Better is fixing the broken homeownership system by combining our proprietary technology with a seamless customer service experience while removing the middleman and saving customers thousands in unnecessary charges and fees

Better

Storing Passwords In A Database: A Better Way to Do So

The TechBeat: Can AI Audit Smart Contracts Better than Human Auditors? (4/15/2024)

The Noonification: UX Considerations for Better Multi-Factor Authentication (4/12/2024)

Keeping online identities and sensitive data safe is always critical. Cyberthreats are constantly growing more sophisticated, so defenses must grow with them. Part of keeping users’ information secure is through multifactor authentication (MFA). This tool adds layers of protection beyond the traditional password. Although MFA can enhance security, developers should also implement it to improve the user experience. Maintaining both assets empowers users, ensuring a wider adoption of MFA while bolstering their overall security. What Is Multifactor Authentication? MFA is a security system that requires users to provide more than one form of verification to prove their identity. It acts as a multilayered shield protecting accounts and information. Instead of simply asking for a password, MFA adds one or two more questions to the mix. It may request a code sent to someone’s phone or a fingerprint or facial recognition. Combining different pieces of evidence ensures it’s the actual user trying to access their account and not someone else. Is this extra work worth it? According to security experts, the answer is yes. Research suggests that MFA can stop about 80%-90% of cyberattacks, which rely on stealing or guessing simple passwords. A hacker can get a password, but they still need the other pieces of the puzzle to break into an account. MFAs deter cyberattackers from hacking users by adding more hurdles, making unauthorized access more challenging. They add more protections to ensure online accounts remain secure. The Importance of Good UX Security measures are crucial for protecting online activities. However, the success of those safety protocols depends on the user experience. UX is a concept that impacts how people interact with technology. Don Norman — the godfather of UX — introduced this term in 1993 and stressed the importance of designing functional and user-friendly technology. Good UX is about making tech as intuitive as engaging in everyday activities. When devices and platforms feel effortless, users are more likely to integrate them into their daily lives. Products designed with UX in mind should enable people to interact with them seamlessly without interruption. Simultaneously, UX should balance protective security measures well without imposing unnecessary barriers. Therefore, MFA should feel effortless and ensure users feel safe and secure in a digital environment. Enable Copy-Paste for Passwords Making account access convenient is crucial for the overall user experience. One feature that enhances this process is copying and pasting passwords. While turning off copy-paste functionality may seem intuitive to avoid cyberattacks, it keeps users from adopting secure login management practices. Around 30% of people worldwide rely on password managers to secure their login information. These digital vaults allow users to store passwords encrypted by a master password. These tools can generate and store complex identifiers for every account, significantly boosting security. Enabling copy and paste allows individuals to leverage their password manager without memorizing or manually entering them. Implement Adaptive Authentication Methods Adaptive or risk-based authentication can achieve a seamless yet secure user experience. This process evaluates the risk level or a login attempt in real-time. It considers various factors, such as someone’s location, device, network, time of access, and behavior patterns. Based on its assessment, it decides whether to allow or deny access or request additional verification. Using adaptive authentication is helpful to users because it offers swift and hassle-free access. However, when the system detects unusual behavior, it automatically introduces additional authentication steps. This security measure operates on the principle that security should be as stringent as necessary but as unobtrusive as possible. It respects people’s time and effort, making safety measures supportive rather than disruptive. Create Fallback Options A good digital security strategy recognizes that even the best plans can encounter unexpected challenges. This is especially true for MFA, where the primary verification method could be unavailable. Implementing fallback options is a critical UX consideration to ensure continuous access while maintaining safety. Fallback options are alternative methods for verifying a user’s identity when the primary function is unavailable. For example, if someone typically receives a verification code via SMS but doesn’t have cell service, a fallback option could be to send it via email. These other methods are essential for avoiding lockouts and ensuring people always have access to their accounts. When designing fallback options, each method should be secure enough to prevent unauthorized access but not so cumbersome that it frustrates the user. Fallback options can include backup codes, other communication channels, and security questions. Streamline the Authentication Flow How can developers seamlessly integrate MFA into the user’s journey? Keep the primary objective in mind, which is to minimize friction while maintaining high-end security. A smooth authentication process involves simplifying input. Reduce the amount of information people need to provide by leveraging data already available. This will keep MFA straightforward and encourage users to adopt this protection method. Another approach is to implement single sign-on (SSO). Using this in MFA reduces the need for multiple logins. Once users have verified their identity, they can access their applications without having to authenticate again. The fewer steps provided, the easier it is for someone to maintain strong safety. However, it is important to realize that while streamlining is desirable, maintaining security is crucial. Simplifying the authentication process without making it too easy for intruders can be challenging. That is why continuously refining the flow is vital to ensure it meets users’ needs and security protocols. Regularly Test and Update Cybersecurity threats are constantly evolving. Regular testing and updating are necessary to ensure MFA systems remain effective while providing a positive user experience. This helps identify potential vulnerabilities and improve functionality even when new security issues emerge. Testing involves simulating various scenarios to ensure MFA is working as intended. This includes checking for usability with actual users to ensure the system is accessible. It also helps identify areas where designers can enhance people’s experience by reducing time or streamlining actionable steps. Simplifying MFA Without Sacrificing Security Quality While multifactor authentication can enhance digital security, its success relies on a user-centric approach. Developers should follow the latest design principles and user feedback so more people can use the safest system. Utilizing both approaches will help individuals feel confident while encouraging them to keep their MFA settings on. Keeping online identities and sensitive data safe is always critical. Cyberthreats are constantly growing more sophisticated, so defenses must grow with them. Part of keeping users’ information secure is through multifactor authentication (MFA). This tool adds layers of protection beyond the traditional password. Although MFA can enhance security , developers should also implement it to improve the user experience. Maintaining both assets empowers users, ensuring a wider adoption of MFA while bolstering their overall security. security What Is Multifactor Authentication? MFA is a security system that requires users to provide more than one form of verification to prove their identity. It acts as a multilayered shield protecting accounts and information. users to provide more than one form of verification users to provide more than one form of verification Instead of simply asking for a password, MFA adds one or two more questions to the mix. It may request a code sent to someone’s phone or a fingerprint or facial recognition. Combining different pieces of evidence ensures it’s the actual user trying to access their account and not someone else. Is this extra work worth it? According to security experts, the answer is yes. Research suggests that MFA can stop about 80%-90% of cyberattacks , which rely on stealing or guessing simple passwords. A hacker can get a password, but they still need the other pieces of the puzzle to break into an account. about 80%-90% of cyberattacks about 80%-90% of cyberattacks MFAs deter cyberattackers from hacking users by adding more hurdles, making unauthorized access more challenging. They add more protections to ensure online accounts remain secure. The Importance of Good UX Security measures are crucial for protecting online activities. However, the success of those safety protocols depends on the user experience. UX is a concept that impacts how people interact with technology. Don Norman — the godfather of UX — introduced this term in 1993 and stressed the importance of designing functional and user-friendly technology. introduced this term in 1993 introduced this term in 1993 Good UX is about making tech as intuitive as engaging in everyday activities. When devices and platforms feel effortless, users are more likely to integrate them into their daily lives. Products designed with UX in mind should enable people to interact with them seamlessly without interruption. Simultaneously, UX should balance protective security measures well without imposing unnecessary barriers. Therefore, MFA should feel effortless and ensure users feel safe and secure in a digital environment. Enable Copy-Paste for Passwords Making account access convenient is crucial for the overall user experience. One feature that enhances this process is copying and pasting passwords. While turning off copy-paste functionality may seem intuitive to avoid cyberattacks, it keeps users from adopting secure login management practices. Around 30% of people worldwide rely on password managers to secure their login information. These digital vaults allow users to store passwords encrypted by a master password. These tools can generate and store complex identifiers for every account, significantly boosting security. Enabling copy and paste allows individuals to leverage their password manager without memorizing or manually entering them. 30% of people worldwide 30% of people worldwide Implement Adaptive Authentication Methods Adaptive or risk-based authentication can achieve a seamless yet secure user experience. This process evaluates the risk level or a login attempt in real-time. It considers various factors, such as someone’s location, device, network, time of access, and behavior patterns. Based on its assessment, it decides whether to allow or deny access or request additional verification. Using adaptive authentication is helpful to users because it offers swift and hassle-free access. However, when the system detects unusual behavior, it automatically introduces additional authentication steps. This security measure operates on the principle that security should be as stringent as necessary but as unobtrusive as possible. It respects people’s time and effort, making safety measures supportive rather than disruptive. Create Fallback Options A good digital security strategy recognizes that even the best plans can encounter unexpected challenges. This is especially true for MFA, where the primary verification method could be unavailable. Implementing fallback options is a critical UX consideration to ensure continuous access while maintaining safety. Fallback options are alternative methods for verifying a user’s identity when the primary function is unavailable. For example, if someone typically receives a verification code via SMS but doesn’t have cell service, a fallback option could be to send it via email. These other methods are essential for avoiding lockouts and ensuring people always have access to their accounts. When designing fallback options, each method should be secure enough to prevent unauthorized access but not so cumbersome that it frustrates the user. Fallback options can include backup codes, other communication channels, and security questions. Streamline the Authentication Flow How can developers seamlessly integrate MFA into the user’s journey? Keep the primary objective in mind, which is to minimize friction while maintaining high-end security. A smooth authentication process involves simplifying input. Reduce the amount of information people need to provide by leveraging data already available. This will keep MFA straightforward and encourage users to adopt this protection method. Another approach is to implement single sign-on (SSO). Using this in MFA reduces the need for multiple logins. Once users have verified their identity, they can access their applications without having to authenticate again. The fewer steps provided, the easier it is for someone to maintain strong safety. without having to authenticate without having to authenticate However, it is important to realize that while streamlining is desirable, maintaining security is crucial. Simplifying the authentication process without making it too easy for intruders can be challenging. That is why continuously refining the flow is vital to ensure it meets users’ needs and security protocols. Regularly Test and Update Cybersecurity threats are constantly evolving. Regular testing and updating are necessary to ensure MFA systems remain effective while providing a positive user experience. This helps identify potential vulnerabilities and improve functionality even when new security issues emerge. Testing involves simulating various scenarios to ensure MFA is working as intended. This includes checking for usability with actual users to ensure the system is accessible. It also helps identify areas where designers can enhance people’s experience by reducing time or streamlining actionable steps. checking for usability with actual users checking for usability with actual users Simplifying MFA Without Sacrificing Security Quality While multifactor authentication can enhance digital security, its success relies on a user-centric approach. Developers should follow the latest design principles and user feedback so more people can use the safest system. Utilizing both approaches will help individuals feel confident while encouraging them to keep their MFA settings on.

UX Considerations for Better Multi-Factor Authentication

উন্নত মাল্টি-ফ্যাক্টর প্রমাণীকরণের জন্য UX বিবেচনা

UX-Überlegungen für eine bessere Multi-Faktor-Authentifizierung

Consideraciones de UX para una mejor autenticación multifactor

Considérations UX pour une meilleure authentification multifacteur

बेहतर मल्टी-फैक्टर प्रमाणीकरण के लिए UX विचार

より良い多要素認証のためのUXの考慮事項

더 나은 다단계 인증을 위한 UX 고려 사항

Considerações de UX para melhor autenticação multifator

Daha İyi Çok Faktörlü Kimlik Doğrulama için Kullanıcı Deneyimi Konuları

Những cân nhắc về trải nghiệm người dùng để xác thực đa yếu tố tốt hơn

更好的多因素身份验证的用户体验注意事项

Radix Engine: A Better Model for “Enshrinement

রেডিক্স ইঞ্জিন: "এনশ্রাইনমেন্ট" এর জন্য একটি ভাল মডেল

Radix Engine: Ein besseres Modell für „Enshrinement

Radix Engine: un mejor modelo para la “consagración”

Moteur Radix : un meilleur modèle pour « l’enchâssement »

रेडिक्स इंजन: “प्रतिष्ठा के लिए एक बेहतर मॉडल”

Radix Engine: 「殿堂入り」のより良いモデル

Radix 엔진: "Enshrinement"를 위한 더 나은 모델

Radix Engine: um modelo melhor para “consagração

Radix Engine: лучшая модель для «закрепления»

Radix Engine: “Kutsallaştırma” için Daha İyi Bir Model

Radix Engine: Một mô hình tốt hơn cho “Bảo quản

Radix Engine：一个更好的“供奉”模型

Smart contracts hold massive potential. But with great power comes great responsibility, and ensuring the security of these smart contracts is critical. This is where auditing comes in. With its superhuman processing power, can outperform human auditors in this critical role of keeping smart contracts safe? We’ll discuss the answer in this article. AI The Case for AI Speed and Scale: AI can analyze massive amounts of code swiftly, identifying patterns and potential vulnerabilities that might take humans weeks. This is crucial in the fast-paced world of blockchain development. Machine Learning Advantage: AI can learn from vast datasets of past exploits and successful audits, continuously improving its ability to detect novel threats. Reduced Bias: Human auditors are susceptible to biases, but AI can approach audits with cold objectivity. This is an AI-based on the audit of a protocol named Lockon, which allows for index investments in crypto. The report was generated in approximately 48 hours. The Lockon team was surprised to learn that this was an AI-based report because they found the points about vulnerabilities to be accurate. report While AI-based audits are not yet perfect, they offer significant benefits for projects looking to reduce audit costs. They are also increasingly used as a “Pre Audit” before engaging traditional audit firms, as identifying critical bugs in advance can reduce the costs paid to audit firms. Moreover, integrating AI-based audit services into the CI/CD process is beginning to be seen as a way to improve code quality. The Case for Human Auditors Understanding Context: Smart contracts don't exist in a vacuum. They interact with complex systems. Unlike humans, AI might need help to grasp the nuances of these interactions and the potential security implications. Explainability and Judgment Calls: When an AI flags an issue, explaining the cause and reason for the issue or vulnerability is crucial. Human auditors can interpret the code, assess the risk, and make informed decisions. Creativity and Unforeseen Threats: Cybercriminals are constantly innovating. AI might miss new attack vectors, while human auditors can leverage their experience and creativity to consider these possibilities. Many may argue that AI can do this given its machine-learning capabilities, but again, human intelligence has the upper hand. No doubt, AI is a game-changer for smart contract audits, but it's not a silver bullet. The future lies in collaboration. Imagine AI rapidly scanning code, highlighting potential risks, and freeing up human auditors to focus on complex scenarios and make final judgments. This powerful partnership can ensure the secure and efficient future of smart contracts. A Quick Comparison An example of an AI-based audit firm, between AI-based audits and human audits. Bunzz Audit has published a comparison The Bunzz team states, "Our research and development results have led us to conclude that a database plus AI approach is more suited for detecting vulnerability patterns than humans." The Future of AI Audits In February 2024, Vitalik Buterin highlighted the potential of AI in aiding formal verification of code and bug finding. “One application of AI that I am excited about is AI-assisted formal verification of code and bug finding,” he stated, adding: “Right now, Ethereum’s biggest technical risk probably is bugs in code, and anything that could significantly change the game would be amazing.” Blockchain projects rely on code, and just like any code, it can have errors. Formal Verification is a tool that helps identify these weaknesses in the logic of blockchain projects. By using Formal Verification, web3 builders can ensure their projects are more reliable and trustworthy. Imagine a future where Formal Verification is even more powerful. Some experts believe this advancement could be just as significant for blockchain technology as Zero-Knowledge proofs, a different technology that enhances privacy. However, there's a hurdle. Writing clear and perfect instructions for code, called "specifications," is currently expensive and time-consuming. Here's where things get interesting: some, like Vitalik Buterin, and front-runners like . I believe AI  could be the key to making this process cheaper and easier. Bunzz Audit

Can AI Audit Smart Contracts Better than Human Auditors?

এআই কি হিউম্যান অডিটরদের চেয়ে স্মার্ট চুক্তির অডিট করতে পারে?

Kann KI Smart Contracts besser prüfen als menschliche Prüfer?

¿Puede la IA auditar contratos inteligentes mejor que los auditores humanos?

L’IA peut-elle mieux auditer les contrats intelligents que les auditeurs humains ?

क्या AI स्मार्ट कॉन्ट्रैक्ट्स का ऑडिट मानव ऑडिटर्स से बेहतर कर सकता है?

AI は人間の監査人よりもスマート コントラクトを監査できますか?

AI가 인간 감사자보다 스마트 계약을 더 잘 감사할 수 있습니까?

A IA pode auditar contratos inteligentes melhor do que auditores humanos?

Может ли ИИ проверять смарт-контракты лучше, чем люди-аудиторы?

Yapay Zeka Akıllı Sözleşmeleri İnsan Denetçilerden Daha İyi Denetleyebilir mi?

AI có thể kiểm tra hợp đồng thông minh tốt hơn kiểm toán viên con người không?

人工智能能比人类审计员更好地审计智能合约吗？

I’ve started a new contract where I'm tasked with consolidating the company's infrastructure under AWS. They (the company) are starting to see some serious growth and have a team in place currently using PaaS and various other cloud providers. Infrastructure as code tools have been popular for a long time; I've mostly been a bit skeptical about using them given that with a small team size, the UI is often more than enough. But, when you need to start spinning up multiple environments (dev, staging, prod, demo, etc.), this starts to become a lot of overhead. An issue I've often seen is that it becomes the responsibility of one or two developers to maintain this as the rest of the team is not familiar with the tool and language syntax. Obviously, this is not ideal, so I wanted to research the space to see if there was a middle way where you can get the benefits of IaC, without the overhead of having to learn a new language and tool. I've previously used Terraform in other companies I've done work for but never from scratch and (full disclosure) always found the experience rather frustrating. So, I began to search for terraform alternatives and stumbled upon Pulumi which lets you provision resources using a number of programming languages (including Go), and Pulumi's AWS provider support is excellent. But, as in any other situation where you are considering marrying yourself to a new tool, it's very worthwhile to do some research and preferably build some small proof of concept before you commit. I've had some interesting discoveries through this process, why I choose pulumi over Terraform, and when I would consider Terraform over Pulumi. Short Intro to Terraform I think it's fair to say that Terraform has been the big dog in the IaC space for a long time. They've support for the majority of cloud providers, have been battle-tested at scale, and have a bunch of great tutorials. They also used to have an open source license, using Mozilla Public License v2, but decided recently to switch to what is known as the Business License, BSL, which can be considered as "source-available." I will not go into a longer debate about why this is not ideal or if it's fair or not, but it does pose a threat to the development of third-party tools and your options in terms of making tweaks if needed. For the unfamiliar, Terraform is written in its own "DSL" known as HCL. It's a declarative language, so you tell it the desired state you want your infrastructure to be in and Terraform figures out how to get your infra to that state. A short example of how you would provision a S3 bucket would look like this: 1resource "aws_s3_bucket" "my_bucket" {
2  bucket = "my-bucket"
3  acl    = "private"
4} Which would be written in a file with the extension. As we'll see later on, you have lots of options in terms of structuring your code into modules and different types of options for code reuse: blocks, , , etc. .tf data variables outputs Short Intro to Pulumi Pulumi is just a very strange name. Growing up, I had a friend we for some reason called Pummi (or maybe it was bummy, can't recall for sure), and all I can see when reading the name is his face. They're also rather new in the IaC space but have made some significant advances. Some years ago, I worked at a place that utilized AWS's CDK, and I imagine people would feel pulumi to be quite similar. You have a range of choices in terms of the language you want to use, JS/TS, Python, Go, etc, all have the same API, so switching be the biggest issue. I write all my stuff in Go these days, so the same example as above written using Go and Pulumi would look like this: shouldn't 1func main() {
 2	pulumi.Run(func(ctx *pulumi.Context) error {
 3		_, err := s3.NewBucket(ctx, "my-bucket", &s3.BucketArgs{
 4			Bucket: pulumi.String("my-bucket"),
 5			Acl:    pulumi.String("private"),
 6		})
 7		if err != nil {
 8			return err
 9		}
10		return nil
11	})
12} To anyone who has ever written Go, this should immediately make sense, even without knowing the Pulumi API or the AWS ecosystem. And this is one of the main benefits we will get back to, again and again, over the course of this post. Pulumi is also "true open source", in the sense that it operates with an Apache 2.0 license, which is a lot more permissive than the BSL license terraform uses. Which is great for the community and adoption rate, but, so was Terraform at one point. For now, it's a huge plus. However, it isn't all sunshine and rainbows. Pulumi is still young, so documentation is still not great when actually writing code. Their general-purpose docs do make up for this, but it can be frustrating having to jump in and out of the editor to look up what you're currently working on. Building the POC All of the applications are containerized being we can take full advantage of AWS's elastic container service, so the POC was a simple hello world API packed in a docker image, served using fargate and a load balancer in front. I've been aware of ECS and fargate (plus, vpc, subnets, security groups, etc.), but never used them, so there was also some learning involved. The first thing that became clear was that Terraform has a lot of great documentation and tutorials available. While Pulumi does also have documentation and available tutorials, they are not as "complete" as what you find with Terraform. However, I would find myself hitting a problem in the infrastructure setup with Terraform, and switching to pulumi, and even with less available information, I was able to reason my way out of the problem because I simply had to read Go code. The overhead of a new language and platform would be frustrating, but staying in something I already knew removed one leg of complexity, and the AWS concepts were now the only thing I had to figure out. I suspect that would be one of the main feelings of other engineers who don't do full-time DevOps as well. I managed to get the poc running using both tools, but a big help came from staying in an environment I was already familiar with. I'm a heavy (neo)vim user and while there are lots of good plugins for Terraform, the Go environment is something I'm in every day; nothing new was needed. If I dedicated the time, I don't suspect it would take super long to get familiar with HCL and Terraform to the point where the environment would feel close to as familiar as Go. But, given that I wouldn't have to work every day with Terraform after getting the initial setup done, that familiarity would soon start to fade. Meaning, that every time a new infrastructure part had to be added, I would need to re-familiarize myself. And, for the rest of the team, this would be the same but with the added overhead of getting into a part of the code they didn't help write. This could be mitigated by involving everyone from the get-go, but this is also a business, there are other priorities that need building too. Documentation might be the answer some of you are screaming at the screen right now, and I hear you, but documentation quickly goes stale. This is especially true in smaller teams where things move fast, if the majority can be documented by the code itself, you save yourself much trouble. Why I Choose Pulumi Over Terraform I ended up going with Pulumi. I know from experience that the "correctness" of these choices only shows its true self after you're well past the point of making the switch to the other candidate feasible. But, from my current point of view, this is what will best benefit the team I'm currently working with. Two questions kept coming up as I was trying to decide on which tool to use: What are our infrastructure requirements now and in the future? (i.e., are we ever going to need a full-time DevOps) What does the current team know? (i.e., programming languages, cloud providers, etc.) The first might seem arbitrary, but the likelihood of finding a full-time DevOps engineer who knows Terraform is properly much higher than knowing Go and pulumi. Given that the needed infrastructure now and in the foreseeable future most likely will not require a full-time DevOps role, terraform begins to feel a bit overkill. It's a new language, and everybody on the team would need to learn it as well as any best practices that come with it. All the while, getting into the nitty gritty of AWS which will also be a new learning experience for the team (myself included). The second, to me, was very important since I've, from multiple experiences, seen what happens when you have a big Terraform setup that maybe one engineer was in charge of creating. Most of the time, it ends up being that one person that has to maintain and fix it, effectively making them a devOps person (which might be against their will -> they switch job -> team is fucked). The rest of the team, despite the person writing documentation, making presentations, etc., are still very reluctant to touch it. It's something they are unfamiliar with; the infrastructure system can be quite difficult to "have in your head." You can potentially take down everything without knowing how to get back to a running state. It creates a lot of friction. You might argue: "Well, they will just have to learn it" and I agree; that would be a sensible path forward. But we're not trying to solve a technical problem right now, but rather, a human one. And without allocating the time for people to learn it, it probably will not happen. So, in lieu of a DevOps team, you need to optimize for what gets people to actually want to learn infrastructure. Over the two weeks I spent researching and building some POCs, I would often find very good tutorials and materials on setting up infrastructure with Terraform. But as soon as I hit my head against wall, not knowing a specific syntax/setup/approach used in the tutorial or what the specific AWS services were about, it became very hard to move on. Multiple times, I switched back to Pulumi where their docs had examples in Go code, which was much easier for me to wrap my head around since I already knew Go. I "only" had to figure out the AWS part. After, I would switch back to Terraform and fix the thing with my new understanding from pulumi/go. But it's important to note where that knowledge originated from, by reading code, which most of us are doing pretty much every day. Taking away the overhead of both having to learn a new language and a cloud provider, to only the cloud provider, helps a tremendous amount. You also get the added benefit of already knowing best practices, and when and why to break those practices. You get an API from pulumi, so you can start provisioning infrastructure directly in your application(s), which makes spinning up demo environments for sales processes trivial. When I Would Choose Terraform Up to a certain point, something becomes a standard because of its quality and appeal to a large part of the tool’s target group. After that point, better alternatives might actually exist, but since the standard requirement is to know said tool, everyone else just continues learning that (I'm looking at you, React. Switch those frontends back to HTML, and use htmx for interactivity!). If that's what’s going on here with Terraform and Pulumi is hard to say. I actually had a much better experience exploring terraform, compared to previous experiences, where I only had to tweak it a little bit. If your team includes members who already know Terraform or you know that you have some large-scale infrastructure needs in the near future, that will include a dedicated DevOps team, Terraform still seems like the better choice. I did pick Terraform and HCL up rather quickly, but I'm still quite confident that this would fade again after not using it daily, so if you don't have that limitation, terraform would win for me. The main argument from my side here is to remove friction from your team when they don't deal with infrastructure on a daily basis; learning a new language while your PM is blasting new tickets your way like his life depended on it is tough. And having to wait for the one team member who truly knows the infrastructure code coming back from holiday to fix things, is very sub-optimal. Was This a Good Decision? It's too early to tell; I will revisit this in a few months once we've had some more production experience with it and the team has started working more with it as well.

Pulumi vs Terrafrom: Which Is Better?

In 2024, there is no shortage of LLM-based applications. Major tech companies like Microsoft and Google are pushing forward ever-more-powerful versions of their flagship ChatGPT and Gemini models, and specialist players like Anthropic are pushing forward competing offerings with additional integrations. In the applied LLM world, companies and even governments are experimenting with chat applications for a variety of contexts. Despite the enormous entrepreneurial energy poured into LLMs, most high-profile applications are still limited by their focus on chat-like interfaces that take in and return human-readable text. This is understandable - after all, one of the most exciting developments of LLMs is the ability to comprehend and generate human language, allowing for a conversational user interface. However, chat interfaces overlook another very important use case for LLMs - text processing as an intermediate step in a larger data pipeline. Today, we will explore this use case and see how LLMs can be useful as part of a data pipeline, not just as a natural language generator. Function Calling LLMs In order to use LLMs as part of a data pipeline, we need to change the output format of the LLM - instead of generating paragraphs for humans to read, the model has to generate something that computers can read. Usually, this means structured output in a data format like JSON or instructions in  a programming language like Python or SQL. These output formats are a lot less forgiving than natural language, since a missing quotation mark or bracket can crash the entire pipeline. Therefore, we will need to rely on specialized methods and features that have been developed to support this use case. These features are collectively referred to as function calling, since the output tends to call functions or be consumed in function calls. Before we delve into these methods, though, let’s first explore a little more in depth why function calling features were developed in the first place. Use Cases Connecting to external services The original and most straightforward use case for function calling is connecting to external services. When OpenAI originally released GPT-4, it also updated the API with a feature that allowed the user to provide the model a set of python-style functions that the model could call to accomplish its goals. The model could, for example, be told that it can call an external function to calculate the price of a complex security. Using this information, the model would be able to write code that calculates the value of a portfolio made up of these securities, without having to possess specialized knowledge on securities pricing. Calling python-style functions is only the tip of the iceberg. Once the importance of function-calling was proven in the market, OpenAI and other LLM providers started to support other output formats, such as JSON or SQL. The important thing was that these models were outputting machine-readable outputs, which could be reliably read by other processes. Astute readers might recognize that we have done something similar in previous articles, using LLM to generate , , or . In these , we accomplished this using prompt engineering and output-checking, but now that function-calling is a widely-supported feature, we can do this more easily by relying on these model-level features. training data SQL JSON articles Chaining LLMs Function calling created new possibilities for multi-LLM applications, and soon developers were experimenting with chaining LLMs to create sophisticated systems. Some of these systems became known as , which could independently search the web, gather new data, and call another LLM with the new information. These pipelines are capable of surprising amounts of autonomy and are capable of solving sophisticated problems with very little input, though there are still limitations, such as API costs and behavioral safeguards, that prevent agents from gaining widespread adoption. agents Using LLM as input and intermediate processing Another use case for function-calling LLMs is input and intermediate data processing. LLMs can be used to parse unstructured inputs into structured data that can be used for downstream processing. While many of these tasks tend to be relegated to “traditional” NLP technologies, the flexible nature of transformer-based models means that a specifically trained model can perform much better on these tasks than other NLP technologies. As a result, many developers are trying to leverage these specialized models in their data pipelines. Now that we’re familiar with the theory behind function-calling, let’s look at the application we will be building today. Demo Application CB Insights Entity Relationship Analyzer In a , I created a simple RAG application to answer natural language questions about CB Insights popular newsletter. In today’s article, we will build a similar question-answering application, but instead of relying on embedding search and GPT3.5, we will be using entity recognition as the primary indexing method. Additionally, we will use DRAGON as the summarization engine so we can run the entire application on our laptop, no cloud services needed. previous article Why Use Entity Recognition? Before we delve into the implementation, let’s first explore the advantages of using NER as the retrieval technology instead of embedding search. While in production we will want to use each technique according to the demands of the specific situation, NER offers several advantages over a system that relies on embedding search. Debuggability: Because entity recognition is an easily verifiable task, the entire pipeline is much more debuggable. It is easy to check if the model correctly identifies all of the entities, and it is easy to build and improve a matching algorithm based on these entities. Comparatively, it is much more difficult to verify that the embedding algorithm is properly identifying similarities and differences in passages. Flexibility: By separating recognition and filtering, we make the pipeline much more flexible than an embedding-based search algorithm. We can add additional metadata, change search algorithms based on entity type, and even use embedding algorithms on top of the NER-based search results. This allows for much more powerful features to be developed based on combinations of technologies. For example, an NER-based pipeline can use entity-based search to narrow down a set of documents, then use an embedding algorithm to narrow down further within the search space. This tends to make the search much faster and more efficient. Identification Power: Due to the level of manual control that is possible, NER pipelines are much more suited for certain search and retrieval tasks. Embedding searches are based on the proximity of passages within the training data, which calculates the probability that two documents come from the same larger document. In some use cases, this will cause embedding search to miss important documents. For example, if we were trying to understand Microsoft’s AI strategy, we might not only want to retrieve information about Microsoft’s activities within the AI software space, but also information about investments in chipmaking, data centers, and robotics. A general purpose embedding algorithm will not be able to identify these connections, whereas an NER-based algorithm will be able to draw these connections. Now that we understand the benefits of using NER within a RAG pipeline, let’s get a deeper look at the specific technologies we’re using in our application. Technologies Used LLM Entity Recognition Entity Recognition is a “traditional” NLP technology for extracting structured data from unstructured language data. The extracted data can then be used in down-line processing or as metadata for the passage being analyzed. Historically, this was accomplished using small, purpose-built machine learning algorithms that first tags the parts of speech, followed by a second pass that determines if the proper nouns identified are named entities. With function-calling LLMs, we can accomplish the same task, with several added advantages. Because transformer architecture is able to understand the language structure better than smaller NLP models, the performance is likely to be more robust, for example in cases where the passage is improperly formatted. Because LLMs are being updated with the most recent training data, the entity recognition system is likely to stay more up-to-date than other open-source entity recognition models. Prompt engineering techniques can be used to embed additional data and give additional instructions, allowing for more flexible behavior even in off-the-shelf models. We have covered Dragon in a previous article where we highlighted its impressive performance in summarizing natural-language data. We will be using Dragon to perform the final step of analysis, where we will summarize all of the articles relevant to the selected entities. DRAGON SLIMs are a new family of miniaturized, locally-runnable models from - it’s no secret I am a fan of their miniaturization work - that specializes in function calling. These models have been fine-tuned specifically to generate outputs that can be interpreted by machines, allowing users to take advantage of the recent developments in function calling architecture without having to rely on external APIs. SLIMs LLMWare Today we will be using the SLIMs-NER model, which will perform the Named Entity Recognition on the newsletter articles. In addition to NER, there are also SLIMs models for sentiment analysis, SQL generation, and multi-step agents. Now we understand the technology, let’s implement the application! Implementation Data Downloading and Processing Let’s begin by downloading the CB Insights articles. Let’s import the dependencies: import requests
from bs4 import BeautifulSoup
import os
import pandas as pd
import json
import re And now the code to download the newsletter archive: res = requests.get('https://www.cbinsights.com/newsletter/')

soup = BeautifulSoup(res.text)
article_links = [[i.text, i['href']] for i in soup.find_all('a') if 'campaign-archive' in i['href'] ]
article_soups = [BeautifulSoup(requests.get(link).text) for title, link in article_links] Now that we have downloaded the newsletter archive, let’s process it into JSON format result_json = {}
for soup_meta, soup_art in zip(article_links, article_soups):
    article_tables = []
    cur_article = []
    for table in soup_art.find_all('table'):
        if table.attrs.get('mc:variant') == 'Section_Divider':
            article_tables.append(get_deduped_article_tables(cur_article))
            cur_article = []
        else:
            cur_article.append(table.text)
    article_tables.append(get_deduped_article_tables(cur_article))
    result_json[soup_meta[0]] = article_tables

articles_with_meta = []
for name, tables in result_json.items():
      print(name, pd.to_datetime(tables[0][1].strip()))
      articles_with_meta.append({
            'name': name, 'date':  pd.to_datetime(tables[0][1].strip()).strftime('%Y-%m-%d'), 'tables': tables
      })
df = pd.DataFrame(articles_with_meta) Now we are at the same place we were at in the previous article. Instead of going right to the RAG construction by creating embeddings, however, we will instead run an entity-recognition step. First, let’s import the dependencies for running SLIMs, a new set of models from LLMWare that allows us to perform entity recognition locally on our machine: from llmware.agents import LLMfx
from llmware.parsers import WikiParser
from collections import defaultdict

# define a function for identifying all the named entities
def run_ner(text):
    agent = LLMfx()
    agent.load_work(text)
    agent.load_tool("ner")
    named_entities = agent.ner()
    ner_dict= named_entities["llm_response"]
    return ner_dict Now we can run the named entity recognition on all of the articles: date_entities = defaultdict(dict)
for _, row in df.iterrows():
    for idx, t in enumerate(row['tables'][1:]):
        if 'Start Your Free Trial' in t:
            t = t[:t.index('Start Your Free Trial')]
        date_entities[row['date']][idx] = run_ner('\n'.join(t)) It might take a few minutes for the NER pipeline to complete, but this is all you need to recognize entities using a state-of-the-art miniaturized LLM. You can check the date_entities dictionary by printing some test items. For example, the code: date_entities[list(date_entities.keys())[0]] Should produce the output below: {0: {'people': ['Yahoo!'],
  'place': [],
  'company': ['Databricks', 'MosaicML'],
  'misc': []},
 1: {'people': [],
  'place': ['New York'],
  'company': ['CB Insights'],
  'misc': []}} Which shows all of the various entities that have been detected by the SLIMs model. Question-Answering with DRAGON Now that the entities have been detected, let’s build a question-answering workflow that demonstrates the power of this technique. For our example, we will use the test question: What role does OpenAI play in Microsoft's AI strategy? Let’s begin by importing the proper packages for running DRAGON: from llmware.prompts import Prompt
query = "What role does OpenAI play in Microsoft's AI strategy?"

model_name = "llmware/dragon-llama-7b-gguf"
prompter = Prompt().load_model(model_name) Now, we can build the function that answers the question using entity recognition. In order to leverage our NER data, we will want to implement the following workflow: Identify the entities in the user query. We can use the same SLIMs function we used in the previous step. Perform a lookup based on the results of the lookup, that is, we search for articles in the corpus that talk about the same entities. Once we find these articles, we can supply them to the question-answering model to extract the relevant information. Here is what the workflow looks like in code form: def answer_question_with_ner(query):
    ner_results = run_ner(query) # run NER on the user query
    search_entities = []
    for ent_type, ent_list in ner_results.items():
        search_entities.extend(ent_list)
    # create a list of entities to search for
    search_entities = list(set(search_entities))

    # now perform a lookup for articles that mention the identified entities, using set arithmetic. 
    articles = set(entity_to_place_map[search_entities[0]])
    for se in search_entities:
        articles &= set(entity_to_place_map[se])

    # now process the corpus into a prompt and feed it to the question-answering LLM.
    article_content = []
    for article in articles:
        article_content.extend(df[df['date'] == article[0]].iloc[0]['tables'][article[1]+1])
    response = prompter.prompt_main(query, 
        context='\n'.join(article_content),
        prompt_name="default_with_context", temperature=0.3)
    return response # return the response. Run the function, with the query from the first code block, and you should see the following result: Microsoft has poured billions of dollars into ChatGPT developer OpenAI. However, it's also placed a number of bets on other GenAI startups across computing, mapping, and gaming. You can also see in the “evidence” section of the response object that, indeed the two articles from the CB Insights archive that mention Microsoft and OpenAI have been retrieved, and that the LLM’s answer is based directly on the evidence. Note that because we are doing explicit entity recognition, the retrieval process is extremely transparent and debuggable. Should a question ever arise as to why the model retrieved these specific pieces of information from the corpus - all it takes is a simple print statement to see that the model chose the article because the query mentions “Microsoft” and “OpenAI”, and the two retrieved newsletter sections are the only sections that mention both entities. Additionally, when compared with embedding-based vector search, the NER lookup method provides much more precise answers. In my tests, the selected articles were in the top 10 most relevant articles ranked by OpenAI’s ada algorithm, but was not the one identified as having the closest proximity to the question at hand. Therefore, it is possible an application using embedding search may not have correctly answered the question at all, and the lack of debuggability would only contribute to the confusion. And with that, we have built a question-answering application using NER lookups, improving the quality of the pipeline in the process! Conclusion Today, we built an application using function calling, an exciting new LLM feature. Miniaturized, locally-runnable function-calling models is a revolutionary development that unlocks a new class of AI applications, and we are only seeing the first iteration of these technologies. It will be exciting to see what applications developers will create with these technologies in the coming months. If you have an idea in the AI space that you want to see implemented or simply want to chat about technology, please do not hesitate to reach out on or . Github LinkedIn If you want to learn more about LLMWare, the company behind SLIMs and DRAGON, you can find them on or . HugginFace Github

Function Calling LLMs: Combining Multiple Models for Better RAG Performance

ফাংশন কলিং এলএলএম: আরও ভাল RAG পারফরম্যান্সের জন্য স্লিম এবং ড্রাগনকে একত্রিত করা

Funktionsaufruf-LLMs: Kombination von SLIMs und DRAGON für eine bessere RAG-Leistung

LLM de llamadas a funciones: combinación de SLIM y DRAGON para un mejor rendimiento de RAG

Appel de fonctions LLM : combiner SLIM et DRAGON pour de meilleures performances RAG

फंक्शन कॉलिंग एलएलएम: बेहतर आरएजी प्रदर्शन के लिए एसएलआईएम और ड्रैगन का संयोजन

関数呼び出し LLM: SLIM と DRAGON を組み合わせて RAG パフォーマンスを向上させる

함수 호출 LLM: 더 나은 RAG 성능을 위해 SLIM과 DRAGON 결합

LLMs de chamada de função: combinando SLIMs e DRAGON para melhor desempenho de RAG

Вызов функций LLM: объединение SLIM и DRAGON для повышения производительности RAG

İşlev Çağırma Yüksek Lisansı: Daha İyi RAG Performansı için SLIM'leri ve DRAGON'u Birleştirme

Gọi chức năng LLM: Kết hợp SLIM và DRAGON để có hiệu suất RAG tốt hơn

函数调用 LLM：结合 SLIM 和 DRAGON 实现更好的 RAG 性能

BETTER

better.com

-- employees

Since n.d.

COMPANY RANKING

BETTER

EVERGREEN INDEX #1647

Representing this company? Click here to claim and customize this page!

Better WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

BETTER

better.com

-- employees

Since n.d.

COMPANY RANKING

BETTER

EVERGREEN INDEX #1647

RELATED COMPANIESRANK

STORIES ABOUT BETTER

Representing this company? Click here to claim and customize this page!

Better WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!