CloudBlueis in the Business Process Management Software Industry

CloudBlue

cloudblue

The 40 Under 40 Fueling Spain's Startup Economy

40 অনূর্ধ্ব 40 স্পেনের স্টার্টআপ অর্থনীতিতে জ্বালানি দিচ্ছে

Die 40 unter 40 treiben Spaniens Startup-Wirtschaft voran

Los 40 menores de 40 que impulsan la economía de las startups en España

Les 40 de moins de 40 ans alimentent l'économie des startups espagnoles

40 अंडर 40 स्पेन की स्टार्टअप अर्थव्यवस्था को बढ़ावा दे रहा है

スペインのスタートアップ経済を支える40歳未満の40人

스페인의 스타트업 경제를 촉진하는 40세 미만 40세

Os 40 abaixo dos 40 impulsionam a economia das startups na Espanha

40 Yaş Altı 40, İspanya'nın Startup Ekonomisini Güçlendiriyor

Nhóm 40 Under 40 thúc đẩy nền kinh tế khởi nghiệp của Tây Ban Nha

40 位 40 岁以下的人士推动了西班牙的创业经济

Symfony is without doubts one of the most PHP frameworks. It has amazing flexibility and is written in an applaudable modular fashion. Some Symfony components even other prominent frameworks like Laravel. Running Symfony is a bit tricky at times, especially the of the cache and logs folder, this blog post demystifies running the Symfony in a docker container and hosting it serverless on . popular power permissions Demo App Google Cloud Run Prerequisites You have done at least one project with Symfony (of course you are comfortable with PHP and composer) You have a good working knowledge of git and Github Know a fair bit of , maybe even multi-stage build docker Have a working Google cloud account (they give you free for 1 yr, no reasons not to have an account) $300 credit This post is not going to be a detailed one like the last one about . If you are fairly new Git or Docker, please do read the above-mentioned post thoroughly. Laravel on Google Cloud Run Steps Before going to the steps, the repo is hosted on my and it is open-source of course. It might look insanely easy but we will go through some details after the steps. So let’s get started now: Github 1. Go to the repo Navigate to the open-source repo. That is a very easy step, isn’t it? :) Github Repo with Dockerized Symfony Demo App 2. Click on the Google Cloud button Then click on the Run on Google Cloud blue button, as shown below: Click on the button 3. Choose correct settings on Google cloud CLI After that, given you are logged into your Google account and have Google cloud setup with 1 or more projects, click Proceed. You might need to wait a bit, after that Choose the project — Choose a project to deploy this application Choose the region — Choose a region to deploy this application, I usually choose us-central-1 Then wait for the container to be built and deployed, you can see my process below: Deploying Symfony Demo app with Google Cloud shell script If everything goes fine on your Google Cloud Shell, you will see HTTPs URL you can go to in order to see your Symfony demo app running like below: Symfony Demo app running on Google Cloud Run One issue with this setup is that data will not be saved if you click around and add new posts. This happens because the data is saved in the SQLite file, as it is not persisted new containers get the old file and you get the same data pushed in the repo. So what just happened? There are some things you need to consider for this automagic deployment of the Symfony App. Let’s look at what just happened above: The Symfony Demo app has been dockerized, have a look at this and the too. The Dockerfile uses multistage build, on stage to install dependencies with composer and another one with Apache to run the application. Dockerfile Apache config If you want to run it locally, just run docker-compose up then go to http://localhost:8080. is the required port needed for Google Cloud Run. 8080 Thanks to the and the Cloud Shell script that does the automagic deployment. Google Cloud Run button To make the most out of this tutorial, you can fork the , add your own button then explore more with it. repo Conclusion Running Symfony entails some tricky configuration :) so the Dockerized version is a breeze to run. I really believe that Google Cloud Run is a superior product if you know how to dockerize your web app and run it on port 8080 you can get amazing scalability with unparallel ease to make it run. I would recommend Cloud Run for any pet project or even production application. Read more at https://geshan.com.np

How To Run Symfony On Google Cloud Run With The Demo App [Step-by-Step Guide]

There’s no doubt: DevOps and the sheer scale of the software it enables have truly revolutionized the world of software development. Evolving from humble single-server beginnings two decades ago, it’s finally reached the point where we can build elastic software at scale, thanks to cloud and orchestration layers such as IaaS, containers, Kubernetes, and serverless (FaaS). New developments create new challenges. As developers try to keep pace with the ever-increasing complexity, speed, and scale of their software, they are realizing that are the new bottleneck, still stuck working with the same development and debug tools from a simpler age. they A torrent of new challenges The most beloved characteristics of modern software, and those which make it so powerful — scale, speed, extreme modularity, and high distribution — are also the qualities that make developing and maintaining it so difficult. These new challenges can be roughly divided into three categories or levels: , , and . complexity connectivity development These categories are closely related; often challenges in one category are solved by translating the problem to the next level up. This ‘challenge flow’ isn’t a straightforward vertical waterfall but is rather best envisioned as a cascading spiral. Just as complexity and connectivity spur development, development challenges lead to greater degrees of complexity, and so forth. Complexity challenges Complexity challenges are a direct result of software solutions tackling more complex problems, making them the most obvious set of challenges. They include: Developing distributed modular systems (aka microservices), which requires engineers to take time to plan how to break down, deploy and connect software. Developing scalable software. Engineers must consider what scale the solution will need to support. (What ever happened to “this server supports up to X users?”) Handling data complexity in transit and at rest (usually coupled with “big data”). Modern software requires engineers to plan for extreme cases of throughput (high traffic, workloads), fast processing (real-time), storage, and search. What used to be a unique skill-set just a few years ago is now expected of every full-stack engineer (“You know Hadoop / Redis / Mongo / Kafka… right?”), raising the bar of most software projects. Saving your data as a .csv file or even a local SQL database is rarely an option anymore. The skillset developers require to address these challenges is constantly growing, along with the time and energy that they need just to get started — to understand the problem space and assess how the available tools can be optimally applied . Often when complexity issues become too great to manage, the problem escalates to become a next-level challenge, with complexity encapsulated in a new solution or method. Adding encapsulated software solutions such as databases, memcache, message-queues and ML engines in effect “delegates” the problem to be solved by the way we weave and orchestrate the overall solution. Once a specific pattern of complexity-to-connectivity escalation starts to be repeated frequently, it usually translates into a new standard development method or solution. connectivity Connectivity challenges Connectivity challenges result from the way modern software is woven together. There are at least three parallel connectivity chains: — connectivity within the software solution, such as the connections between microservices or modules Interconnectivity — connectivity with other software solutions including 3rd party servers, SDKs and SaaS External connectivity the configuration and orchestration layer used to build, deploy, and manipulate the software solution. Meta-connectivity — In even the simplest of layouts, each connectivity layer comprises dozens of elements, as well as multiple connections the layers. Just keeping track of all the connections and data flows is a huge — even sisyphean — management and architectural effort. between Now, consider that connections constantly change due to changing needs or as part of the architecture itself, as for load-balancing. Systems quickly reach a point where developers must invest many hours — even weeks in some cases — to understand what connects to what in the software solution they are working on. The days of are long gone. “That box is connected to that box, and that’s the wire connecting them” We’ve already listed plenty of ‘frosting’ on the connectivity ‘cake’, but let’s not forget the cherry on top: Engineers are expected not only to understand all aspects of connectivity but to design, build, monitor and maintain them so that the overall solution is secure and meets all required standards. This is mind-bogglingly difficult when even the smallest defect in the smallest element can bring the entire house down. It’s like saying to the engineers, ” security and compliance. “You know that huge haystack you’re trying to pile up? Make sure all those pieces of hay connect just right, and while you’re at it, check for needles, too. As time progresses (both within projects and in general) connectivity layouts grows beyond the ability of the human mind to keep track of, developers turn to the meta-connectivity layer, and try to automate and orchestrate connectivity (e.g. Puppet/Chef/Ansible, Kubernetes, Istio, Helm…). “You like code, right? So, here’s more code to orchestrate your code while you are writing code”. When this modus operandi, often described as ‘configuration as code’ approaches maturity it transfers to the next level of challenges — And elevates the resolution of each challenge to a software solution in its own right. development. Development challenges Development challenges are the classic pains involved in producing functional software within a framework. These emerge from the growing gap between the power of modern software and developers’ ability (or lack thereof) to keep pace with it. Moreover, since all the challenges from the previous levels gradually propagate to this one, the challenges here are at the bleeding-edge of the dev/devops experience. These include: Dev environment challenges Dev environment challenges require developers to assemble, learn, and manage all tools and workflows chosen for the software solution being developed: The sheer number of tools and methodologies is overwhelming and still rising, even after the huge growth of the past decade, to name just a few: IDEs, source-controls, compilers, transpilers, DBA tools, cloud consoles, development servers, debuggers, orchestrators, monitoring agents, task / ticket management, alerting solutions. Context switching makes matters worse. This ungodly pile of tools doesn’t hit developers just once, but continues to bombard them. Developers must always be ready to deal with a different situation. ( “It was raining Git commits yesterday but today I’ve been waiting for hours for it to start snowing containers… Oh wait, it’s actually going to be a typhoon of tickets with a chance of tracing.”) Today, for developers, “getting into the zone” is no longer a matter of efficiency; it’s essential for basic productivity. And that’s before we complicate the stack with AI, quantum-computing, bio-computing, and other miracles. (“If you think multithreaded programming is hard, I have some bad news for you…”) Replicating bugs Often the first step toward understanding a bug is observing it. The most basic approach to observation is replication of the bug in a controlled (usually local) environment. Sadly, with modern software, replication has become a herculean feat. The many challenges and factors mentioned above interact to create cases so complex and interconnected that any attempt to simulate them is doomed to fail, or break the budget trying. ( “We think the issue was a result of rain in Spain, and a butterfly beating its wings… Alright, so let’s start by building a life-size model of Spain, and I’ll check Amazon for bulk butterfly shipments.”) As in vitro bug replication becomes less of an option, in vivo observability becomes a must. Unfortunately, developers often discover that their ancient toolbox is ill-equipped for the task. The old tools simply don’t work in modern software environments; the reason usually comes down to loss of access. You can’t access the ephemeral: multiple layers of encapsulation, the result of translating complexity challenges into connectivity, have made access an issue, as layers like containers, Kubernetes, and serverless take ownership of the software environment. The issue is clearest for serverless / FaaS. Not only do developers lack access to the server, but as far as they are concerned there no server. Even if by some trick or hack one gains access to an underlying server through all the layers, it’s practically impossible to pinpoint a specific server/app since these fluctuate, controlled by orchestration layers, which constantly remove and add servers on the fly. is Bringing an SSH knife to a K8S gunfight: with access lost, existing tools have become obsolete. SSH, which provided an all powerful direct command-line console, has become unusable in most cases and is at best, a huge stability risk. Traditional debuggers (in contrast to Rapid Production Debuggers) have nothing to attach More significantly, the idea of breaking (setting a breakpoint) on a server in production is unacceptably risky, since it is likely to literally BREAK production or at best, knock microservices and functions out of sync, removing any chance of replicating or debugging substantial issues in a distributed system. to. IDEs used to represent a developer’s full view of the system from code through compiling to building and running. They enabled developers to sync their views and approaches to software they share. IDEs were never very close to live systems, but the gap between them has grown so great that they can no longer create shared views. While integration to modern source control (e.g. Git) and CI/CD solutions helps, the gap is still large. The CI/CD bottleneck With access lost and few alternatives, if any, developers have turned to deploying code as the main way to achieve access. Any need to interact with software translates to writing more code, merging it, testing it, approving and of course, finally deploying it. This approach is leveraged for adding/removing features, getting observability (monitoring and investigating), and applying fixes and patches. This overwhelming dependency on code deployment creates a bottleneck as all these deployments fight for space in the pipeline and the attention of those who maintain it. As the flow of challenges continues spiraling onwards, it gathers momentum. Today’s torrent is but a taste of the challenges the future holds. Once these challenges of modern software development are brought into focus, a clear picture emerges of a huge gap between the power of modern software and developers’ ability to keep pace with it. We see this most often in development challenges but in the other challenge levels as well. Bridging that gap is a key capability we require from modern dev and devops tools. observability gap A bridge over troubled waters Currently, only a handful of solutions is available to developers who face these challenges. Most developer tools have remained stagnant for years. . That said, the modern developer toolbox have some new solutions. These include solutions designed to enable greater focus, solutions that attempt to do more with the limited available data, and solutions that try to bridge the observability gap by improving on the deployment cycle. An engineer from 20 years ago would be completely baffled by modern servers in the cloud, but would recognize a current IDE or debugger in seconds does “Like a glove” — Tailored observability views With many modern software challenges starting to repeat and consolidate into known forms and formats (such as Docker, K8S, Serverless functions) a new breed of tools has emerged that identifies these patterns, and leverages their knowability to tailor specific solutions. Within this category are next-generation APM solutions such as , which provide views built specifically for on top of existing APM offering. In fact, you’ll find that most APMs adjust and provide capabilities for the microservices world, although not always as first-class citizens. DataDog Containers and Kubernetes In an even more modern tailored approach, we find solutions doubling down on structured data and specifically , such as (alongside open source projects such as and ). These identify the specific pain of reconstructing a distributed system behaviour, much as a detective reconstructs a crime scene, and arise from the very nature of microservice architectures. Tracing HoneyComb.io Zipkin Jager For Serverless, we find solutions like and , which are tailored specifically to the FaaS use case and target specific pain points such as discovery, management, and pricing. These issues, of course, were present before, but became more acute with Serverless. Epsagon Lumigo “Deus Ex Machina” — Advanced analysis With software grown big, big data is not only a challenge, but also a means of tackling the problem. Multiple solutions harness the strengths of machine-learning to attain observability, and some use it as a primary approach. Examples include solutions like and . Coralogix Anodot “Developers of the world, unite!” — Advanced workflows Harnessing machines to solve machine problems is a start, but it isn’t a silver bullet. As a result, many solutions focus on building a better developer workflow on top of the views and alerts provided by the automated part of the solution. is one great example and specifically with their recent release of Sentry 9, they improve the cooperative workflow on top of the existing exception management platform. Sentry.io “Getting a taste of the real stuff” — Canary deployments Most solutions reviewed here so far, and most solutions in the devops space in general, work by deriving value from data that exists in the system, or that can be collected in advance by focusing on a specific pattern (such as tracing). While a significant step forward, these still leave us highly dependent on the CI/CD channel to iterate by delivering new data from production by updating log lines or SDK calls that feed the systems upstream. One way to reduce pressure on the pipeline is by using , a variant on green-blue deployments. They enable developers to expose new code (in this case, the necessary observability changes) to a limited percentage of production, without affecting all of production. It also allows faster rollbacks. canary deployments Recipes for canary deployments can be found for most leading CI/CD tools such as and . GitLab CodeFresh Yet a huge gap still remains: What if the needed data isn’t within the limited canary percentage? While canary deployments reduce the friction and risk of observing production, they still leave most of it on the table, making it an expensive and risky effort that most can’t afford. “Bridging the gap with agility” — Rapid data collection Despite the many solutions above, a gap remains between the observability data developers need from live systems and the pace at which they can iterate to collect and deliver that data to their various solutions (including some listed here). A new cohort of solutions attempts to bridge this gap by completely decoupling data collection from the CI/CD pipeline and thus eliminating the friction, risks, and bottleneck that create the gap. These rapid solutions collect and drive data on demand without prior planning, creating evanescent bridges as needed, instead of trying to anticipate specific bridges for predictable cases. This ephemeral access approach, aligns with the ephemeral nature of modern software. Rapid Production Debugging solution is an example which leverages instrumentation and opcode manipulation capabilities to enable developers to collect data from live environments and pipeline it to whichever platform they need. (Full disclosure: author is a co-founder of Rookout) Rookout A glimpse into the future We’ve come a long way. Developers from the past would definitely envy the amazing accomplishments that enable modern software architectures. But when it comes to the tools we provide developers, we are not there yet. Devops has launched the world of software forward at tremendous speeds, but the from keeping pace with their own software. complexity, connectivity, and development challenges left in its wake are preventing developers Now is the time to take another leap forward by embracing the new solutions quickly and actively working to bridge the observability gap. and more. In the not-too-distant future we can reach a point where the pace of software evolution is matched by software observability, creating a feedback loop that endlessly increases the speed of creation. A future where no one is left behind. By more effectively connecting tools to one another, creating better workflows on top of them, and finding true agility in data collection and observability, we can bridge the gap About Or Weis: Or Weis is CEO and co-founder of , a Rapid debugging and observability solution for live systems. Rookout Rookout sets non-breaking breakpoints that collect any data you want and deliver it on the fly wherever you need it, when you need it. All without writing more code, re-deploying or restarting.

Is DevOps leaving developers behind?

for whom the bell tolls. I originally wrote this 2016 but given the WSJ discussion on then I thought it was worth repeating but with the snark dial turned all the way up to 11. Remember the old adage of “go away or I’ll replace you with a small Perl script” … well, maybe we might just get to enact our threat on the . post in April “World’s Largest Hedge Fund Is Building an Algorithmic Model From its Employees’ Brains” “robots” On machine intelligence I frequently read articles about how machine intelligence and robotics will replace basic roles in society, they will become the new drivers, the new waiters, the new hospital porters and nurses of this world. But is this likely? And if they are going to replace jobs then whose job are they most suited to? With questions like this I tend to look through three lenses — ability, cost and acceptability. Does it have the ability to do a better job at a reasonable cost and would we accept it? For example, let us take the idea of a waiter. Certainly there’s some mileage in terms of a marketing gimmick to begin with but humans are surprisingly good at taking orders, delivering food and cleaning up tables. Humans are also relatively cheap compared to the current cost of machine intelligence and robotics to replace them and in general though we might be able to trust a robot to deliver our food, would the banter be the same and would it be as socially acceptable to customers? Beyond the gimmick, I doubt this change will happen for quite a long time. However, there are other groups where ability, cost and acceptability are far more positive for replacement. One possible candidate is that of the CEO. The CEO? Of a company? Surely not? Well, I think so. Lets go through the reasons. Ability From my experience, most CEOs tend to demonstrate poor situational awareness and an inability to decipher doctrine from context specific play. My own work in 2012, which examined situational awareness versus action for 160+ Silicon Valley companies showed that those with high levels of situational awareness performed better. But this was Silicon Valley, it was supposed to be at the cutting edge and even here there were large companies operating with poor situational awareness of their environment and suffering for it. Going beyond Silicon Valley and boardrooms started to feel more akin to alchemy, gut feel and whatever is popular in the HBR than to chess playing masters. Situational awareness appeared to be the exception and not the rule. So rather than being a Darwinian competition of survival of the fittest where all conquering CEOs battle each other in a game of wits, there’s another less charitable way of looking at this — survival of the least hazardous. It’s governed by the same rules but rather than a positive chess like game of survival, it’s more random with the occasional hero characters. A bit like the games like world of warcraft where most run around shouting “I’m lost” and one player saves the team. An awful lot boils down to luck. Surely, this can’t be the case? Alas various studies have questioned the impacts of CEOs e.g. Markus Fitza’s study demonstrated that the measurable . brawl of new players in fantasy role playing CEO effect on firm performance varies little from chance Given that situational awareness can be improved, that doctrine and context specific play can be learned and we’ve seen first hand the experience of companies failing to understand basic lessons and (e.g. cloud) then we have to ask whether this is just inertia, blindness or caused by some other motivation? CEOs are not daft people but then neither are fund managers and the of financial indices. From my experience, this is an area where machine intelligence might vastly improve on the performance of the incumbent executives along with the industry of management consultants that often “ ” them. being disrupted by highly predictable change vast majority were outperformed by simple trackers supports Cost The other upside of replacing the CEO with machine intelligence is cost. Unlike your average waiter, CEOs aren’t cheap — they tend to be very expensive. Now, whilst Marissa Mayer’s performance at CEO of Yahoo has not been bad (despite what many think, the company has at least maintained its revenue), the question becomes whether this has been worth the speculated . It doesn’t actually matter how much the figure is, we simply know it’ll be a lot more than a waiter expects. In general, there’s a lot more money on the table replacing the CEO than there is your average worker. $365 million for 5 years of work Acceptability. But CEOs lead us! You wouldn’t trust a robot! Well, that’s probably the idea in the hallowed walls of executive thinking and business schools. But on the shop-floor we’re already becoming used to machines taking life and death decisions for us in areas such as driving cars. Most people tend to be motivated by their own autonomy, the ability to gain mastery, purpose (as in direction) and financial rewards. Using (e.g. ) then it should be possible for most companies to create such an environment. I’d argue a machine intelligence could manage this just as easily as a human. cell based structures, maps, fitness functions and other tools the pioneer, settler and town planner structure which AirBnB discussed A machine could direct a cell of human pioneers to go do what they are good at by exploring an uncertain area to see what is found. Equally, at the other extreme a machine is just as capable of telling a cell of human town planners to look at industrialising something and it is even more likely to take rational decisions without inertia and sentimental motivation or concerns over political capital due to past investments. Also, a machine is perfectly capable of learning the basic economic patterns that apply to an environment. The failures of past technology giants in cloud computing were executive failures and human error against highly predictable changes. It wasn’t lack of skilled engineers on the shop-floor. Back in 2008, at Canonical (Ubuntu) we exploited the predictable changes of cloud computing in order to take the company from a . Ubuntu has maintained that position ever since. Had we been up against machines rather than human executives then I’m not sure we could have got away with it and we certainly couldn’t have used inertia against others. I somehow doubt people will have a problem with a machine intelligence being the CEO if it leads to more stability and more security along with enhancements to their own autonomy and mastery. Given these conditions I suspect many on the shop-floor would happily cheer for our robot overlords — small fraction of the market to 70% of all cloud in around 18 months “hey, are you’re still running with that old Cyberdyne systems CEO? We’ve just installed the new HAL 9000, it comes with better stock performance and added EQ with moral imperative subroutines. Everyone is really happy.” Except of course, there’s one group that might not cheer — those desiring to be CEO and those who are the CEO. Actually, there’s another group which are the management consultants that thrive off them. Executives tend to be very busy people trying to deal with complex and complicated environments. They are always looking for quick answers and there’s an entire industry ready to the latest magic solution. Just look at the stuff that pervades our industry from Myers Briggs Personality Tests to (as reported in the HBR). Could we not do better? Would a machine care about earlobes? Unfortunately, such groups voting for robotic CEOs would be like turkeys voting for Christmas. If such a change was to happen then it would have to be through testing first in startups and then activist investors. Which, by the way, is why that . sell how earlobes can signify leadership potential WSJ article is so fascinating Given all the roles that could be replaced then on a basis of ability, cost and acceptability then the average CEO seems as good if not a far better bet than your average waiter. There are always exceptions to rules but it’s certainly worth thinking about. In my view it’s not the blue collar workers that need to be immediately worried about robots / machine intelligence but instead the white collar workers who think they’re not the target. Originally published at blog.gardeviance.org on December 22, 2016.

The robots are coming …

Software development goes through six main stages, otherwise known as the software development lifecycle. They are planning, design, development, testing, deployment, and maintenance. After development, the next phase involving quality assurance and testing is crucial to the success of the software. Proper QA testing identifies redundancies, inconsistencies, bugs, and defects in a newly developed product. Without this process, there’s no way to find out the ability of the product to survive in the real world and to work as intended for many years. Still, there have been instances when developers have either ignored this step or done it poorly for reasons such as cutting costs or beating a deadline. They have chosen to go straight to deployment, with grave consequences. For example, the Nest Learning Thermostat by Google that drained the device’s battery. As a result, people who had installed the device in their houses were unable to heat them. Nest declared that the issue was in the firmware update, incompatible boilers, and older air filters and released a new update that solved the issue for its 99.95% of affected users. experienced a software bug Another case is that of Cloudflare. In 2017, the web security company , dubbed Cloudbleed, that led to the leakage of sensitive personal information such as authentication tokens, passwords, private messages, and cookies from customers’ sites. Though the most severe issues were cleared up in hours, it took six days for the company to completely repair the bug. However, it is suspected that the breach could have started five months before. suffered a major software bug These two cases show that poor/ inadequate software testing is not only costly and time-consuming in the long run but also can damage a company’s reputation among customers. But before you decide to do QA and testing, let’s have a look at the difference between manual and automation QA. Key Differences Between Manual and Automation Testing Software testing is a broad aspect that can be categorized into two types. These are manual testing and automated testing. Manual testing, as the name suggests, is done by hand. The testers act as the end-users of the product and check that all the features and functionalities are working as intended before the software is released. As the testers check for defects manually, they don’t need to know how to use testing tools. On the other hand, the testers are expected to report on any discrepancies or errors for the developers to be able to fix them. Automation testing uses a set of testing tools or a pre-scripted framework to perform tests. It compares the collected results to the expected behavior of the product and creates a report. Automation eliminates the need for a manual tester, especially in a regression test. Projects That Can Do with Manual QA Only Manual QA works best for projects that require cognitive and behavioral capabilities during the testing of the software. The issues that can be tested include: The functionality of an app User interface Site and application activity Features User acceptance User experience. These are the projects that can do with the manual type of testing only. Consequently, manual QA should be exclusively used in the following cases: : Domain professionals predominantly implement it. They conduct their tests by examining the functionalities of a particular app without possessing the proper knowledge of the requirements. Exploratory testing : It is used for gauging if an app is user-friendly or comfortable for the end-user. Determining whether the end-user can comprehend and operate the application is the principal purpose of this testing. Usability testing : It is whereby testers try out an app at random without complying with any testing techniques or specifications in relevant documents. Ad-hoc testing is often conducted when the testers` knowledge regarding the subject app is excellent. Ad-hoc testing Projects That Only Need Test Automation to Succeed Sometimes, it is test automation that should be applied to achieve the best results. Automation testing is ideal for assessing things such as: Object information Function library Test data source Various reusable models. What are the cases in which this type of testing will work better than a manual one? Let`s observe these scenarios: Regression testing: It refers to the subsequent examination of a program that has been tested before and then modified accordingly. The purpose is to identify any problems that have come up due to the modifications or any other reason. Regular code changes make automated testing necessary in this case to ensure that regressions are run on time. Load testing: The goal of this process is to confirm whether the subject app can manage the projected number of transactions and gauge its behavior during peak and off-peak periods. Performance testing: It is used for understanding issues like the speed, scalability, and stability of a particular application. Final Thoughts To conclude, it is essential to appreciate that there is a QA talent shortage across the planet. Luckily, by leveraging QA R&D outsourcing solutions, companies can address the issue of scarce local talent by hiring offshore QA specialists. Things get even better since this model of cooperation is cost-effective. The reason is it often takes advantage of the disparity in salaries between the involved countries. Are you wondering about where to hire QA talent? Contact us for QA team outsourcing!

Automation Testing Versus Manual Testing Guidelines

A few weeks ago I decided to scratch an itch I’ve been having for a while — to participate in some bug bounty programs. Perhaps the most daunting task of the bug bounty game is to pick a program which yields the highest return on investment. Soon though, I stumbled upon a web application that executes user-submitted code in a sandbox. This looked interesting so I decided to pursue it. Python Let me out of this god-forsaken sandbox! After a bit of poking around, I discovered how to break out of the sandbox with some hacks at the Python layer. Report filed. Bugs fixed, and a nice reward to boot, all within a couple days. Sweet! A great start to my bug bounty adventures. But this post isn’t about that report. All in all, the issues I discovered are not that interesting from a technical perspective. And it turns out the issues were only present because of a regression. But I wasn’t convinced that securing a Python sandbox would be so easy. Without going into too much detail, the sandbox uses a combination of OS-level isolation and a locked-down Python interpreter. The Python environment uses a custom whitelisting/blacklisting scheme to prevent access to unblessed builtins, modules, functions, etc. The OS-based isolation offers some extra protection, but it is antiquated by today’s standards. Breaking out of the locked-down Python interpreter is not a 100% win, but it puts the attacker dangerously close to being able to compromise the entire system. So I returned to the application and prodded some more. No luck. This is indeed a tough cookie. But then I had a thought — Python modules are often just thin wrappers of mountainous C codebases. Surely there are gaggles of memory corruption vulns waiting to be found. Exploiting a memory corruption bug would let me break out of the restricted Python environment. Where to begin? I know the set of Python modules which are whitelisted for importation within the sandbox. Perhaps I should run a distributed network of AFL fuzzers? Or a symbolic execution engine? Or maybe I should scan them with a state of the art static analysis tool? Sure, I could have done any of those things. Or I could have just queried the some bug trackers. Turns out I did not have this hindsight when beginning the hunt, but it did not matter much. My intuition led me to discovering an exploitable memory corruption vulnerability in one of the sandboxes’ whitelisted modules via manual code review and testing. The bug is in Numpy, a foundational library for scientific computing — the core of many popular packages, including scipy and pandas. To get a rough idea of Numpy’s potential as a source of memory corruption bugs, let’ check out the lines-of-code counts. In the remainder of this post, I first describe the conditions which lead to the vulnerability. Next, I discuss some quirks of the CPython runtime which exploit developers should be aware of, and then I walk through the actual exploit. Finally, I wrap up with thoughts on quantifying the risk of memory corruption issues in Python applications. The Vulnerability The vulnerability which I am going to walk through is an integer overflow bug in Numpy v1.11.0 (and probably older versions). The issue has been fixed since v1.12.0, but there was no advisory issued. security The vulnerability resides in the API for resizing Numpy’s multidimensional array-like objects, and friends. is called with a tuple defining the array’s , where each element of the tuple is the size of a dimension. ndarray resize shape Sidenote: Yup, the array is leaking uninitialized memory, but we won’t be focusing on that in this post. Under the covers, actually 's a buffer, with the size calculated as the product of each element in the shape tuple and the element size. So in the prior snippet of code, boils down to C code . The next code snippet is the heavily paraphrased implementation of in C. resize realloc arr.resize((2, 3)) realloc(buffer, 2 * 3 * sizeof(int32)) resize Spot the vulnerability? You can see inside the for-loop (line 13) that each dimension is multiplied to produce the new size. Later on (line 25) the product of the new size and the element size is passed as the size to memory which holds the array. There is some validation on the new size prior to , but it does not check for integer overflow, meaning that very large dimensions can result in an array which is allocated with insufficient size. realloc realloc Ultimately, this gives the attacker a powerful exploit primitive: the ability to read or write arbitrary memory by indexing from an array with overflown size. Let’s develop a quick proof of concept that proves the bug exists. Quirks of the CPython runtime Before we walk through developing the exploit, I would like to discuss some ways in which the CPython runtime eases exploitation, but also ways in which it can frustrate the exploit developer. Feel free to skip this section if you want to dive straight into the exploit. Leaking memory addresses Typically one of the first hurdles exploits must deal with is to defeat address-space layout randomization (ASLR). Fortunately for attackers, Python makes this easy. The builtin function returns the memory address of an object, or more precisely the address of the structure which encapsulates the object. id PyObject In real-world applications, developers should make sure not to expose to users. In a sandboxed, environment there is not much you could do about this behavior, except perhaps blacklisting or re-implementing to return a hash. id(object) id id Understand memory allocation behavior Understanding your allocator is critical for writing exploits. Python has different allocation strategies based on object type and size. Let’s check out where our big string , little string , and numpy array landed. 0xa52cd0 0x7ffff7f65848 0x7ffff7e777b0 Python object structure Leaking and corrupting Python object metadata can be quite powerful, so it’s useful to understand how Python objects are represented. Under the covers, Python objects all derive from , a structure which contains a reference count and a descriptor of the object’s actual type. Of note, the type descriptor contains many fields, including function pointers which could be useful to read or overwrite. PyObject Let’s inspect the small string we created in the section just prior. Shellcode like it’s 1999 The library serves as a bridge between Python and C code. It provides C compatible data types, and allows calling functions in DLLs or shared libraries. Many modules which have C bindings or require calling into shared libraries require importing ctypes. ctypes I noticed that importing ctypes results in the mapping of a 4K-sized memory region set with read/write/execute permissions. If it wasn’t already obvious, this means that attackers do not even need to write a ROP chain. Exploiting a bug is as simple as pointing the instruction pointer at your shellcode, granted you have already located the RWX region. Test it for yourself! Investigating further, I discovered that is for ing the RWX region. However, the region cannot be allocated RWX on certain platforms, such as systems with selinux enforced or PAX mprotect enabled, and there is code which works around this limitation. libffi’s closure API responsible mmap I did not spend much time trying to reliably locate the RWX mapping, but in theory it should be possible if you have an arbitrary-read exploit primitive. While ASLR is applied to libraries, the dynamic linker maps the regions of the library in a predictable order. A library’s regions include its globals which are private to the library and the code itself. Libffi stores a reference to the RWX region as a global. If for example you find a pointer to a libffi function on the heap, then you could precalculate the address of the RWX-region pointer as an offset from the address of the libffi function pointer. The offset would need to be adjusted for each library version. De facto exploit mitigations I tested out security-related compiler flags for the Python2.7 binary on Ubuntu 14.04.5 and 16.04.1. There are a couple of weaknesses which are quite useful for the attacker: Partial RELRO: The executable’s , which contains pointers to library functions dynamically linked into the binary, is writable. Exploits could replace the address of with for example. GOT section printf() system() No PIE: The binary is not a Position-Independent Executable, meaning that while the kernel applies ASLR to most memory mappings, the contents of the binary itself are mapped to static addresses. Since the GOT section is part of the binary, no PIE makes it easier for attackers to locate and write to the GOT. Road blocks While CPython is an environment full of tools for the exploit developer, there are forces which broke many of my exploit attempts and were difficult to debug. The garbage collector, type system, and possibly other unknown forces will break your exploit if you aren’t careful about clobbering object metadata. can be unreliable. For reasons I could not determine, Python appears sometimes to pass a copy of the object while the the original object is used . id() The region where objects are allocated is somewhat unpredictable. For reasons I could not determine, certain coding patterns led to buffers being allocated in the heap, while other patterns led to allocation in a python-specific ‘d heap. brk mmap The exploit Soon after discovering the numpy integer overflow, I submitted a report to the bug bounty with a proof of concept that hijacked the instruction pointer, but did not inject any code. When I initially submitted I did not realize that the PoC was actually pretty unreliable, and I wasn’t able to test it properly against their servers because validating hijack of the instruction pointer requires access to core dumps or a debugger. The vendor acknowledged the issue’s legitimacy, but they gave a less generous reward than for my first report. Fair enough! I’m not really an exploit developer, but I challenged myself to do better. After much trial and error, I eventually wrote an exploit which appears to be reliable. Unfortunately I was never able to test it in the vendor’s sandbox because they updated numpy before I could finish, but it does work when testing locally in a Python interpreter. At a high level, the exploit gains an arbitrary read/write exploit primitive by overflowing the size of a numpy array. The primitive is used to write the address of to 's GOT/PLT entry. Finally, Python’s builtin calls under the covers, so now you can call to get a shell, or replace /bin/sh with any command. system fwrite print fwrite print '/bin/sh' There is a bit more to it than the high-level explanation, so check out the exploit in full below. I recommend to begin reading from the bottom-up, including comments. If you are using a different version of Python, adjust the GOT locations for and before you run it. fwrite system Running the exploit gives you a “hacked” shell. Quantifying the risk It is well known that much of Python’s core and many third-party modules are thin wrappers of C code. Perhaps less recognized is the fact that memory corruption bugs are reported in popular Python modules all the time without so much as a CVE, a security advisory, or even a mention of security fixes in release notes. So yes, there are a lot of memory corruption bugs in Python modules. Surely not all of them are exploitable, but you have to start somewhere. To reason about the risk posed by memory corruption bugs, I find it helpful to frame the conversation in terms of two discrete use-cases: regular Python applications, and sandboxing untrusted code. Regular applications The types of applications we’re concerned with are those having a meaningful attack surface. Think web applications and other network-facing services, client applications which process untrusted content, privileged system services, etc. Many of these applications import Python modules built against mountains of C code from projects which do not treat their memory corruption bugs as security issues. The pure thought of this may keep some security professionals up at night, but in reality the risk is typically downplayed or ignored. I suspect there are a few reasons: The difficulty to remotely identify and exploit memory corruption issues is quite high, especially for closed-source and remote applications. The likelihood that an application exposes a path for untrusted input to reach a vulnerable function is probably quite low. Awareness is low because memory corruption bugs in Python modules are not typically tracked as security issues. So fair enough, the likelihood of getting compromised due to a buffer overflow in some random Python module is probably quite low. But then again, memory corruption flaws can be extremely damaging when they do happen. Sometimes it doesn’t even take anyone to explicitly exploit them to cause harm (re: cloudbleed). To make matters worse, it’s nigh impossible to keep libraries patched when library maintainers do not think about memory corruption issues in terms of security. If you develop a major Python application, I suggest you at least take an inventory of the Python modules being used. Try to find out how much C code your modules are reliant upon, and analyze the potential for exposure of native code to the edge of your application. Sandboxing There are a number of services out there that allow users to run untrusted Python code within a sandbox. OS-level sandboxing features, such as linux namespaces and seccomp, have only become popular relatively recently in the form of Docker, LXC, etc. Weaker sandboxing techniques can unfortunately still be found in use today — at the OS layer in the form of chroot jails, or worse, sandboxing can be done entirely in Python (see and ). pypy-sandbox pysandbox Memory corruption bugs completely break sandboxing which is not enforced by the OS. The ability to execute a subset of Python code makes exploitation far more feasible than in regular applications. Even pypy-sandbox, which claims to be secure because of its two-process model which virtualizes system calls, can be broken by a buffer overflow. If you want to run untrusted code of any kind, invest the effort in building a secure OS and network architecture to sandbox it.

Escaping a Python sandbox with a memory corruption bug

When mathematics and programing go apart Source: https://www.youtube.com/watch?v=884dnOYOb68 In the world that routinely shifts towards complete dependence on scientific computing, even a trivial mistake can have fatal consequences (check the yesterday’s headlines about ) Although I cannot give you precise statistics, quite likely >90% of errors are caused by us, humans. The issue, I want to write about, is far more frightening than a spontaneous or overlooked typo. Cloudbleed . Scientific computing and high impact factor journals are plagued with misuse and confusion between log(x) with ln(x)! Why should anybody bother about some obscure logarithmic operations? The established, mathematical definition: log(10) = 2.302585093 (…) The widespread definition used in physics, chemistry and derivative life-sciences: log(10) = 1 ln(10) = 2.302585093 (…) Take these numbers, multiply them by some ridiculously large integer (let’s say 10000000000000) and compare. The numerical difference between these two could easily translate into an incorrect trajectory for Space-X Falcon 9 rocket, abnormal termination of Instrument Landing System for any commercial airliner attempting CAT-3 autolanding, Tesla Model-X mistakenly speeding up and performing obstacle avoidance maneuver leading to accident, and countless other tasks, which rely on numerical optimization and intricate workings of embedded logarithmic operations. The computation of logarithm is at the very heart of potentially every problem that concerns computational physics, our dearly beloved , and all the possible permutations of numerical optimization. in silico machine learning The observed misuse of and is simply and by code developers and scientific writers. log(x) ln(x) INSTITUTIONALIZED AMPLIFIED Just to be clear here! The problem exists and it becomes by new generations of . On my side: I am not willing to play a “blame game”. perpetuated scientific programmers I have routinely observed in my students (still at University of Groningen), snippets of Python code with confused use of base-10 and natural logarithms. I observe the same problem in the code by my scientific collaborators. A quick review of research papers (from high impact peer reviewed journals, including ) on protein electrostatics from past 20 years, clearly demonstrates issues with proper use of ln(x). This coincides perfectly with the emergence of scientific computing, and a dominant place log(x) has as a representation of natural logarithm in all standard math libraries. PNAS I have made countless log(x) vs ln(x) mistakes . myself Looking for discrepancies in protein electrostatics calculation code How is the problem perpetuated? Simply by symbolical use of log(x), which performs ln(x) according to its mathematical definition. That’s how the “obvious” thing becomes “not so obvious” mistake, which in turn may have quite bizarre numerical consequences. I have attached below the snippets of documentation from different programing languages, which are widely used in scientific computing. : NumPy v1.12 documentation numpy.log( [, ]) x out = <ufunc ‘log’> Natural logarithm, element-wise. Matlab documentation : Syntax Y = log(X) Description example returns the natural logarithm ln(x) of each element in array . [Y](https://it.mathworks.com/help/matlab/ref/log.html?requestedDomain=www.mathworks.com#outputarg_Y) = log([X](https://it.mathworks.com/help/matlab/ref/log.html?requestedDomain=www.mathworks.com#inputarg_X)) X Mathematica documentation: [ ] gives the natural logarithm of (logarithm to base) Log z z C documentation (Tutorials point): Description The C library function returns the natural logarithm (base-e logarithm) of . double log(double x) x The ISO80000–2 way of dealing with it: ln(x) for natural logarithm lg(x) for base-10 logarithm What can we do about the log(x) vs ln(x) confusion? Enforce thorough reading of documentation on our students, collaborators and peers (wishful thinking). Simply introduce ln(x) and log(x) so mathematics,programing and life sciences go in concert together! development Follow the guidelines disclosed in ISO8000–2 standard http://www4.ncsu.edu/~jwilson/files/mathsigns.pdf Disclaimer: This post has been edited to address the comments and correct the issues pointed out in https://news.ycombinator.com/item?id=13731301#13732928 Useful post? If so, make my day by clicking the heart below! About the Author is the founder and the architect of . You can connect with him on , , , and . Kamil Tamiola Peptone — The Protein Intelligence Company AngelList LinkedIn Twitter Researchgate

log(x) vs ln(x) — The curse of scientific computing

Cloud computing was once at the forefront of emerging data center technology. But now, it’s the backbone of digital businesses worldwide. “The cloud” is no longer just a corporate buzzword — it powers everything from mobile apps to billion-dollar enterprises. And it’s not done growing yet! Visionary leaders like Obinna Odirionye, CEO and creator of Clouddley, believe it will define the next generation of technologies like artificial intelligence, machine learning, and the Internet of Things. However, cloud computing also has inherent complexities that can hinder innovation. To combat this, Obinna is improving accessibility and simplicity in cloud technologies, making these tools available to more people than ever before. Cloud Computing: Powerful Tech with a High Barrier to Entry Setting up and maintaining cloud infrastructure can be quite a chore. You must have a firm understanding of networking, security protocols, resource optimization, and many other complicated concepts. Even feature-rich cloud platforms like AWS don’t exactly make it easy for a relative beginner to launch a cloud app. This means there’s a steep barrier for small companies and startups that could greatly benefit from cloud computing but lack the resources to hire trained professionals. But this is one area where these businesses can’t afford to fall behind. 85% of organizations are expected to take a cloud-first approach by 2025. 95% of all new digital workloads are predicted to be deployed on cloud-native platforms by then as well. This means even small businesses must leverage cloud technologies if they hope to keep up with the competition. That’s why Obinna aims to democratize the cloud, empowering organizations big and small to use the cloud in simple but powerful ways. Simplifying the Cloud — the Clouddley Way Ever since he was a teenager, Obinna was fascinated with “The Cloud.” As he developed his tech skills and learned the ins and outs of cloud computing, he only came to love it more. Now, he calls the cloud “the heart of the internet.” After starting his career as a DevOps engineer for Deimos, a cloud developer and security operations company, Obinna noticed how complicated cloud platforms have become. He realized just how many talents a developer has to have in order to create a smooth cloud experience, and he also learned how many ways cloud computing can go wrong. But rather than accept it as the status quo, Obinna decided to do something about it. Enter Clouddley. Clouddley is Obinna’s baby, the new kid on the block. It’s a reimagining of the cloud, a simple, cost-effective approach that any organization can use to develop robust cloud apps with a fraction of the complexity. All you have to do is connect Clouddley to your GitHub account, configure your app, and then deploy it. So, instead of having to worry about load balancing, IAM roles, policies, etc., you can let Clouddley handle it all, allowing you to focus on the code and shipping a successful product. The latest iteration of Clouddley includes a product called Triggr, a continuous deployment platform. Like the base Clouddley platform, it’s designed to simplify a developer’s work — by auto-detecting your programming language and framework, deploying to the server/VM of your choice without you having to lift a finger, it dramatically expedites the deployment workflow. As you can see, Clouddley vastly eliminates many of the complexities that come with cloud computing. It makes the process straightforward, allowing you to deploy an app without needing extensive cloud training. It’s the culmination of Obinna’s dream: democratizing the cloud and making the heart of the internet accessible to everyone. A Cloudy Future Never Looked So Bright Despite achieving his goal of simplifying the cloud, Obinna isn’t done. He’s already hard at work with version 2 of Clouddley, which aims to give users even more flexibility in how they deploy their apps. In this version, Triggr users will be able to easily add team members, deploy databases on the fly in seconds, and run LLMs like Llama 2 and Mixtral 8x22b on top of their virtual machines with OpenAI-compatible endpoints provided by Clouddley Triggr to chat with these models. After that, Obinna has plans for a Heroku alternative that vastly simplifies containerized app development. Like the Clouddley platform as a whole, his goal for the project is to reduce the barrier to entry when running a production-managed app. Despite Clouddley’s impressive capabilities, Obinna insists on offering these top-flight solutions at a fraction of what he could realistically sell them for. In his words, “If you can afford a Starbucks coffee, you can use the Clouddley platform.” As cloud computing continues to evolve, leaders like Obinna will be at the forefront. By making cloud development more accessible, Obinna is empowering a more diverse group of developers and entrepreneurs to create and implement innovative cloud-based solutions. He’s paving the way for this next generation of developers — innovators who will enjoy a more inclusive and user-friendly cloud computing environment. This story was distributed by Jon Stojan Media under HackerNoon’s Brand As An Author Program. Learn more about the program here: https://business.hackernoon.com/brand-as-author Cloud computing was once at the forefront of emerging data center technology. But now, it’s the backbone of digital businesses worldwide. “The cloud” is no longer just a corporate buzzword — it powers everything from mobile apps to billion-dollar enterprises. And it’s not done growing yet! Visionary leaders like Obinna Odirionye, CEO and creator of Clouddley, believe it will define the next generation of technologies like artificial intelligence, machine learning, and the Internet of Things. However, cloud computing also has inherent complexities that can hinder innovation. To combat this, Obinna is improving accessibility and simplicity in cloud technologies, making these tools available to more people than ever before. Cloud Computing: Powerful Tech with a High Barrier to Entry Setting up and maintaining cloud infrastructure can be quite a chore. You must have a firm understanding of networking, security protocols, resource optimization, and many other complicated concepts. Even feature-rich cloud platforms like AWS don’t exactly make it easy for a relative beginner to launch a cloud app. This means there’s a steep barrier for small companies and startups that could greatly benefit from cloud computing but lack the resources to hire trained professionals. But this is one area where these businesses can’t afford to fall behind. 85% of organizations are expected to take a cloud-first approach by 2025 . 95% of all new digital workloads are predicted to be deployed on cloud-native platforms by then as well. This means even small businesses must leverage cloud technologies if they hope to keep up with the competition. 85% of organizations are expected to take a cloud-first approach by 2025 85% of organizations are expected to take a cloud-first approach by 2025 That’s why Obinna aims to democratize the cloud, empowering organizations big and small to use the cloud in simple but powerful ways. Simplifying the Cloud — the Clouddley Way Ever since he was a teenager, Obinna was fascinated with “The Cloud.” As he developed his tech skills and learned the ins and outs of cloud computing, he only came to love it more. Now, he calls the cloud “the heart of the internet.” Obinna Obinna After starting his career as a DevOps engineer for Deimos, a cloud developer and security operations company, Obinna noticed how complicated cloud platforms have become. He realized just how many talents a developer has to have in order to create a smooth cloud experience, and he also learned how many ways cloud computing can go wrong. But rather than accept it as the status quo, Obinna decided to do something about it. Enter Clouddley . Clouddley Clouddley Clouddley is Obinna’s baby, the new kid on the block. It’s a reimagining of the cloud, a simple, cost-effective approach that any organization can use to develop robust cloud apps with a fraction of the complexity. All you have to do is connect Clouddley to your GitHub account, configure your app, and then deploy it. So, instead of having to worry about load balancing, IAM roles, policies, etc., you can let Clouddley handle it all, allowing you to focus on the code and shipping a successful product. The latest iteration of Clouddley includes a product called Triggr , a continuous deployment platform. Like the base Clouddley platform, it’s designed to simplify a developer’s work — by auto-detecting your programming language and framework, deploying to the server/VM of your choice without you having to lift a finger, it dramatically expedites the deployment workflow. Triggr Triggr As you can see, Clouddley vastly eliminates many of the complexities that come with cloud computing. It makes the process straightforward, allowing you to deploy an app without needing extensive cloud training. It’s the culmination of Obinna’s dream: democratizing the cloud and making the heart of the internet accessible to everyone. A Cloudy Future Never Looked So Bright A Cloudy Future Never Looked So Bright Despite achieving his goal of simplifying the cloud, Obinna isn’t done. He’s already hard at work with version 2 of Clouddley, which aims to give users even more flexibility in how they deploy their apps. In this version, Triggr users will be able to easily add team members, deploy databases on the fly in seconds, and run LLMs like Llama 2 and Mixtral 8x22b on top of their virtual machines with OpenAI-compatible endpoints provided by Clouddley Triggr to chat with these models. Clouddley Triggr Clouddley Triggr After that, Obinna has plans for a Heroku alternative that vastly simplifies containerized app development. Like the Clouddley platform as a whole, his goal for the project is to reduce the barrier to entry when running a production-managed app. Despite Clouddley’s impressive capabilities, Obinna insists on offering these top-flight solutions at a fraction of what he could realistically sell them for. In his words, “If you can afford a Starbucks coffee, you can use the Clouddley platform.” As cloud computing continues to evolve, leaders like Obinna will be at the forefront. By making cloud development more accessible, Obinna is empowering a more diverse group of developers and entrepreneurs to create and implement innovative cloud-based solutions. He’s paving the way for this next generation of developers — innovators who will enjoy a more inclusive and user-friendly cloud computing environment. This story was distributed by Jon Stojan Media under HackerNoon’s Brand As An Author Program. Learn more about the program here: https://business.hackernoon.com/brand-as-author This story was distributed by Jon Stojan Media under HackerNoon’s Brand As An Author Program. Learn more about the program here: https://business.hackernoon.com/brand-as-author This story was distributed by Jon Stojan Media under HackerNoon’s Brand As An Author Program. Learn more about the program here: https://business.hackernoon.com/brand-as-author https://business.hackernoon.com/brand-as-author

Obinna Odirionye: How This Founder Is Reimagining Cloud Computing in 2024

This paper is under CC BY-SA 4.0 DEED license. available on arxiv Authors: (1) Juan Mera Men´endez; (2) Martin Bartlett. Table of Links Abstract and Introduction Initial Application Performance Tests Best Practices and Techniques Combinations Discussion Related Work Conclusion and References VIII. CONCLUSION Performance is an aspect that should always be taken into account when creating Lambda functions, especially if you plan to combine them with Java. Once the performance improvements offered by these approaches for using Java with AWS Lambda have been quantified. It is evident that Java can be used competitively with AWS Lambda without the need to resort to runtimes like Node.js or Python (which usually report better performance). Having tested various combinations of proposed strategies and demonstrated that the performance is similar to what can be achieved with the use of GraalVM, we recommend avoiding its usage. We consider it essential to profile the Java functions to select the optimal memory configuration and using AWS SDK v2. From there, optionally, the next step is to the rest of the techniques to achieve one of the proposed combinations. Additionally, following the general best practices such as initializing connections outside the handler or reduce the bundle size, among others, also contribute to optimizing Java functions. The optimization strategies we propose are not the only ones available, there are many other techniques that can similarly yield excellent results. It is important to highlight that the process of optimizing a function is linear in terms of difficulty. In other words, it’s relatively easy to obtain a significant improvement, but if you want to squeeze out the maximum performance, the process requires trial and error and greater effort. It’s also important to highlight that the percentage of improvement offered by each approach depends on the specific use case in which they are applied. This percentage can vary, either increasing or decreasing. REFERENCES [1] H. Puripunpinyo and M. Samadzadeh, “Effect of optimizing java deployment artifacts on aws lambda,” in 2017 IEEE Conference on Computer Communications Workshops (INFOCOMWKSHPS), 2017, pp. 438–443. DOI: 10.1109/INFCOMW.2017.8116416. [2] D. Bardsley, L. Ryan, and J. Howard, “Serverless performance and optimization strategies,” in 2018 IEEE International Conference on Smart Cloud (SmartCloud), 2018, pp. 19–26. DOI: 10.1109/SmartCloud.2018.00012. [3] D. Jackson and G. Clynch, “An investigation of the impact of language runtime on the performance and cost of serverless functions,” in 2018 IEEE/ACM International Conference on Utility and Cloud Computing Companion (UCC Companion), 2018, pp. 154–160. DOI: 10.1109/UCC-Companion.2018.00050. [4] O. Hosseini Mehrshad Sahragard, “Aws lambda language performance,” 2019. [Online]. Available: https://gupea.ub.gu.se/handle/2077/62454. [5] A. L. Dowd, “Performance of java in function-as-a-service computing,” University of Texas Libraries, 2020. [Online]. Available: https://repositories.lib.utexas.edu/handle/2152/84357. [6] S. O’Toole, “Aws lambda java tutorial: Reducing cold starts,” 2020. [Online]. Available: https://www.capitalone.com/tech/cloud/aws-lambda-java-tutorial-reduce-cold-starts/v=1694091771423. [7] D. Quaresma, D. Fireman, and T. E. Pereira, “Controlling garbage collection and request admission to improve performance of faas applications,” in 2020 IEEE 32nd International Symposium on Computer Architecture and High Performance Computing (SBAC-PAD), 2020, pp. 175–182. DOI: 10.1109/SBAC-PAD49847.2020.00033. [8] M. Sipek, D. Muharemagi´c, B. Mihaljevi´c, and ˇ A. Radovan, “Enhancing performance of cloudbased software applications with graalvm and quarkus,” in 2020 43rd International Convention on Information, Communication and Electronic Technology (MIPRO), 2020, pp. 1746–1751. DOI: 10.23919/MIPRO48935.2020.9245290. [9] Q. I. S. Hassan B. Hassan Saman A. Barakat, “Survey on serverless computing,” Journal of Cloud Computing, 2021. [10] C. D. Ron Mosquera Bryan Alexander y Villegas Armijos, “Mejora del rendimiento de aplicaciones serverless basadas en la nube con graalvm y quarkus,” 2022. [11] StackOverflow, “Developer survey 2022,” 2022. [Online]. Available: https://survey.stackoverflow.co/2022/. [12] Q. Wu and L. K. John, “Performance of java in function-as-a-service computing,” in 2022 IEEE/ACM 15th International Conference on Utility and Cloud Computing (UCC), 2022, pp. 261– 266. DOI: 10.1109/UCC56403.2022.00047. [13] Datdog, “The state of serverless,” datadog, 2023. [Online]. Available: https://www.datadoghq.com/state-of-serverless/. [14] AWS, “Best practices to work with aws lambda functions,” [Online]. Available: https://docs.aws.amazon.com/es es/lambda/latest/dg/best-practices.html. [15] AWS, “Developer guide - aws sdk for java 2.x,” [Online]. Available: https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/home.html. [16] AWS, “Improving startup performance with lambda snapstart,” [Online]. Available: https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html. [17] AWS, “Java lambda functions customization settings,” [Online]. Available: https://docs.aws.amazon.com/lambda/latest/dg/java-customization.html. [18] AWS, “Lambda instruction set architectures (arm/x86),” [Online]. Available: https://docs.aws.amazon.com/es es/lambda/latest/dg/foundation-arch.html. [19] AWS, “Profiling functions with aws lambda power tuning,” [Online]. Available: https://docs.aws.amazon.com/lambda/latest/operatorguide/p [20] G. org, “Graalvm overview,” [Online]. Available: https://www.graalvm.org/latest/docs/introduction/. [21] A. Stefano Buliani, “Best practices for aws lambda and java,” [Online]. Available: https://d1.awsstatic.com/events/reinvent/2019/REPEAT 1 B

Performance Best Practices Using Java and AWS Lambda: Conclusion and References

This paper is under CC 4.0 license. available on arxiv Authors: (1) Hatem A. Alharbi, CSchool of Electronic and Electrical Engineering, University of Leeds, LS2 9JT, United Kingdom; (2) Taisir E.H. Elgorashi, School of Electronic and Electrical Engineering, University of Leeds, LS2 9JT, United Kingdom; (3) Jaafar M.H. Elmirghani, School of Electronic and Electrical Engineering, University of Leeds, LS2 9JT, United Kingdom. Table of Links Abstract & Introduction Related Works Repealing Net Neutrality Profit-Driven Model Results Conclusions & References Biographies IV. PROFIT-DRIVEN MODEL RESULTS: In this section, we evaluate the increase in ISP profit and the reduction in network traffic and subsequently power consumption resulting from the optimized pricing scheme under the repeal of net neutrality. We define the three services classes as follows; • Class A; for UHD video service; 18 Mbps download rate. • Class B; for HD video service; 7.2 Mbps download rate. • Class C; for SD video service; 2 Mbps download rate. We investigate CP’s end users’ choices of service classes based on different PED. We show how users behavior under the different PED; 0.2, 0.4, 0.6, 0.8, 1 or 2 affects the equilibrium price of each class the ISP charges the CP for delivering its content. As discussed above, we assume that the CP will transfer the price increase to their customers at the same rate (if the CP absorbs some of the increase in prices, then this may represent a different PED). As a benchmark, we consider users to be distributed among classes according to the Cisco forecast report [45], where UHD, HD, and SD users distribution are 19%, 56% and 25% respectively. We consider 1.8 million users active simultaneously in the network. This figure is obtained as follows: The number of users is 44 million users in Netflix in the US and the average user spent around 1 hour per day watching movies in 2015 [46]. Therefore, the average number of users during one hour of the day is 1.8 million users, which is an average number that does not consider the popularity of different viewing times in the day. The concentration of users at any node in AT&T network is based on the population of the state where the node is located (see Fig. 2). We consider the BT network connectivity selling price as the net neutrality price of the three classes where 10 Gbps connectivity is priced at £12,600 ($15,750) per year [47], i.e. $131 per 1 Gbps link per month. The actual cost of provisioning ISP core network infrastructure is sensitive information and not usually shared by ISPs. However, we estimate the cost of provisioning 1 Gbps of network as $118 considering 10% as the ISP profit margin (the average profit margin for AT&T [2] and Comcast [48] were approximately 9% and 12%, respectively between 2013-2018). We divided the cost among the three network layers; core, metro and access network based on their power consumption percentages: 24%, 6% and 70%, respectively [49] which corresponds to $28, $7, $83, respectively. The cost of $28 per Gbps in the core network is associated with a single hop. For the AT&T architecture the average hop count between clouds and other nodes is 1. As shown in Fig. 2, we choose AT&T core network (a primary core network topology in the US) as a core network topology example. This core network consists of 25 nodes and 54 bidirectional links. AT&T hosts datacenters in nodes 1, 3, 5, 6, 8, 11, 13, 17, 19, 20, 22, and 25 [50]. These nodes are used to host datacenters to serve distributed CPs users. The input parameters used are given in Table I. In the following subsections, we evaluate two scenarios; equal PED for all classes and different PED for different classes. Under each scenario we study three scenarios of delivering CPs contents to users; a cloud-based delivery and a cloud-fog based deliver and fog-based delivery. 1) Equal PED among classes: In the following, we study three scenarios of delivering CPs contents to users; a cloud-based delivery and a cloud-fog based delivery and fog-based delivery. Figs. 3 to 5 show the profit-driven model results for AT&T core network where content is delivered from the 12 datacenters in the AT&T topology [50]. The number of users and the corresponding price of each class under different PED are illustrated in Fig. 3. The primary y-axis shows price per Gbps per month of each class in US dollar. These prices represent the equilibrium point of users’ willingness to follow the price increase which results in maximum profit for the ISP. The secondary y-axis corresponds to the percentage of users subscribed to each class. The x-axis shows different PED scenarios from 2 to 0.2. The former represents the highest sensitivity to the price change considered, whereas, the latter represents the contrary. PED values are shown along with the case of net neutrality where the price of different classes is fixed at 113$ and the percentage of users in each class follows Cisco forecast report [45] as discussed above. For each PED value we consider two cases; a case where the optimized pricing scheme should maintain 100% of the users that existed under net neutrality ( ≥ 100) and another case where the pricing scheme can result in users leaving the service ( ≥ 0). Cloud based delivery: LB LB Fig. 4 is a plot of the monthly profit of ISP considering different PED values as well as net neutrality scenario. Total traffic of core network and the power consumption due to this traffic under different PED scenarios and the net neutrality scenario are plotted in Fig. 5. In case of content with = 2, under ≥ 100 or ≥ 0 , Fig. 3 shows that repealing net neutrality has increased class C users to 48% of the total number of users compared to 14% only under the net neutrality pricing scheme. This increase is a result of some users of class B downgrading to class C as the class B price increased slightly by 18% (the number of users in class B reduced to 36%) and due to new users joining the service (the total number of users increased to 102%) attracted by the 1% decrease in class C price. The users of class A are reduced to 18% of the total number of users as a result of the slight increase in price by 19%. This pricing scheme and distribution of users have resulted in an increase in the total profit by 54% compared to the net neutrality scenario as seen in Fig. 4. For a less sensitive content with = 0.2 under ≥ 0, the equilibrium pricing scheme resulted in 28% of the users leaving the service as the increase in the classes price resulted in an increase in the profit by a factor of 8.3 compared to the net neutrality scenario. Maintaining all the users of the service ( ≥ 100) has slightly reduced the profit by 10%. PED LB LB PED LB LB In addition to growing ISP profit, we also observe in Fig. 5 a decline in the core network traffic by up to 55% under = 0.2, ≥ 0 and a consequent reduction in power consumption by 49%. This reduction in core network traffic and power consumption occurred for two reasons; 1) some cloud service users leave classes A and B to subscribe to class C as the charges per Gb/s of the classes A and B increase. 2) the total cloud service subscribers diminished due to the increase in class C price (in case of ≥ 0). PED LB LB Next, we introduce 10 fog nodes in addition to the 12 datacenter locations. These fog nodes are assumed to be built in the proximity of nodes with the highest population in the AT&T core network, so no core network cost (Ͼ) is incurred by serving the demands of these nodes. Fig. 6 shows that the prices per Gbps per month under different PED that are less than the previous case (cloud-based delivery) as we reduced the cost of the core network by introducing the fog nodes. Under = 2, the prices compared to the net neutrality case in class A and B increased by 12% and 11%, respectively, while the price of class C dropped by 1% as opposed to 19%, 18% and 1% with cloud-based delivery. The reduced prices attracted more users resulting in increase in the profit by 18% compared to the net neutrality case as seen in Fig. 7 as opposed to a 54% increase in profit with cloud-based delivery. Fig. 8 shows a reduction in core network traffic (40%) and power consumption (35%) by repealing net neutrality in the cloud-fog architecture. Cloud-Fog based delivery: PED Here, we consider a scenario in which all users access CP contents from a local fog node. Although deploying a fog node locally, to serve CP customers, increases the capital expenditure (CAPEX) and operating expenses (OPEX) of provisioning multiple locations (i.e. 25 fog nodes in AT&T network), it reduces the communication network transit cost burden to the minimum. However, fog nodes are not always an option due to the finite capacity of processing and storage. The results show that the prices are further reduced under fog-based delivery (Fig. 9) as no core network cost (Ͼ) is incurred by serving demands. For instance, under PED = 2, the prices compared to the net neutrality case in class A and B increased by 9% while the price of class C is decreased by 11% resulting in increase in the profit by 6% compared to the net neutrality scenario as seen in Fig. 10. Fog based delivery: 2) Different PED among classes: In this section, we consider a scenario where elasticity of demand varies among the different classes of service. We consider class C to be less sensitive to price change than class B. Also, we considered class B to be less sensitive than class A. The elasticity of demand for classes A, B and C are considered to be 2, 0.8 and 0.2, respectively. Fig. 11 shows the price per Gbps for classes A and B is the same under different scenarios and delivery schemes as a result of the high PED of class A. Class C is priced at the same level of classes A and B for ≥ 0 as the low PED of class C limits the number of users leaving the services as a result of increase in the price. Fig. 12 shows an increase in profit by up to 88%, 29% and 16% under cloudbased delivery, cloud-fog based delivery and fog-based delivery, respectively, compared to the net neutrality scenario. Fig 13 shows a decrease in core network traffic by up to 43% and 30% under cloud-based delivery and cloud-fog based delivery, respectively, compared to the net neutrality scenario. Also, the total reduction in the core network power consumption (as shown in Fig 14) is up to 40% and 32% under cloud-based delivery and cloud-fog based delivery respectively. LB

Impact of the Net Neutrality Repeal on Communication Networks: Profit-Driven Model Results

**BERLIN, Germany, March 27th, 2024/Chainwire/--**On March 13th, 2024, Casino.Guide for Canadian game-of-chance enthusiasts. That is a selection of gaming hubs licensed by international regulators, whose games get tested by third-party independent randomness verification agencies like iTech Labs, GLI, and eCOGRA. published its selection of the Internet’s highest-quality gambling platforms The number one spot on this list gets reserved for Stake.com, what many consider the world’s most famous crypto casino, licensed by Curacao Gaming. It is a remote casino/sportsbook that works with various sports franchises, like English Premiership side Everton FC, the UFC, and the Alfa Romeo F1 racing team. Stake has also made the news cycle in recent years for its , who is a massive online gambling aficionado. affiliation with Canadian musical superstar Drake Casino.Guide followed up Stake.com with Lucky Days, Cloudbet, InstaSpin, and BC.Game, completing its top five rankings with these five sites. All four of these, like Stake, operate from Curacao, accepting virtual currencies as viable payment methods while offering welcome bonuses for new users. BC.Game is also a notable interactive gaming brand that many online gamblers have gotten familiar with thanks to its affiliation/sponsorship with the Cloud9 eSports team, which has squads that compete in various video games like Counter Strike Global Offensive, League of Legends, Rocket League, Halo Infinite, StarCraft, and Overwatch. BC.Game is also the official betting partner of the Argentinian national football team. Stake is the wagering partner of the UFC. And it is of its former middleweight champion, Israel Adesanya. a long-time sponsor About Stake It comes as little surprise that Casino.Guide places Stake.com as . It debuted in 2017 and quickly established itself as a credible gaming brand. It gets operated by Medium Rare N.V., a company run by Ed Craven, the face of the Stake brand. the number one Canadian online casino In August 2022, Stake.com entered the United States through a social casino offshoot, and the company’s staff manages its operations from offices in Cyprus, Australia, and Serbia. The site itself gets renowned for its vast collection of games, advanced sportsbook page, and wide range of accepted cryptos. How Casino.Guide Rates Online Casino Sites. Casino.Guide claims that it is the go-to place for objective reviews and ratings, listing the most trustworthy gaming sites for Canadian players. It also supplies info on the latest casino streamer trends and everything anyone would want to know about crypto gambling. The site staff evaluates casinos based on their registration promos, game selections, payment options, payout timeframes, and the competence of their customer service staff. Casino.Guide specialists diligently seek to analyze these main areas and others to conclude if a specific website meets their quality control standards. If it does, they rank it accordingly, stacking it up with other crypto-centric competitors that allow Canadians to join their user pools. A Casino.Guide rating between 95% and 100% means that a platform comes highly recommended. A 94% to 90% rating gets reserved for recommended brands. An 89% to 85% rating is for passable websites, and those that fall under the 85% rating get labeled as casinos in need of improvement. There is also a Best-in-Class group, the crème de la crème of online gaming operators for Canadian remote casino lovers. Casino.Guide’s Team The Casino.Guide website got established in 2020, founded by a group of iGaming experts that total over three decades of online gambling sector experience. The pack gets headlined by Vienne Garcia, a resident of Malta, Europe’s prime iGaming hotspot. Garcia has spent much time in British Columbia, so she knows about what Canadians desire concerning gaming, and she looks to put her decade’s worth of experience to good use to cater to their needs. Christian Webber is the in-house mobile gaming expert at Casino.Guide. He looks to keep up to date with the latest developments on the smartphone gambling side of things. Christian lives in Germany and has spent almost ten years working , Austria’s land-based machine gambling juggernaut. Peter Schmidt is the final part of the Casino.Guide puzzle, supplying his unmatched knowledge of all things related to casino play over the Web. He is the chief site analyst, primarily focusing on reviewed gaming platforms. as a software tester for Novomatic Contact Teamlead Outreach Kush Sharma impulsQ GmbH ks@impulsq.de This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program here.

Casino.Guide Posts Its List Of The Best Canadian Online Casinos For March 2024

Casino.Guide মার্চ 2024 এর জন্য সেরা কানাডিয়ান অনলাইন ক্যাসিনোগুলির তালিকা পোস্ট করে

Casino.Guide veröffentlicht seine Liste der besten kanadischen Online-Casinos für März 2024

Casino.Guide publica su lista de los mejores casinos en línea canadienses para marzo de 2024

Casino.Guide publie sa liste des meilleurs casinos en ligne canadiens pour mars 2024

Casino.Guide ने मार्च 2024 के लिए सर्वश्रेष्ठ कनाडाई ऑनलाइन कैसीनो की अपनी सूची पोस्ट की

Casino.Guide が 2024 年 3 月のカナダのベストオンラインカジノのリストを掲載

Casino.Guide가 2024년 3월 최고의 캐나다 온라인 카지노 목록을 게시했습니다.

Casino.Guide publica sua lista dos melhores cassinos online canadenses para março de 2024

Casino.Guide опубликовал список лучших канадских онлайн-казино на март 2024 года

Casino.Guide Mart 2024 İçin En İyi Kanada Çevrimiçi Casinolarının Listesini Yayınladı

Casino.Guide đăng danh sách các sòng bạc trực tuyến tốt nhất ở Canada vào tháng 3 năm 2024

Casino.Guide 发布 2024 年 3 月加拿大最佳在线赌场名单

I awoke, and my first thought was, Adrian and Clara are dead.

Eventful winter passed; winter, the respite of our ills.

108 Stories To Learn About Cybersecurity Tips

After a long interval, I am again impelled by the restless spirit within me to continue my narration

THE POLE.

THE INVISIBLE GIRL.

What Is Man? and Other Essays by Mark Twain, is part of the HackerNoon Books Series. You can jump to any chapter in this book . WILLIAM DEAN HOWELLS here WILLIAM DEAN HOWELLS Is it true that the sun of a man’s mentality touches noon at forty and then begins to wane toward setting? Doctor Osler is charged with saying so. Maybe he said it, maybe he didn’t; I don’t know which it is. But if he said it, I can point him to a case which proves his rule. Proves it by being an exception to it. To this place I nominate Mr. Howells. I read his about forty years ago. I compare it with his paper on Machiavelli in a late number of , and I cannot find that his English has suffered any impairment. For forty years his English has been to me a continual delight and astonishment. In the sustained exhibition of certain great qualities—clearness, compression, verbal exactness, and unforced and seemingly unconscious felicity of phrasing—he is, in my belief, without his peer in the English-writing world. . I entrench myself behind that protecting word. There are others who exhibit those great qualities as greatly as he does, but only by intervaled distributions of rich moonlight, with stretches of veiled and dimmer landscape between; whereas Howells’s moon sails cloudless skies all night and all the nights. Venetian Days Harper sustained In the matter of verbal exactness Mr. Howells has no superior, I suppose. He seems to be almost always able to find that elusive and shifty grain of gold, the Others have to put up with approximations, more or less frequently; he has better luck. To me, the others are miners working with the gold-pan—of necessity some of the gold washes over and escapes; whereas, in my fancy, he is quicksilver raiding down a riffle—no grain of the metal stands much chance of eluding him. A powerful agent is the right word: it lights the reader’s way and makes it plain; a close approximation to it will answer, and much traveling is done in a well-enough fashion by its help, but we do not welcome it and applaud it and rejoice in it as we do when right one blazes out on us. Whenever we come upon one of those intensely right words in a book or a newspaper the resulting effect is physical as well as spiritual, and electrically prompt: it tingles exquisitely around through the walls of the mouth and tastes as tart and crisp and good as the autumn-butter that creams the sumac-berry. One has no time to examine the word and vote upon its rank and standing, the automatic recognition of its supremacy is so immediate. There is a plenty of acceptable literature which deals largely in approximations, but it may be likened to a fine landscape seen through the rain; the right word would dismiss the rain, then you would see it better. It doesn’t rain when Howells is at work. right word. the And where does he get the easy and effortless flow of his speech? and its cadenced and undulating rhythm? and its architectural felicities of construction, its graces of expression, its pemmican quality of compression, and all that? Born to him, no doubt. All in shining good order in the beginning, all extraordinary; and all just as shining, just as extraordinary today, after forty years of diligent wear and tear and use. He passed his fortieth year long and long ago; but I think his English of today—his perfect English, I wish to say—can throw down the glove before his English of that antique time and not be afraid. I will go back to the paper on Machiavelli now, and ask the reader to examine this passage from it which I append. I do not mean examine it in a bird’s-eye way; I mean search it, study it. And, of course, read it aloud. I may be wrong, still it is my conviction that one cannot get out of finely wrought literature all that is in it by reading it mutely: Mr. Dyer is rather of the opinion, first luminously suggested by Macaulay, that Machiavelli was in earnest, but must not be judged as a political moralist of our time and race would be judged. He thinks that Machiavelli was in earnest, as none but an idealist can be, and he is the first to imagine him an idealist immersed in realities, who involuntarily transmutes the events under his eye into something like the visionary issues of reverie. The Machiavelli whom he depicts does not cease to be politically a republican and socially a just man because he holds up an atrocious despot like Caesar Borgia as a mirror for rulers. What Machiavelli beheld round him in Italy was a civic disorder in which there was oppression without statecraft, and revolt without patriotism. When a miscreant like Borgia appeared upon the scene and reduced both tyrants and rebels to an apparent quiescence, he might very well seem to such a dreamer the savior of society whom a certain sort of dreamers are always looking for. Machiavelli was no less honest when he honored the diabolical force of Caesar Borgia than Carlyle was when at different times he extolled the strong man who destroys liberty in creating order. But Carlyle has only just ceased to be mistaken for a reformer, while it is still Machiavelli’s hard fate to be so trammeled in his material that his name stands for whatever is most malevolent and perfidious in human nature. You see how easy and flowing it is; how unvexed by ruggednesses, clumsinesses, broken meters; how simple and—so far as you or I can make out—unstudied; how clear, how limpid, how understandable, how unconfused by cross-currents, eddies, undertows; how seemingly unadorned, yet is all adornment, like the lily-of-the-valley; and how compressed, how compact, without a complacency-signal hung out anywhere to call attention to it. There are twenty-three lines in the quoted passage. After reading it several times aloud, one perceives that a good deal of matter is crowded into that small space. I think it is a model of compactness. When I take its materials apart and work them over and put them together in my way, I find I cannot crowd the result back into the same hole, there not being room enough. I find it a case of a woman packing a man’s trunk: he can get the things out, but he can’t ever get them back again. The proffered paragraph is a just and fair sample; the rest of the article is as compact as it is; there are no waste words. The sample is just in other ways: limpid, fluent, graceful, and rhythmical as it is, it holds no superiority in these respects over the rest of the essay. Also, the choice phrasing noticeable in the sample is not lonely; there is a plenty of its kin distributed through the other paragraphs. This is claiming much when that kin must face the challenge of a phrase like the one in the middle sentence: “an idealist immersed in realities who involuntarily transmutes the events under his eye into something like the visionary issues of reverie.” With a hundred words to do it with, the literary artisan could catch that airy thought and tie it down and reduce it to a concrete condition, visible, substantial, understandable and all right, like a cabbage; but the artist does it with twenty, and the result is a flower. The quoted phrase, like a thousand others that have come from the same source, has the quality of certain scraps of verse which take hold of us and stay in our memories, we do not understand why, at first: all the words being the right words, none of them is conspicuous, and so they all seem inconspicuous, therefore we wonder what it is about them that makes their message take hold. The mossy marbles rest On the lips that he has prest In their bloom, And the names he loved to hear Have been carved for many a year On the tomb. It is like a dreamy strain of moving music, with no sharp notes in it. The words are all “right” words, and all the same size. We do not notice it at first. We get the effect, it goes straight home to us, but we do not know why. It is when the right words are conspicuous that they thunder: The glory that was Greece and the grandeur that was Rome! When I go back from Howells old to Howells young I find him arranging and clustering English words well, but not any better than now. He is not more felicitous in concreting abstractions now than he was in translating, then, the visions of the eyes of flesh into words that reproduced their forms and colors: In Venetian streets they give the fallen snow no rest. It is at once shoveled into the canals by hundreds of half-naked FACCHINI; and now in St. Mark’s Place the music of innumerable shovels smote upon my ear; and I saw the shivering legion of poverty as it engaged the elements in a struggle for the possession of the Piazza. But the snow continued to fall, and through the twilight of the descending flakes all this toil and encounter looked like that weary kind of effort in dreams, when the most determined industry seems only to renew the task. The lofty crest of the bell-tower was hidden in the folds of falling snow, and I could no longer see the golden angel upon its summit. But looked at across the Piazza, the beautiful outline of St. Mark’s Church was perfectly penciled in the air, and the shifting threads of the snowfall were woven into a spell of novel enchantment around the structure that always seemed to me too exquisite in its fantastic loveliness to be anything but the creation of magic. The tender snow had compassionated the beautiful edifice for all the wrongs of time, and so hid the stains and ugliness of decay that it looked as if just from the hand of the builder—or, better said, just from the brain of the architect. There was marvelous freshness in the colors of the mosaics in the great arches of the facade, and all that gracious harmony into which the temple rises, of marble scrolls and leafy exuberance airily supporting the statues of the saints, was a hundred times etherealized by the purity and whiteness of the drifting flakes. The snow lay lightly on the golden globes that tremble like peacocks-crests above the vast domes, and plumed them with softest white; it robed the saints in ermine; and it danced over all its works, as if exulting in its beauty—beauty which filled me with subtle, selfish yearning to keep such evanescent loveliness for the little-while-longer of my whole life, and with despair to think that even the poor lifeless shadow of it could never be fairly reflected in picture or poem. Through the wavering snowfall, the Saint Theodore upon one of the granite pillars of the Piazzetta did not show so grim as his wont is, and the winged lion on the other might have been a winged lamb, so gentle and mild he looked by the tender light of the storm. The towers of the island churches loomed faint and far away in the dimness; the sailors in the rigging of the ships that lay in the Basin wrought like phantoms among the shrouds; the gondolas stole in and out of the opaque distance more noiselessly and dreamily than ever; and a silence, almost palpable, lay upon the mutest city in the world. The spirit of Venice is there: of a city where Age and Decay, fagged with distributing damage and repulsiveness among the other cities of the planet in accordance with the policy and business of their profession, come for rest and play between seasons, and treat themselves to the luxury and relaxation of sinking the shop and inventing and squandering charms all about, instead of abolishing such as they find, as is their habit when not on vacation. In the working season they do business in Boston sometimes, and a character in takes accurate note of pathetic effects wrought by them upon the aspects of a street of once dignified and elegant homes whose occupants have moved away and left them a prey to neglect and gradual ruin and progressive degradation; a descent which reaches bottom at last, when the street becomes a roost for humble professionals of the faith-cure and fortune-telling sort. the undiscovered country What a queer, melancholy house, what a queer, melancholy street! I don’t think I was ever in a street before where quite so many professional ladies, with English surnames, preferred Madam to Mrs. on their door-plates. And the poor old place has such a desperately conscious air of going to the deuce. Every house seems to wince as you go by, and button itself up to the chin for fear you should find out it had no shirt on—so to speak. I don’t know what’s the reason, but these material tokens of a social decay afflict me terribly; a tipsy woman isn’t dreadfuler than a haggard old house, that’s once been a home, in a street like this. Mr. Howells’s pictures are not mere stiff, hard, accurate photographs; they are photographs with feeling in them, and sentiment, photographs taken in a dream, one might say. As concerns his humor, I will not try to say anything, yet I would try, if I had the words that might approximately reach up to its high place. I do not think any one else can play with humorous fancies so gracefully and delicately and deliciously as he does, nor has so many to play with, nor can come so near making them look as if they were doing the playing themselves and he was not aware that they were at it. For they are unobtrusive, and quiet in their ways, and well conducted. His is a humor which flows softly all around about and over and through the mesh of the page, pervasive, refreshing, health-giving, and makes no more show and no more noise than does the circulation of the blood. There is another thing which is contentingly noticeable in Mr. Howells’s books. That is his “stage directions”—those artifices which authors employ to throw a kind of human naturalness around a scene and a conversation, and help the reader to see the one and get at meanings in the other which might not be perceived if entrusted unexplained to the bare words of the talk. Some authors overdo the stage directions, they elaborate them quite beyond necessity; they spend so much time and take up so much room in telling us how a person said a thing and how he looked and acted when he said it that we get tired and vexed and wish he hadn’t said it at all. Other authors’ directions are brief enough, but it is seldom that the brevity contains either wit or information. Writers of this school go in rags, in the matter of stage directions; the majority of them having nothing in stock but a cigar, a laugh, a blush, and a bursting into tears. In their poverty they work these sorry things to the bone. They say: “... replied Alfred, flipping the ash from his cigar.” (This explains nothing; it only wastes space.) “... responded Richard, with a laugh.” (There was nothing to laugh about; there never is. The writer puts it in from habit—automatically; he is paying no attention to his work; or he would see that there is nothing to laugh at; often, when a remark is unusually and poignantly flat and silly, he tries to deceive the reader by enlarging the stage direction and making Richard break into “frenzies of uncontrollable laughter.” This makes the reader sad.) “... murmured Gladys, blushing.” (This poor old shop-worn blush is a tiresome thing. We get so we would rather Gladys would fall out of the book and break her neck than do it again. She is always doing it, and usually irrelevantly. Whenever it is her turn to murmur she hangs out her blush; it is the only thing she’s got. In a little while we hate her, just as we do Richard.) “... repeated Evelyn, bursting into tears.” (This kind keep a book damp all the time. They can’t say a thing without crying. They cry so much about nothing that by and by when they have something to cry ABOUT they have gone dry; they sob, and fetch nothing; we are not moved. We are only glad.) They gravel me, these stale and overworked stage directions, these carbon films that got burnt out long ago and cannot now carry any faintest thread of light. It would be well if they could be relieved from duty and flung out in the literary back yard to rot and disappear along with the discarded and forgotten “steeds” and “halidomes” and similar stage-properties once so dear to our grandfathers. But I am friendly to Mr. Howells’s stage directions; more friendly to them than to any one else’s, I think. They are done with a competent and discriminating art, and are faithful to the requirements of a stage direction’s proper and lawful office, which is to inform. Sometimes they convey a scene and its conditions so well that I believe I could see the scene and get the spirit and meaning of the accompanying dialogue if some one would read merely the stage directions to me and leave out the talk. For instance, a scene like this, from : The Undiscovered Country “... and she laid her arms with a beseeching gesture on her father’s shoulder.” “... she answered, following his gesture with a glance.” “... she said, laughing nervously.” “... she asked, turning swiftly upon him that strange, searching glance.” “... she answered, vaguely.” “... she reluctantly admitted.” “... but her voice died wearily away, and she stood looking into his face with puzzled entreaty.” Mr. Howells does not repeat his forms, and does not need to; he can invent fresh ones without limit. It is mainly the repetition over and over again, by the third-rates, of worn and commonplace and juiceless forms that makes their novels such a weariness and vexation to us, I think. We do not mind one or two deliveries of their wares, but as we turn the pages over and keep on meeting them we presently get tired of them and wish they would do other things for a change. “... replied Alfred, flipping the ash from his cigar.” “... responded Richard, with a laugh.” “... murmured Gladys, blushing.” “... repeated Evelyn, bursting into tears.” “... replied the Earl, flipping the ash from his cigar.” “... responded the undertaker, with a laugh.” “... murmured the chambermaid, blushing.” “... repeated the burglar, bursting into tears.” “... replied the conductor, flipping the ash from his cigar.” “... responded Arkwright, with a laugh.” “... murmured the chief of police, blushing.” “... repeated the house-cat, bursting into tears.” And so on and so on; till at last it ceases to excite. I always notice stage directions, because they fret me and keep me trying to get out of their way, just as the automobiles do. At first; then by and by they become monotonous and I get run over. Mr. Howells has done much work, and the spirit of it is as beautiful as the make of it. I have held him in admiration and affection so many years that I know by the number of those years that he is old now; but his heart isn’t, nor his pen; and years do not count. Let him have plenty of them; there is profit in them for us. About HackerNoon Book Series: We bring you the most important technical, scientific, and insightful public domain books. This book is part of the public domain. Mark Twain (2004). What Is Man? and Other Essays. Urbana, Illinois: Project Gutenberg. Retrieved October 2022 https://www.gutenberg.org/cache/epub/70/pg70-images.html This eBook is for the use of anyone anywhere at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this eBook or online at , located at . www.gutenberg.org https://www.gutenberg.org/policy/license.html

Stories, News & Mentions about CLOUDBLUE

Cloudblue’s Stories on HackerNoon