Another improvement might be a human-readable DNS A record that's pointed at the same IP. Still, being readable and all, the inherent problem with a static IP remains. VPC start being charged The solution - . Put simply, the service discovery service attaches itself to an ECS target group, updating the live running tasks underneath with an internal endpoint managed by Route53. Meaning, the user can hit the same endpoint and trust it to resolve to a dynamic IP that's connected to an existing task. AWS Service Discovery Here's a quick example using Terraform code (out of convenience only - this can be set manually or using any other language): A global resource of private dns namespace has to be created first before it can host internal records: <img src="{{ site.url }}{{ site.baseurl }}/assets/images/tf-carbon-dns.png"/> After the namespace is ready, we can start creating private records, note the reference to the namespace inside : dns_config <img src="{{ site.url }}{{ site.baseurl }}/assets/images/tf-carbon-discovery.png"/> And lastly, connecting the aws_ecs_service resource to the service registry: <img src="{{ site.url }}{{ site.baseurl }}/assets/images/tf-carbon-registries.png"/> Alternatives The solution above is no the only one for zero trust solution. There are plenty out there, including as well as many OSS alternatives. Buzzfeed's solution was the choice here for its elegance by remaining a one-stop authentication system that builds on top of Google's OAuth2 solution. Any kind of solution will usually do pretty much the same work, and as long as the concept of security is kept, the rest is implementation details. commercial ones Extending the power of Zero Trust Having the system deployed is a great solution for all things web. But sometimes real-life pop the security bubble; in some cases engineers will need to gain access to private resources by SSH, or other protocols (working against a Redis or a PostgreSQL instance). While Working directly against a resource in its protocol is not achievable, we can extend the reach by deploying web interfaces for , -like applications. SSH PGAdmin I would address the engineering culture of accessing private resources in the first place, and how to create a workflow that removes the necessity of such operations, but that's material for another post. In the meantime, let's leave the notion of avoiding it when you can. And if you're serious, you may consider rotating those accessed instances altogether, marking them as once they've been SSH'ed into and automating their removal. Food for thought... contaminated I hope this post helped with grasping the concept of zero trust and real-world implementation. This is something I struggled with when I tried incorporating it in our workflow, so I'm happy to share the experience and the "how-to". If you find any mistakes in the information above, have any questions or comments please ! reach out Thank you for reading 🖤

The Essential Guide to Zero Trust on AWS ECS Fargate

Want to open a business? Check out the entrepreneurship tips we created especially for you! Are you about to set up a venture? This is undoubtedly one of the most important steps for anyone's professional career. Therefore, it must be done with the utmost care, as any failure can cause numerous losses, contributing to end and, consequently, with a dream. To avoid risks it is recommended to invest as much as possible before and during the execution of your activities. planning Preparing to be a good entrepreneur is something that can be done in several ways, among them the most suitable is to study about the profession you want to exercise and also the variables of your field of activity. In addition, there are simple entrepreneurship tips, which are often ignored by many aspiring entrepreneurs, but when put into practice they make a total difference in the smooth running of business. Is your intention to set up a successful venture? For this to be possible, it is necessary to know how to observe the market in order to be able to identify trends and subsequently take advantage of the best opportunities that are available for your sector of activity, in addition to developing personal skills that are essential to running a business. To improve your business, we have assembled this article, bringing tips To Entrepreneur. Check it out below: 1. Share your idea A common mistake of those who are starting their journey in entrepreneurship is to be afraid to tell the business idea to other people. The reason? Fear that someone might copy your project. However, this perception ceases to make sense when we think of , that is, the network of contacts that is important for the company's success To increase you networking you can also crack some funny jokes or . networking . poetry to make impress people When we share our thoughts with other professionals - especially with those who have had similar experiences - we receive important advice that will save our time and money. Often, an outside look can be critical to solving a seemingly unsolved problem. Conversation with others in the industry also helps in other ways. You find out what trends and fads are - and whether they have a chance to stay in the market. This is important to avoid, for example, investing in something like Mexican palettes, which were a fever, but fell out of use months later. You can also discover good suppliers of raw materials, products, supplies and equipment. In this way, you increase the quality of the food due to the good ingredients and identify which  software is most suitable for your segment. 2. Know And Analyze Companies In The Segment It is important to understand about the sector in which it will start to operate and also about the other organizational areas, such as commercial, financial and , for example. This is the most efficient way to get a complete picture of the company. Remember that running a business goes far beyond and covers different areas. marketing To invest in the food segment, it is worth visiting other establishments in the area. As it is a sector with wide possibilities, you identify the characteristics of each business. For example, bars and restaurants have entertainment for the public. Lunch boxes offer a more basic meal outside the home. In turn, there are companies that provide services to cover events. Supermarkets, on the other hand, offer a wide range of options. However, if you choose a similar establishment, but located in a neighborhood, you need to have products suitable for the residents of the region. If they are part of classes A and B, for example, it is worth investing in fine and imported chocolates. Otherwise, you can keep the stock stopped if you make this investment. 3. Validate your business model One of the main reasons that lead companies to close their doors is the lack of planning. Making mistakes  is normal and is part of the learning process, but the most important thing is that the failures serve for the development of the enterprise. In the food sector, the prerogative is the same. To increase the chances of success, you need to . Identify who your competitors, potential suppliers and potential customers are. Detail information, such as consumption habits, preferences, brand options, etc. make a good assessment of the market through research Follow the results and indicators to change the strategy, if necessary, without fear. If your initial idea did not work, it is important to practice detachment from your conception. A common problem for the novice entrepreneur who bets on the food segment is operating costs. analyze To change this scenario, . This document guides the next actions, according to the strategic planning. Thus, you visualize the viability of the business and are more likely to get it right. In addition, it is an essential item for seeking corporate loans and financing, which have lower rates. invest in a good business plan At this point, in addition to defining strategies, . Look to the future and clearly determine where you are going. From then on, always focus on your purposes. it is also important to set goals and objectives 4. Organize Your Financial Life A very common reality in the life of a start-up entrepreneur is to keep the business finances in complete disarray - either because of their lack of knowledge or because of their lack of experience. To resolve this situation, the first step is to organize the cash flow. With simple tools, such as traditional , it is possible to both control the movement of incoming and outgoing products and making future forecasts. However, the ideal is to use to the food segment. spreadsheets management software specific As they are adapted to the segment, they present important resources for financial control, informing the amounts that must enter the cash register and the due dates of the slips. More than that, you monitor the indicators and check if the objectives set are being achieved. For example, you can determine that you want to increase your revenue by 10% over the next three months. To do this, it will promote your supermarket more on social networks, with the help of sponsored links. With the management software, it is possible to check if the action has positive effects or if it is better to correct it to be better oriented. So, in addition to having complete control of the monetary situation of your business, you can still plan your growth safely and accurately. 5. Study The Market The market study is another essential element for those who are opening their own business. The more the novice entrepreneur knows . the competition and the area of ​​operation, the greater the chances of success When analyzing the market, you will have much more security and foundation to define your  strategies . In addition, quantitative and qualitative research will help to identify your target audience and also determine the best techniques for selling your product or service. In addition to the market, it is important to consider the current economic situation in the country before opening your company - if the analysis indicates that this is not the best time, perhaps you should wait a little while to realize your dream. 6. Price Correctly The cases of entrepreneurs who sell a lot, but who are always with the cashier in the red, are common. Beginning entrepreneurs can make mistakes when defining the profit margin or fixing the values ​​of the products or services - and this usually happens due to wrong calculations. You need to find the right techniques to define important business items, such as pricing the goods or establishing a balanced profit margin. If you experience difficulties in this process, seek the assistance of a finance specialist. The most complete management software also helps in this process, as they are programmed to check automatic pricing of goods. This is the case of systems aimed at points of sale in the food industry, such as supermarkets, mini-markets, refrigerators, bakeries and convenience stores. In addition to automating the store front and facilitating inventory control, they also bring more precision to the administrative and financial sectors. The result is the right decision based on secure information. You identify, for example, which products have more or less turnover and you can even use the  ABC curve  to manage inventory efficiently. Remember that training is worth focusing on here. Therefore, search the main , in order to learn more about pricing, profit margin and other important information to define the correct value of the products. books for entrepreneurs 7. Create value for your products A company only if it presents any differential - otherwise, it will be just another option available among so many others that already exist. Presenting innovative solutions, for example, allows your brand to be well positioned in the market. stands out from the competition Another way to achieve this goal is to create value for your products and services. As? Through social responsibility. The concept is related to the voluntary act of organizations that are concerned with the well-being of the internal or external public. will certainly be more valued before others that do not position themselves in the same way. It is the case of implementing a recycling system in your supermarket or adopting a zero waste initiative in your restaurant. Companies that adopt actions and attitudes with the purpose of contributing to a better society Therefore, try to make your contribution to the sustainability of the planet or get involved with actions in the field of health, culture, education or housing. Undoubtedly, this conduct of social responsibility will create value for your brand. Developing a conscious and responsible posture is a safe and efficient strategy to manage your business, and also ensure the fulfillment of your dreams and the achievement of all your goals. Even if the beginning of the journey is not easy, do not give up: the road may be long, but in the end, all the effort will have been worth it. More than that, always remember the technology. Using management software to your advantage is the most efficient way to put all the tips we have put into practice. Thus, you monitor sales, production and assisted sales, fiscal adequacy and financial control of the entire business. In other words, it is everything you need to succeed, even if you are a beginner entrepreneur. Is that what you want to achieve? So, how about seeing how to change levels and leverage your business?

7 Entrepreneurship Tips That Will Change Your Business Life

Stories, News & Mentions about BEINGZERO

Beingzero’s Stories on HackerNoon