CONCURED is a Predictive Artificial Intelligence platform for Content Marketers

CONCURED

concured

For a number of years now, Google has been at the forefront of artificial intelligence (AI) development. Their in-house AI workshop has already made some major breakthroughs in applied AI for medicine, , and . The high-profile nature of their work has even started to overshadow what is still the company's main business: being the world's go-to search engine. DeepMind game theory speech synthesis In that arena, Google has long championed the use of AI and machine learning technology to deliver the best possible search results to users. In fact, their RankBrain platform is AI-driven and forms the core of their whole search business. In turn, that has led to some of the most tried-and-true digital marketing and SEO techniques to go right out the window, as RankBrain analyzes, scores, and ranks new content almost as fast as businesses can create it. The bottom line is that Google's search AI is leading to an internet that favors more human-friendly content than ever before, and businesses everywhere have relearnt . One of the most effective ways for them to do that is to make use of some AI-powered tools of their own – and here are three areas they should focus on. the art of balancing content and website design for the best SEO performance 1. First, Move on From Traditional SEO For years, web designers and marketers have focused on search engine optimization (SEO) as the best way to enhance search result performance. The problem is that old-school SEO tactics depended on search algorithms that remained unchanged over long periods of time. Today, ranking factors evolve on a near-constant basis, as Google's algorithm learns what users want in real-time. They're also far more reliant on context and relevance than keywords, as they were in the past. To stay ahead of the constant changes, businesses can use AI-powered content creation and optimization tools like and to plan and execute their content strategies. Doing so will help them to produce posts and pages that will score well when analyzed by Google's AI, and that will gain high search result placements. The same tools can also be used to constantly re-evaluate existing content to make sure it's still relevant and to make revisions as necessary. MarketMuse Concured 2. Go Big on Structured Data Now that AI has become the central arbiter in Google's search engine, it's tempting to design online content with an eye toward how the algorithm will see the page. In reality, though, the algorithm is trying to see the pages through human-like eyes, so designing for the machine is mostly irrelevant. There is an exception to the rule though. The exception is to make liberal use of structured data on all websites and properties. It's like adding a high-detail map for the algorithm to follow, which explains where all of the site's important information lies. Without it, businesses can only hope that Google's AI will figure things out. With it, however, they gain access to and can leapfrog the competition on every result page. Best of all, there are AI-powered solutions like that can help automate the process of creating structured data sets for existing web pages, as well as for new ones as they come online. some of Google's highest-performing search features Diffbot 3. Automate Analytics With AI One of the challenges that businesses face when dealing with AI-powered search is the sheer speed with which the landscape changes. That has made it far more important to use the best analytical tools to assess website results and performance and to do it in as close to real-time as possible. Of course, a human analyst couldn't hope to keep up, but AI-powered analytics can. New platforms like can derive critical insights from a website's Google analytics data with little to no input from a business. All it needs is access and it can start producing actionable insights in less than a minute. Best of all, the platform doesn't need any human-provided cues to know what to look for – it learns from the data itself to determine the right questions to ask. In short, it has the power to provide any business with high-end data analysis with almost no overhead, which can be a major game-changer for SMEs and startups. PaveAI Fight AI with AI Going forward, it is certain that Google is going to expand its reliance on AI and machine learning for all things search. We've already reached the point where traditional SEO is all but dead, and businesses have to turn to AI solutions of their own if they want to remain relevant in an ever-changing search environment. The tools mentioned here make for a good start, but they're likely to be just the beginning – so now is the time to adopt them and stay as far ahead of the curve as is possible. Photo credits via the contributor's Adobe Stock License by THANANIT, iLee, and Africa Studio.

3 Areas Where Businesses Should Use AI to Inform Their SEO Efforts

The recent rapid pace of development in artificial intelligence (AI) technology and data analytics has changed the ways that many of today's biggest companies do business. From Amazon's to Netflix's uncanny ability to know what users will want to watch even before they know it themselves, there's virtually no market that's been left untouched by the growth of those technologies. For startups and SMEs, however, the pace of adoption of AI and analytics has been slower than many would've hoped (except, of course, within AI-centric startups themselves). mastery of consumer preferences Some of that is due to the relative complexity of some of today's leading-edge AI and analytics solutions, but for the most part, there's a much simpler explanation: it's still really difficult to tell how the technologies fit into the operational and strategic picture for most organizations. That doesn't mean, however, that there aren't plenty of game-changing ways that small companies and startups could be leveraging AI and analytics to advance their own causes. To help make that clear, and to assist those businesses looking to make AI and data analytics a core part of their operations going forward, here's a look at three inexpensive AI and analytics solutions that SMEs and startups could be using to great effect right now. Market Research by Crayon Photo: hakinmhan / Adobe Stock For startups and SMEs, succeeding in a market means knowing what to do and exactly when to do it. To do that, however, takes a broad understanding of the market itself (whatever it may be) including every move the competition makes on a minute-to-minute basis. In the past, this required a massive investment in both time and labor and even then was more of an art than a science. Today, any business can turn the job over to an AI platform and get far better, more comprehensive results. That's just what does – it acts as a market intelligence aggregator with an AI-powered business intelligence (BI) function. The result is akin to having a full-blown in-house BI suite with a team of data experts to get the most out of it. For startups and SMEs, it can be a critical advantage that lets them beat competitors to the punch, without the expense involved in building internal BI capabilities. Crayon Digital Data Insights by Crystal Photo: Kir Smyslov / Adobe Stock It's one thing to bring sophisticated BI tools into an organization's decision making and strategic processes, but it's quite another to make them accessible enough for small, non-technical teams to make good use of them. Enter , and AI-powered digital assistant that can take existing business data and extract meaningful insights out of it. It also provides a conversational interface, which makes it a kind of Swiss Army knife for businesses with little to no existing data infrastructure. For example, users can ask Crystal simple strategic questions and get direct, evidence-based answers, such as the best time to send a marketing email, or what the biggest causes of product production slowdowns have been. Best of all, there's virtually no learning curve involved, so it's an almost plug-and-play AI solution. Crystal Content Marketing Guidance by Concured Photo: Tierney / Adobe Stock One of the best current uses for AI and data analytics by startups and SMEs is within their marketing operations. It can be used for everything from analyzing website data to conducting complex A/B testing on digital platforms. It's most valuable use, though, might be in eliminating duplicative or low-value work when it comes to content marketing strategies. That's where AI platform comes in. It lets marketers know what types of content to create to drive the highest engagement possible from prospective customers, and provides high-level ROI tracking to drive consistent results. With it, almost any startup or SME can simply learn the basics of , and then trust Concured to do the rest. Concured blogging for beginners A High-Tech Advantage Without the Price Tag Photo: sdecoret / Adobe Stock Put together, the addition of the AI and analytics tools mentioned here can make for a sophisticated data arsenal for any startup or SME. They also serve as an object lesson in the fact that there is no shortage of high-tech tools already available to the SME market. If nothing else, these tools and others can serve as a kind of onramp for organizations that are looking to become data-centric and hop aboard the AI and analytics train. With so many companies already achieving a great deal of success by doing so, it would be absurd for any business not to take advantage of them.

3 AI and Analytics Solutions Startups and SMEs Should Use Right Now

Hi, I’m Aaron Sankin, and I’m a reporter here at The Markup. Over the past year, I’ve focused on investigating and what you (other than shoot dirty looks at your modem, which doesn’t really care about your opinion). why the internet connection at your house is slow can do about it Tucked deep in the , signed by President Joe Biden in 2021, is a short provision giving the Federal Communications Commission (FCC) broad leeway to fundamentally reshape how America connects to the internet. Infrastructure Investment and Jobs Act Under a section titled “Digital Discrimination,” the legislation tasks the FCC with adopting “rules to facilitate equal access to broadband internet access service, taking into account the issues of technical and economic feasibility presented by that objective, including … preventing digital discrimination of access based on income level, race, ethnicity, color, religion, or national origin.” The section itself is short—under 400 words—and relatively light on detail, leaving it largely up to the FCC to decide how much power it wants to grab for itself to close the digital divide. Various actors have rushed into that void of legislative ambiguity, forcefully advocating for their own agendas. On one side are advocacy groups and some local governments who hope the FCC will take the opportunity to aggressively hold internet service providers (ISPs) to account for what they see as generations of inequitable broadband infrastructure deployment across the country. Some propose levying fines on ISPs guilty of discrimination or, as the agency did when it approved a merger between Charter Communications and Time Warner Cable in 2016, companies build out high-speed infrastructure in new areas. mandating On the other side are ISPs, the industry groups representing them, and ideologically aligned pro-business think tanks. They want nothing more than for the FCC to merely supplement its historic light-touch regulation of the broadband industry with generous subsidies—that make investing in high-speed internet infrastructure in marginalized communities more beneficial to the companies’ bottom lines. The crux of this fight is over a concept called “disparate impact” and whether the FCC should use it to identify whether an ISP has engaged in discrimination. The idea behind disparate impact is that discrimination isn’t always explicit. So, if an institution’s policies have created a situation where certain protected groups experience markedly worse outcomes than others, this impact matters just as much as any intentionally biased practices. For example: A company’s CEO decides that people should always physically look up to their managers, so only people over 6 feet, 3 inches get promoted to managerial roles. As a result, the management staff is entirely male, since men tend to be taller on average. Did the company engage in gender discrimination? Under a disparate impact standard, yes. But, under a standard where intent prevails, this discrimination is a lot harder to prove, because the rules that resulted in a management team where everyone can dunk said nary a peep about gender. “From my point of view, disparate impact is really just discrimination through the back door,” said John Yinger, a professor of economics and public administration at Syracuse University, who has disparate impact and wrote a about discrimination in mortgage lending. studied book “If you have a system that doesn’t recognize and address disparate impact, you allow people to, either on purpose [or] by accident, engage in a lot of discrimination.” The problem, Yinger noted, is that to assess disparate impact, the first step is determining which allocation of a certain scarce set of resources—be it broadband access or corporate promotions—is fair, and then determine if different groups’ receipt of that resource violates that standard of fairness. Intentions Matter, or Do They? Consider an we published last year showing how a quartet of ISPs consistently gave the worst deals for internet service to households in low-income, less-White, and historically redlined neighborhoods in major cities across the country. investigation When we were reporting that story, we certainly were curious these disparities existed, but that was less important than the fact that we could prove they existed in the first place. why why Last year, when we reached out to CenturyLink, one of the companies we found consistently charging high prices for sluggish service in marginalized areas, spokesperson Mark Molzen insisted at the time that the company was committed to anti-racism. “While we can’t comment on behalf of other providers, we can say we do not enable services based on any consideration of race or ethnicity, and the methodology used for the report on our network is deeply flawed.” Molzen never pointed to any specific inaccuracies in our data collection or analysis. The “flaw” he identified was in an inference the company read into the story about its motives. Our October 2022 investigation showed absolutely zero evidence that CenturyLink had partitioned cities into geographic areas based on race and used that to determine where to deploy high-speed internet infrastructure. And, honestly, it would be pretty wild if it actually had. Nevertheless, we found that CenturyLink offered addresses in the least-White parts of Des Moines, Iowa, slow-speed internet service 19 percentage points more frequently than the Whitest parts of the city—and all for the same price. In Las Vegas, Nev., that gap was 31 percentage points. In Omaha, Neb., 33 percentage points. A comment within a June 2022 FCC with Lumen, CenturyLink’s parent company, mentioned the company’s expectations “to deploy fiber to approximately one million new locations in 2022 and around 1.5 to 2 million new locations in 2023.” digital discrimination proceeding However, there wasn’t any specificity regarding how many of these new fiber deployments would go to low-income or predominantly non-White areas. When it comes to the FCC’s responsibility, the question is whether the FCC will look at the levels of access that different racial, ethnic, and socioeconomic groups have to affordable, blazing-fast internet, find substantial inequality, and then do something about it. Or, as the telecom industry would prefer, will the agency only intervene after finding direct evidence of an ISP making inequitable decisions about where to deploy infrastructure explicitly based on characteristics like race or ethnicity? “ ” In Some Circumstances, It Can Be Profitable The legal theory behind disparate impact goes back to , a 1971 Supreme Court case about how a company required all employees to pass a pair of intelligence tests if they wanted to move into higher-paying roles. Black people were far less likely to pass those tests, which were unrelated to the jobs’ responsibilities. Griggs v. Duke Power Co. The court ruled that these tests—which the company just so happened to implement on the very day the 1964 Civil Rights Act—prohibited race-based employment discrimination, and were illegal due to the effect they had on Black employees’ career advancement. The use of disparate impact to identify discrimination grew in the ensuing decades and was finally into law in 1991. “Because individual motives may be difficult to prove directly, Congress has frequently permitted proof of only discriminatory impact as a means of overcoming discriminatory practices,” reads a U.S. Department of Justice on the subject. codified manual “The Supreme Court has, therefore, recognized that disparate impact liability under various civil rights laws ‘permits plaintiffs to counteract unconscious prejudices and disguised animus that escape easy classification as disparate treatment.’ ” During the administration of President Donald Trump, who famously settled a in the 1970s over his family’s real estate company’s practice of not renting properties to Black tenants, the Department of Housing and Urban Development dramatically the government’s ability to use disparate impact, but the rules were shortly after President Biden took office. lawsuit weakened reinstated While disparate impact has been used by the government to regulate employment and housing, it hasn’t yet been used to assess the role ISPs are playing in the digital divide. As a result, when the FCC went about implementing the digital discrimination rules mandated by Congress, the agency specifically that the public weigh in on whether the standard should be used and, if so, how. requested The responses the agency received on the issue largely fell into two categories. The telecom industry argued in favor of using as a metric, which holds that discrimination occurs when people are explicitly divided up by a protected category (like race) and then treated worse as a result. Digital inclusion advocacy groups argued that is the only feasible metric. disparate treatment disparate impact “Rational, profit-seeking actors will discriminate because, in some circumstances, it can be profitable to do so. Whether this is intentional or not is beside the point,” argued the National Digital Inclusion Alliance and Common Sense Media, two nonprofit advocacy groups, in one . comment “The point … is that discrimination occurs and will continue to occur unless providers’ incentives are changed.” The groups’ comment urges the FCC to look for disparate impact in a plethora of ISP practices ranging from the prices customers are charged for a service, and under what contract terms, to the actual speeds different areas receive and how companies prioritize network maintenance. “For decades, the disability community has noted that discrimination occurs unintentionally and often results from seemingly neutral policies,” the American Association of People with Disabilities in another comment. concurred “Too often, disabled people experience discrimination not because of malicious intent or explicit exclusion within programs or policies but because the disabled people were simply not considered in the first place.” The Greenlining Institute, a California-based nonprofit that for digital inclusion efforts, insisted in its that applying disparate impact to broadband would be consistent with how it has been used across the government for decades. advocates comment “Adoption of the disparate impact standard in the wake of the Civil Rights Act of 1964 allowed for a whole-of-government approach that targeted discrimination in public goods such as education and housing,” Greenlining asserted. “It would be consistent to apply this similar treatment to digital public infrastructure and services such as broadband internet.” The tenor of comments from folks who might theoretically be held accountable if their actions were found to have treated some communities worse than others was, unsurprisingly, markedly different. A primary industry worry is that requiring ISPs to constantly weigh equity concerns may dissuade them from deploying new infrastructure widely in the first place. “Adopting a disparate impact test would cause carriers to choose between prioritizing deployment based on closing the digital divide, as required by Congress, and paralyzing deployment for fear that a regular, common business decision may disproportionately affect a minority community,” asserted the Lincoln Network, a free market think tank, in its . comment Another industry argument is that Congress didn’t really mean for the FCC to use disparate impact to identify “discrimination of access based on income level, race, ethnicity, color, religion, or national origin.” Verizon, for example, that the phrase “based on” in the legislation specifically means that discrimination has to be a direct result of company decisions made because of protected demographic characteristics of a particular area. asserted For its part, AT&T asserted in its that, even if a disparate impact standard were applied, the broadband industry wouldn’t be found to have delivered less connectivity to historically marginalized areas. comment While there have been localized studies showing inequitable deployment in places like , , , and , the company said that the only way to accurately assess deployment would be to look at a comprehensive, national picture of everywhere every single ISP offers service. Cleveland Dallas Oakland Los Angeles AT&T to an analysis from former FCC chief economist Glenn Woroch that showed that “broadband availability rates for census-based ‘non-white’ households are higher than for white households and that availability rates for households above and below the poverty line are nearly identical.” pointed Woroch’s research relies on data from a broadband availability map produced by the FCC that is supposed to show what service ISPs offer across the country. While a footnote in Woroch’s comment insists his data source doesn’t skew the results, that map has been for inaccuracies, and a 2020 Princeton found that “the FCC’s data disproportionately overstates coverage in rural and minority communities.” widely criticized study The FCC released a last year designed to rectify those issues, but that map has its own set of and is still effectively in its beta testing phase. As a result, obtaining data accurate enough to meet the standards pushed for by AT&T remains a tall order. new map profound accuracy problems The battle over the FCC’s potential use of disparate impact hasn’t been limited to the public comment process. In a recent , The Wall Street Journal’s historically laissez-faire editorial board used the specter of disparate impact to lobby against Public Knowledge’s co-founder Gigi Sohn, whom Biden unsuccessfully nominated to lead the agency, but withdrew following telecom industry opposition. op-ed “Public Knowledge, the outfit that Ms. Sohn co-founded and led from 2001 to 2013, has urged the FCC to interpret its regulatory mandate broadly to micromanage broadband competition and development,” the editorial charged. Now would be the time to mention that The Markup does, in fact, have a pack of dogs in this fight. Our newsroom is based on the idea that if you evaluate the inputs and outputs of a big, complex technical system, you can identify serious problems in how it treats different groups without having to know the precise intentions of the people who developed it. The technology does not yet exist to do a regression controlling for the vagaries of the human heart. In March, Markup reporter and freelance data journalist used data analysis to determine that an algorithm for deciding which patients got life-saving liver transplants people in a handful of states, almost all of which were in the South and Midwest. The day after that story was published, the Department of Health and Human Services major reforms to that very system. Malena Carollo Ben Tanen systematically disadvantaged announced One thing I’m working on—along with my colleague, investigative data reporter —is a step-by-step guide showing everyday people how they can evaluate whether ISPs have left a digital divide in their towns. It should be dropping sometime in the next few weeks. Leon Yin We’re hoping that if people use the guide and find something interesting, they can tell the FCC about it. And, who knows, depending on how this disparate impact proceeding goes, maybe the agency will even do something about it. Sincerely, Aaron Sankin Investigative Reporter The Markup By Aaron Sankin Also published here Photo by on Annie Spratt Unsplash

Disparate Impact: Who's Afraid of It?

অসম প্রভাব: কে এটা ভয় পায়?

Unterschiedliche Auswirkungen: Wer hat Angst davor?

Impacto dispar: ¿quién le teme?

Impacts disparates : qui en a peur ?

असमान प्रभाव: इससे कौन डरता है?

異質な影響: 誰がそれを恐れるでしょうか?

이질적인 영향: 누가 그것을 두려워하는가?

Impacto díspar: quem tem medo disso?

Несопоставимое воздействие: кто этого боится?

Farklı Etki: Kim Korkar?

Tác động khác nhau: Ai sợ nó?

不同的影响：谁害怕它？

The morning began as it always did. Blanket aside, sleepy gait, morning ritual, and the usual way to work. Even if the place of work is the desk in the next room. Every successful coach screams about fighting this system. But in fact, you don't need to fight it. It's enough to understand how it works and use it to your benefit. That's what neurohacking is all about. Dopamine mining in the 21st century: inflation Huxley's Brave New World is a super-concentrated utopia in which sources of quick gratification have possessed people. A button come off? Buy a new piece. Food, sex, entertainment - everything is calibrated and available. Even social elevators are predetermined from birth and literally written into your genocode. But let's move away from fiction and look at reality. In it, cyberpsychology and society are closely intertwined into a single structure that generates myths, supports them, and brings them to life. Dopamine swing The whole marketing industry is swinging a huge pendulum of neurohormones. At its highest point is dopamine. And at its lowest point, corticoliberin. It is the fear hormone, and slogans press it: "offer is limited", "the goods are running out", "discount for the first 10 buyers": The fear of being inferior to others hits our nerves because the loss of social status is comparable to death. If a major official/banker/top manager loses his position, the probability of his suicide increases many times over. It seems to us that work remains the only lifeline, without which we will be doomed to die in misery. Technological advances have spawned a synthesis of psychological mechanisms with advances in cybernetics. Today, cyberpsychology understands how to engage a person in absorbing material. How to create an interest that spurs one to watch a new series, go through another rink, or spend hours watching ten-second videos of cats and songs. Millions of years of starvation still outweigh 200 years of conventional satiety. Calories have become more dangerous than lead bullets. We're like primitive humans opening fire. Only we're not just warming ourselves by the fire. The problem is that the fire has become too much, and we are literally burning alive. Even though modern life is safe enough, the body refuses to accept it. Any lunge towards our safety or any threat to our social status is met with hostility. And the brain starts looking for solutions. Marketers present them on a silver platter. Speed is the main adversary We want to solve problems quickly. We also want achievements to stay with us for a long time. But what exactly they should look like, we have no idea. To be more precise, we stopped having about since childhood. Back then, we knew exactly the charm of the very stick, an unusual stone, or could wander for hours among a few trees while our brains drew incredible pictures of grandeur and adventure. But now we look up to seeming authorities who are slightly different from us. Authoritarians who broadcast the same things from every screen: Only true professionals use this smartphone. The super camera, the incredible processor, the screen with the number of colors your eye can't distinguish anyway. But this device becomes obsolete after a year, and you must make your next purchase to get back on track. Want to be fashionable? Here are the expensive brands. Here are ready-to-wear collections. Here are the dressed mannequins. Just take the same and enjoy! You don't need to tell everyone you are rich and fashion-savvy. Just wear the things we've already prepared for you. Have you heard of such a thing as constant self-development? We already spend a third of our lives sleeping! Don't waste time being bored. Boredom and procrastination are a virus worse than COVID-19. Here's a new series, a new movie, a new game. Give your brain a chance to solve interesting puzzles and sit down to work afterward. Develop your cultural experience. Play games, pumping up your game character. Just for your own sake, don't fall into laziness. Otherwise, unnecessary thoughts will start popping up in your head. Add to this shopping on the Internet, delivery services, social networking sites, and a man charged with caffeine who rushes through a maze of entertainment devices in pursuit of the horizon line that looms on every screen. And there is no way to get to it. Neurohacking of dopamine sources So, so far, the situation looks extremely unpleasant. There is a huge target on everyone's forehead, into which a beam of information stimuli is relentlessly beating. It is almost impossible to escape, but there is a way out. Neurohacking is not about taking grandmother's drugs to enhance brain activity. It is a way of life formed from understanding cognitive-behavioral principles and working not with the form of stimuli but with their essence. Power of habits "Step on the system". It applies to people with any type of addiction. Alcohol, drugs, and gambling become a natural ritual, like brushing your teeth or the route to work. To beat the system in the literal sense of the word is impossible. After all, fighting it will already be a reminder of its existence. Therefore, use switching: A notepad or text file in which you write down 3-5 events every day that brought you a moment of happiness. A beautiful sunset, a walk after the office, a dog you petted, a delicious lunch you made yourself. Allowing boredom. Boredom and procrastination are the same as a fever during a cold. It's only worth bringing it down when it's critical. Boredom indicates that you are doing something meaningless. And, quite possibly, there are more productive areas that need your attention. So it's worth giving them a little more attention. Cleansing. I think you know the feeling of not wanting to go to the shower. And then you don't want to get out of it. Same thing with dopamine. Walking on the landing with your smartphone turned off and not even music in your headphones... It seems like torture, but it will be extremely difficult to complete once you start the walk. For starters, you don't have to take it seriously. You're not struggling. You're not giving up habits. You are trying a new way of life. Everything is available to you, and nothing is beyond your control. This is the basis for the principles of Stoicism, which serves as a great balancing act when categorizing personal values. Shifting focus: what is stigmatized by marketers What's written above is a child's warm-up. You know, like morning exercise compared to professional sports. Only your main competition is all the mass marketing. Because to find happiness, you don't need marketing attributes. Comparing yourself with images on advertising posters is similar to biting your nails or lips. It is a kind of 21st-century self-harm. Cyberpsychology studies the tools used in the media by people and companies. These tools dictate the precepts of a successful, productive world. But their status quo can be disrupted by an alternate view conjured up in the mind: You don't need a new keyboard, a smartphone, or a branded notepad to be successful. You can afford all of those things. But it has no power over you. Buy things to get a dopamine boost. But remember that they are only things, and you can easily gift them to loved ones. Or part with them with no regrets. Happiness, like success, cannot be an attainable goal. Like, for example, a profession. It seems that here I will become a freelancer and will type on a chaise lounge on the island. But the screen glares, the charge is not enough, typing is uncomfortable, and it is generally hot. Happiness, success, and freelancing are states, but not an end in themselves. And it is almost impossible to acquire them. Your lifestyle will always seem miserable to some people. And someone will be shocked by its luxury. As Peter H. Diamandis wrote, there are 2 kinds of poverty. Absolute, when you have nothing to eat, and relative, when everyone else has the 12th iPhone, and you have only the 11th. You already have everything you need to experience pleasure and happiness. But it's like comparing a home chandelier to the 3D hologram from the Blade Runner remake... Advertising will always be brighter and more attractive. We will never own the products of the marketing world but only rent them, committing to changing sets of clothes, appliances, and even our personal data. They are left on a hundred websites and no longer belong to us but to supposedly secure databases. Is dopamine gluttony so bad? It may seem like a fierce criticism of modern society and consumer culture. But I'm not. It's more of an illumination of the situation as a whole. Marketing does put pressure on the mind, but companies can't do otherwise. But we can. There is already a culture of alcohol consumption in society. So why stop at just that? A culture of consuming gaming content, media content, marketing content... The excess of stimuli pushing on the dopamine receptors can really be bypassed. It's enough to choose your own goals, instead of being guided by marketing tricks. And yes, you just took a ride on the dopamine-corticoliberine swing.

Dopamine Pumps: Neurohacking Habits

ডোপামিন পাম্প: নিউরোহ্যাকিং অভ্যাস

Dopamin-Pumpen: Neurohacking-Gewohnheiten

Bombas de dopamina: hábitos de neurohacking

Pompes à dopamine : habitudes de neurohacking

डोपामाइन पंप्स: न्यूरोहैकिंग आदतें

ドーパミンポンプ: ニューロハッキングの習慣

도파민 펌프: 신경해킹 습관

Дофаминовые помпы: привычки нейрохакинга

Dopamin Pompaları: Nörohacking Alışkanlıkları

Bơm Dopamine: Thói quen tấn công thần kinh

多巴胺泵：神经黑客习惯

Scientific American, Vol. XXXVII.—No. 2. [New Series.], July 14, 1877 by Various, is part of the HackerNoon Books Series. You can jump to any chapter in this book . The Extension of the Plague. here The Extension of the Plague. Our recent English medical exchanges mention, with undisguised apprehension, the fact that already early this spring authentic observers state that the plague has broken out in Bagdad, and is rapidly increasing there; and information from other sources renders it probable that the disease has shown itself in other places in the vicinity of that city, some of which have not suffered before since the new development of the disease in Mesopotamia, three or four years ago. The progress of the epidemic in and about Bagdad last year shows that each year since its reappearance in that district it has covered a wider area, and it will be remembered that last year it crossed the Turco-Persian frontier, and broke out at Shuster, in Khuzistan. From the phenomena of the epidemic to this period it was feared, especially by the physicians on the spot, that, if it should recur in the present year, it must be expected to extend over a still wider area, and show itself in even a more aggravated form than had yet been observed. This opinion is concurred in by Surgeon-Major Colville, the medical officer attached to the British Embassy at Bagdad, and is expressed in his official report, on the subject of the last and previous year's outbreak. The Turco-Russian struggle in Asia Minor, and the massing of Persian troops on the western frontier of that country, add an additional and most grave factor to this ominous intelligence. It has been so long since Christian Europe has suffered from this terrible disease that most medical men have never seen a case, and, indeed, for awhile, epidemiologists flattered themselves it had "died out." They yet say that a thorough system of sanitation will certainly check its advance. Let us hope so; for of all pestilences which have ever scourged humanity, and desolated empires, none approach in magnitude those of the plague. Under the name of "the black death," it fills, as Hirsch remarks, one of the darkest pages in the history of the human race. It devastated every known country of the earth, and penetrated to the remotest mountain hamlets and granges, sometimes sweeping away in a few days every inhabitant, leaving not one to remember the name or to inherit the goods of the family or the village. Long years afterward, travelers would come upon these unknown villages, the houses rotting, the bones of the plague-stricken owners bleaching in the rooms and streets, and no one to say who they had been. As an epidemic disease, it no doubt spreads from India, that mother of pestilence, where, in the province of Kutch and Guzerat, it is found as an endemic of great malignancy. Far more fatal in its historical appearance than the cholera, it is well that the medical mind of Europe is on the alert to meet its approach with the most energetic measures; and should they fail, it will devolve upon us to lose no time in taking up the defensive in the most energetic manner.— Medical and Surgical Reporter. About HackerNoon Book Series: We bring you the most important technical, scientific, and insightful public domain books. This book is part of the public domain. Various (2012). Scientific American, Vol. XXXVII. —No. 2. [New Series.], July 14, 1877. Urbana, Illinois: Project Gutenberg. Retrieved https://www.gutenberg.org/cache/epub/38481/pg38481-images.html This eBook is for the use of anyone anywhere at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this eBook or online at , located at . www.gutenberg.org https://www.gutenberg.org/policy/license.html

The Extension of the Plague

Wives and Daughters by Elizabeth Cleghorn Gaskell, is part of the HackerNoon Books Series. You can jump to any chapter in this book . "OFF WITH THE OLD LOVE, AND ON WITH THE NEW." here CHAPTER LVI. "OFF WITH THE OLD LOVE, AND ON WITH THE NEW." The next morning saw Mrs. Gibson in a much more contented frame of mind. She had written and posted her letter, and the next thing was to keep Cynthia in what she called a reasonable state, or, in other words, to try and cajole her into docility. But it was so much labour lost. Cynthia had already received a letter from Mr. Henderson before she came down to breakfast,—a declaration of love, a proposal of marriage as clear as words could make it; together with an intimation that, unable to wait for the slow delays of the post, he was going to follow her down to Hollingford, and would arrive at the same time that she had done herself on the previous day. Cynthia said nothing about this letter to any one. She came late into the breakfast-room, after Mr. and Mrs. Gibson had finished the actual business of the meal; but her unpunctuality was quite accounted for by the fact that she had been travelling all the night before. Molly was not as yet strong enough to get up so early. Cynthia hardly spoke, and did not touch her food. Mr. Gibson went about his daily business, and Cynthia and her mother were left alone. "My dear," said Mrs. Gibson, "you are not eating your breakfast as you should do. I am afraid our meals seem very plain and homely to you after those in Hyde Park Street?" "No," said Cynthia; "I'm not hungry, that's all." "If we were as rich as your uncle, I should feel it to be both a duty and a pleasure to keep an elegant table; but limited means are a sad clog to one's wishes. I don't suppose that, work as he will, Mr. Gibson can earn more than he does at present; while the capabilities of the law are boundless. Lord Chancellor! Titles as well as fortune!" Cynthia was almost too much absorbed in her own reflections to reply, but she did say,—"Hundreds of briefless barristers. Take the other side, mamma." "Well; but I have noticed that many of these have private fortunes." "Perhaps. Mamma, I expect Mr. Henderson will come and call this morning." "Oh, my precious child! But how do you know? My darling Cynthia, am I to congratulate you?" "No! I suppose I must tell you. I have had a letter this morning from him, and he's coming down by the 'Umpire' to-day." "But he has offered? He surely must mean to offer, at any rate?" Cynthia played with her teaspoon before she replied; then she looked up, like one startled from a dream, and caught the echo of her mother's question. "Offered! yes, I suppose he has." "And you accept him? Say 'yes,' Cynthia, and make me happy!" "I shan't say 'yes' to make any one happy except myself, and the Russian scheme has great charms for me." She said this to plague her mother, and lessen Mrs. Gibson's exuberance of joy, it must be confessed; for her mind was pretty well made up. But it did not affect Mrs. Gibson, who affixed even less truth to it than there really was. The idea of a residence in a new, strange country, among new, strange people, was not without allurement to Cynthia. "You always look nice, dear; but don't you think you had better put on that pretty lilac silk?" "I shall not vary a thread or a shred from what I have got on now." "You dear, wilful creature! you know you always look lovely in whatever you put on." So, kissing her daughter, Mrs. Gibson left the room, intent on the lunch which should impress Mr. Henderson at once with an idea of family refinement. Cynthia went upstairs to Molly; she was inclined to tell her about Mr. Henderson, but she found it impossible to introduce the subject naturally, so she left it to time to reveal the future as gradually as it might. Molly was tired with a bad night; and her father, in his flying visit to his darling before going out, had advised her to stay upstairs for the greater part of the morning, and to keep quiet in her own room till after her early dinner, so Time had not a fair chance of telling her what he had in store in his budget. Mrs. Gibson sent an apology to Molly for not paying her her usual morning visit, and told Cynthia to give Mr. Henderson's probable coming as a reason for her occupation downstairs. But Cynthia did no such thing. She kissed Molly, and sate silently by her, holding her hand; till at length she jumped up, and said, "You shall be left alone now, little one. I want you to be very well and very bright this afternoon: so rest now." And Cynthia left her, and went to her own room, locked the door, and began to think. Some one was thinking about her at the same time, and it was not Mr. Henderson. Roger had heard from Mr. Gibson that Cynthia had come home, and he was resolving to go to her at once, and have one strong, manly attempt to overcome the obstacles whatever they might be—and of their nature he was not fully aware—that she had conjured up against the continuance of their relation to each other. He left his father—he left them all—and went off into the woods, to be alone until the time came when he might mount his horse and ride over to put his fate to the touch. He was as careful as ever not to interfere with the morning hours that were tabooed to him of old; but waiting was very hard work when he knew that she was so near, and the time so near at hand. Yet he rode slowly, compelling himself to quietness and patience when he was once really on the way to her. "Mrs. Gibson at home? Miss Kirkpatrick?" he asked of the servant, Maria, who opened the door. She was confused, but he did not notice it. "I think so—I'm not sure! Will you walk up into the drawing-room, sir? Miss Gibson is there, I know." So he went upstairs, all his nerves on the strain for the coming interview with Cynthia. It was either a relief or a disappointment, he was not sure which, to find only Molly in the room:—Molly, half lying on the couch in the bow-window which commanded the garden; draped in soft white drapery, very white herself, and a laced half-handkerchief tied over her head to save her from any ill effects of the air that blew in through the open window. He was so ready to speak to Cynthia that he hardly knew what to say to any one else. "I am afraid you are not so well," he said to Molly, who sat up to receive him, and who suddenly began to tremble with emotion. "I'm a little tired, that's all," said she; and then she was quite silent, hoping that he might go, and yet somehow wishing him to stay. But he took a chair and placed it near her, opposite to the window. He thought that surely Maria would tell Miss Kirkpatrick that she was wanted, and that at any moment he might hear her light quick footstep on the stairs. He felt he ought to talk, but he could not think of anything to say. The pink flush came out on Molly's cheeks; once or twice she was on the point of speaking, but again she thought better of it; and the pauses between their faint disjointed remarks became longer and longer. Suddenly, in one of these pauses, the merry murmur of distant happy voices in the garden came nearer and nearer; Molly looked more and more uneasy and flushed, and in spite of herself kept watching Roger's face. He could see over her into the garden. A sudden deep colour overspread him, as if his heart had sent its blood out coursing at full gallop. Cynthia and Mr. Henderson had come in sight; he eagerly talking to her as he bent forward to look into her face; she, her looks half averted in pretty shyness, was evidently coquetting about some flowers, which she either would not give, or would not take. Just then, for the lovers had emerged from the shrubbery into comparatively public life, Maria was seen approaching; apparently she had feminine tact enough to induce Cynthia to leave her present admirer, and to go a few steps to meet her to receive the whispered message that Mr. Roger Hamley was there, and wished to speak to her. Roger could see her startled gesture; she turned back to say something to Mr. Henderson before coming towards the house. Now Roger spoke to Molly—spoke hurriedly, spoke hoarsely. "Molly, tell me! Is it too late for me to speak to Cynthia? I came on purpose. Who is that man?" "Mr. Henderson. He only came to-day—but now he is her accepted lover. Oh, Roger, forgive me the pain!" "Tell her I have been, and am gone. Send out word to her. Don't let her be interrupted." And Roger ran downstairs at full speed, and Molly heard the passionate clang of the outer door. He had hardly left the house before Cynthia entered the room, pale and resolute. "Where is he?" she said, looking around, as if he might yet be hidden. "Gone!" said Molly, very faint. "Gone. Oh, what a relief! It seems to be my fate never to be off with the old lover before I am on with the new, and yet I did write as decidedly as I could. Why, Molly, what's the matter?" for now Molly had fainted away utterly. Cynthia flew to the bell, summoned Maria, water, salts, wine, anything; and as soon as Molly, gasping and miserable, became conscious again, she wrote a little pencil-note to Mr. Henderson, bidding him return to the "George," whence he had come in the morning, and saying that if he obeyed her at once, he might be allowed to call again in the evening, otherwise she would not see him till the next day. This she sent down by Maria, and the unlucky man never believed but that it was Miss Gibson's sudden indisposition in the first instance that had deprived him of his charmer's company. He comforted himself for the long solitary afternoon by writing to tell all his friends of his happiness, and amongst them uncle and aunt Kirkpatrick, who received his letter by the same post as that discreet epistle of Mrs. Gibson's, which she had carefully arranged to reveal as much as she wished, and no more. "Was he very terrible?" asked Cynthia, as she sate with Molly in the stillness of Mrs. Gibson's dressing-room. "Oh, Cynthia, it was such pain to see him, he suffered so!" "I don't like people of deep feelings," said Cynthia, pouting. "They don't suit me. Why couldn't he let me go without this fuss? I'm not worth his caring for!" "You have the happy gift of making people love you. Remember Mr. Preston,—he too wouldn't give up hope." "Now I won't have you classing Roger Hamley and Mr. Preston together in the same sentence. One was as much too bad for me as the other is too good. Now I hope that man in the garden is the ,—I'm that myself, for I don't think I'm vicious, and I know I'm not virtuous." juste milieu "Do you really like him enough to marry him?" asked Molly earnestly. "Do think, Cynthia. It won't do to go on throwing your lovers off; you give pain that I'm sure you do not mean to do,—that you cannot understand." "Perhaps I can't. I'm not offended. I never set up for what I am not, and I know I'm not constant. I've told Mr. Henderson so—" She stopped, blushing and smiling at the recollection. "You have! and what did he say?" "That he liked me just as I was; so you see he's fairly warned. Only he's a little afraid, I suppose,—for he wants me to be married very soon, almost directly, in fact. But I don't know if I shall give way,—you hardly saw him, Molly,—but he's coming again to-night, and mind, I'll never forgive you if you don't think him very charming. I believe I cared for him when he offered all those months ago, but I tried to think I didn't; only sometimes I really was so unhappy, I thought I must put an iron band round my heart to keep it from breaking, like the Faithful John of the German story,—do you remember, Molly?—how when his master came to his crown and his fortune and his lady-love, after innumerable trials and disgraces, and was driving away from the church where he'd been married in a coach and six, with Faithful John behind, the happy couple heard three great cracks in succession, and on inquiring, they were the iron-bands round his heart, that Faithful John had worn all during the time of his master's tribulation, to keep it from breaking." In the evening Mr. Henderson came. Molly had been very curious to see him; and when she saw him she was not sure whether she liked him or not. He was handsome, without being conceited; gentlemanly, without being foolishly fine. He talked easily, and never said a silly thing. He was perfectly well-appointed, yet never seemed to have given a thought to his dress. He was good-tempered and kind; not without some of the cheerful flippancy of repartee which belonged to his age and profession, and which his age and profession are apt to take for wit. But he wanted something in Molly's eyes—at any rate, in this first interview, and in her heart of hearts she thought him rather commonplace. But of course she said nothing of this to Cynthia, who was evidently as happy as she could be. Mrs. Gibson, too, was in the seventh heaven of ecstasy, and spoke but little; but what she did say, expressed the highest sentiments in the finest language. Mr. Gibson was not with them for long, but while he was there he was evidently studying the unconscious Mr. Henderson with his dark penetrating eyes. Mr. Henderson behaved exactly as he ought to have done to everybody: respectful to Mr. Gibson, deferential to Mrs. Gibson, friendly to Molly, devoted to Cynthia. The next time Mr. Gibson found Molly alone, he began,—"Well! and how do you like the new relation that is to be?" "It's difficult to say. I think he's very nice in all his bits, but—rather dull on the whole." "I think him perfection," said Mr. Gibson, to Molly's surprise; but in an instant afterwards she saw that he had been speaking ironically. He went on. "I don't wonder she preferred him to Roger Hamley. Such scents! such gloves! And then his hair and his cravat!" "Now, papa, you're not fair. He is a great deal more than that. One could see that he had very good feeling; and he is very handsome, and very much attached to her." "So was Roger. However, I must confess I shall be only too glad to have her married. She's a girl who'll always have some love-affair on hand, and will always be apt to slip through a man's fingers if he doesn't look sharp; as I was saying to Roger—" "You have seen him, then, since he was here?" "Met him in the street." "How was he?" "I don't suppose he'd been going through the pleasantest thing in the world; but he'll get over it before long. He spoke with sense and resignation, and didn't say much about it; but one could see that he was feeling it pretty sharply. He's had three months to think it over, remember. The Squire, I should guess, is showing more indignation. He is boiling over, that any one should reject his son! The enormity of the sin never seems to have been apparent to him till now, when he sees how Roger is affected by it. Indeed, with the exception of myself, I don't know one reasonable father; eh, Molly?" Whatever else Mr. Henderson might be, he was an impatient lover; he wanted to marry Cynthia directly—next week—the week after; at any rate before the long vacation, so that they could go abroad at once. Trousseaux, and preliminary ceremonies, he gave to the winds. Mr. Gibson, generous as usual, called Cynthia aside a morning or two after her engagement, and put a hundred-pound note into her hands. "There! that's to pay your expenses to Russia and back. I hope you'll find your pupils obedient." To his surprise, and rather to his discomfiture, Cynthia threw her arms round his neck and kissed him. "You are the kindest person I know," said she; "and I don't know how to thank you in words." "If you tumble my shirt-collars again in that way, I'll charge you for the washing. Just now, too, when I'm trying so hard to be trim and elegant, like your Mr. Henderson." "But you do like him, don't you?" said Cynthia, pleadingly. "He does so like you." "Of course. We're all angels just now, and you're an arch-angel. I hope he'll wear as well as Roger." Cynthia looked grave. "That was a very silly affair," she said. "We were two as unsuitable people—" "It has ended, and that's enough. Besides, I've no more time to waste; and there's your smart young man coming here in all haste." Mr. and Mrs. Kirkpatrick sent all manner of congratulations; and Mrs. Gibson, in a private letter, assured Mrs. Kirkpatrick that her ill-timed confidence about Roger should be considered as quite private. For as soon as Mr. Henderson had made his appearance in Hollingford, she had written a second letter, entreating them not to allude to anything she might have said in her first; which she said was written in such excitement on discovering the real state of her daughter's affections, that she had hardly known what she had said, and had exaggerated some things, and misunderstood others: all that she did know now was, that Mr. Henderson had just proposed to Cynthia, and was accepted, and that they were as happy as the day was long, and ("excuse the vanity of a mother,") made a most lovely couple. So Mr. and Mrs. Kirkpatrick wrote back an equally agreeable letter, praising Mr. Henderson, admiring Cynthia, and generally congratulatory; insisting into the bargain that the marriage should take place from their house in Hyde Park Street, and that Mr. and Mrs. Gibson and Molly should all come up and pay them a visit. There was a little postscript at the end. "Surely you do not mean the famous traveller, Hamley, about whose discoveries all our scientific men are so much excited. You speak of him as a young Hamley, who went to Africa. Answer this question, pray, for Helen is most anxious to know." This P.S. being in Helen's handwriting. In her exultation at the general success of everything, and desire for sympathy, Mrs. Gibson read parts of this letter to Molly; the postscript among the rest. It made a deeper impression on Molly than even the proposed kindness of the visit to London. There were some family consultations; but the end of them all was that the Kirkpatrick invitation was accepted. There were many small reasons for this, which were openly acknowledged; but there was one general and unspoken wish to have the ceremony performed out of the immediate neighbourhood of the two men whom Cynthia had previously—rejected; that was the word now to be applied to her treatment of them. So Molly was ordered and enjoined and entreated to become strong as soon as possible, in order that her health might not prevent her attending the marriage; Mr. Gibson himself, though he thought it his duty to damp the exultant anticipations of his wife and her daughter, being not at all averse to the prospect of going to London, and seeing half-a-dozen old friends, and many scientific exhibitions, independently of the very fair amount of liking which he had for his host, Mr. Kirkpatrick himself. About HackerNoon Book Series: We bring you the most important technical, scientific, and insightful public domain books. This book is part of the public domain. Elizabeth Cleghorn Gaskell (2003). Wives and Daughters. Urbana, Illinois: Project Gutenberg. Retrieved https://www.gutenberg.org/cache/epub/4274/pg4274-images.html This eBook is for the use of anyone anywhere at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this eBook or online at , located at . www.gutenberg.org https://www.gutenberg.org/policy/license.html

"OFF WITH THE OLD LOVE, AND ON WITH THE NEW."

On Combinations Amongst Masters or Workmen against Each Other

Authors:
(1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland;
(2) Oscar Nierstrasz, University of Bern, Bern, Switzerland;
(3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Table of Links Abstract and I. Introduction
II. Methodology
III. Results and Discussion
IV. Threats to Validity
V. Related Work
VI. Conclusions
VII. Acknowledgments and References Abstract—Recent studies have shown that developers have difficulties in using cryptographic APIs, which often led to security flaws. We are interested to tackle this matter by looking into what types of problems exist in various crypto libraries. We manually studied 500 posts on Stack Overflow associated with 20 popular crypto libraries. We realized there are 10 themes in the discussions. Interestingly, there were only two questions related to attacks against cryptography. There were 63 discussions in which developers had interoperability issues when working with more than a crypto library. The majority of posts (112) were about encryption/decryption problems and 111 were about installation/compilation issues of crypto libraries. Overall, we realize that the crypto libraries are frequently involved in more than five themes of discussions. We believe the current initial findings can help team leaders and experienced developers to correctly guide the team members in the domain of cryptography. Moreover, future research should investigate the similarity of problems at the API level among popular crypto libraries. I. INTRODUCTION The literature review shows that often developers do not securely use cryptographic (crypto) APIs. Hazhirpasand et al. analyzed 2 324 Java open-source projects in which Java Cryptography Architecture APIs were used. The authors found that more than 72% of the projects suffer from at least one cryptographic misuse [1]. Furthermore, they realized using such APIs over a period of time is not an indicative factor to developer performance. Rahaman et al. introduced CryptoGuard to detect cryptographic misuses and identified various types of misuses, e.g., broken hash, and insecure symmetric and asymmetric algorithms, in 6 181 popular Android applications [2]. Several studies have identified various areas of cryptography that are problematic, and where usability improvement could be advantageous. Green et al. proposed a guideline including ten principles for creating usable and secure crypto APIs [3]. Researchers deduced from 91 954 crypto questions on Stack Overflow that developers mainly have issues in three areas, i.e., digital certificates, programming issues, and passwords/hashes, resulting from a distinct lack of knowledge of fundamental concepts and the complexity of crypto libraries [4]. Lazar et al. studied 269 common vulnerabilities and exposures (CVEs) reports, and devised four main groups of crypto vulnerabilities, i.e., plaintext disclosure, man-in-the-middle attacks, bruteforce attacks, and side-channel attacks [5]. Nevertheless, the previous work studied the usabilities of crypto APIs and did not study the technical aspect of such APIs. To advance previous work, we are interested in shedding light on the following research question: what technical difficulties are prevalent among crypto libraries? We conducted a manual thematic analysis of 500 posts on Stack Overflow associated with 20 crypto libraries. According to the question and answer body in the discussions, we extracted 10 themes. Most developers (i.e., 112 posts) asked how to encrypt/decrypt a piece of text or a file. The concern of security attacks against cryptography was observed only in two posts. We observe (i.e., 111 posts) that installation, compilation, and working with different versions of a crypto library form a barrier for developers to start with cryptography. In summary, our findings indicate that there are more than five themes of problems that involve the majority of the analyzed libraries and can provide assistance for professionals to prepare their team members by addressing problematic areas of crypto libraries beforehand. In future work, we plan to explore how similar APIs in popular crypto libraries are misunderstood and whether APIs whose complexity is higher than others create more problems or not. The remainder of this paper is structured as follows. In section II, we explain the methodology of this study. We discuss our findings in section III and point out potential threats to the validity of this work in section IV. We discuss related work in section V, and we conclude this paper in section VI. This paper is available on arxiv under CC BY 4.0 DEED license. Authors: (1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland; (2) Oscar Nierstrasz, University of Bern, Bern, Switzerland; (3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Authors: Authors: (1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland; (2) Oscar Nierstrasz, University of Bern, Bern, Switzerland; (3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Table of Links Abstract and I. Introduction II. Methodology III. Results and Discussion IV. Threats to Validity V. Related Work VI. Conclusions VII. Acknowledgments and References Abstract and I. Introduction Abstract and I. Introduction II. Methodology II. Methodology III. Results and Discussion III. Results and Discussion IV. Threats to Validity IV. Threats to Validity V. Related Work V. Related Work VI. Conclusions VI. Conclusions VII. Acknowledgments and References VII. Acknowledgments and References Abstract—Recent studies have shown that developers have difficulties in using cryptographic APIs, which often led to security flaws. We are interested to tackle this matter by looking into what types of problems exist in various crypto libraries. We manually studied 500 posts on Stack Overflow associated with 20 popular crypto libraries. We realized there are 10 themes in the discussions. Interestingly, there were only two questions related to attacks against cryptography. There were 63 discussions in which developers had interoperability issues when working with more than a crypto library. The majority of posts (112) were about encryption/decryption problems and 111 were about installation/compilation issues of crypto libraries. Overall, we realize that the crypto libraries are frequently involved in more than five themes of discussions. We believe the current initial findings can help team leaders and experienced developers to correctly guide the team members in the domain of cryptography. Moreover, future research should investigate the similarity of problems at the API level among popular crypto libraries. Abstract —Recent studies have shown that developers have difficulties in using cryptographic APIs, which often led to security flaws. We are interested to tackle this matter by looking into what types of problems exist in various crypto libraries. We manually studied 500 posts on Stack Overflow associated with 20 popular crypto libraries. We realized there are 10 themes in the discussions. Interestingly, there were only two questions related to attacks against cryptography. There were 63 discussions in which developers had interoperability issues when working with more than a crypto library. The majority of posts (112) were about encryption/decryption problems and 111 were about installation/compilation issues of crypto libraries. Overall, we realize that the crypto libraries are frequently involved in more than five themes of discussions. We believe the current initial findings can help team leaders and experienced developers to correctly guide the team members in the domain of cryptography. Moreover, future research should investigate the similarity of problems at the API level among popular crypto libraries. Abstract I. INTRODUCTION The literature review shows that often developers do not securely use cryptographic (crypto) APIs. Hazhirpasand et al. analyzed 2 324 Java open-source projects in which Java Cryptography Architecture APIs were used. The authors found that more than 72% of the projects suffer from at least one cryptographic misuse [1]. Furthermore, they realized using such APIs over a period of time is not an indicative factor to developer performance. Rahaman et al. introduced CryptoGuard to detect cryptographic misuses and identified various types of misuses, e.g., broken hash, and insecure symmetric and asymmetric algorithms, in 6 181 popular Android applications [2]. Several studies have identified various areas of cryptography that are problematic, and where usability improvement could be advantageous. Green et al. proposed a guideline including ten principles for creating usable and secure crypto APIs [3]. Researchers deduced from 91 954 crypto questions on Stack Overflow that developers mainly have issues in three areas, i.e., digital certificates, programming issues, and passwords/hashes, resulting from a distinct lack of knowledge of fundamental concepts and the complexity of crypto libraries [4]. Lazar et al. studied 269 common vulnerabilities and exposures (CVEs) reports, and devised four main groups of crypto vulnerabilities, i.e., plaintext disclosure, man-in-the-middle attacks, bruteforce attacks, and side-channel attacks [5]. Nevertheless, the previous work studied the usabilities of crypto APIs and did not study the technical aspect of such APIs. To advance previous work, we are interested in shedding light on the following research question: what technical difficulties are prevalent among crypto libraries? We conducted a manual thematic analysis of 500 posts on Stack Overflow associated with 20 crypto libraries. According to the question and answer body in the discussions, we extracted 10 themes. Most developers (i.e., 112 posts) asked how to encrypt/decrypt a piece of text or a file. The concern of security attacks against cryptography was observed only in two posts. We observe (i.e., 111 posts) that installation, compilation, and working with different versions of a crypto library form a barrier for developers to start with cryptography. In summary, our findings indicate that there are more than five themes of problems that involve the majority of the analyzed libraries and can provide assistance for professionals to prepare their team members by addressing problematic areas of crypto libraries beforehand. In future work, we plan to explore how similar APIs in popular crypto libraries are misunderstood and whether APIs whose complexity is higher than others create more problems or not. The remainder of this paper is structured as follows. In section II, we explain the methodology of this study. We discuss our findings in section III and point out potential threats to the validity of this work in section IV. We discuss related work in section V, and we conclude this paper in section VI. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv

Dazed and Confused: What’s Wrong with Crypto
Libraries? — Abstract and Introduction

Authors:
(1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland;
(2) Oscar Nierstrasz, University of Bern, Bern, Switzerland;
(3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Table of Links Abstract and I. Introduction
II. Methodology
III. Results and Discussion
IV. Threats to Validity
V. Related Work
VI. Conclusions
VII. Acknowledgments and References IV. THREATS TO VALIDITY We selected 25 posts from each crypto library. This may not be a representative sample of the whole population; however, we were particularly interested in the common themes of issues in various libraries, not just one library. We selected the latest posts that are active on Stack Overflow that had at least one answer and skipped the recent questions to which nobody responded as well as the questions with no positive received votes. Nonetheless, there are various approaches to choose the posts, e.g., the number of answers or the number of views, while each of them can impose some threats to validity. To reduce subjectivity, two authors of this paper carefully performed thematic analysis to extract the themes. The final list of themes is deduced based on their discussions and crosschecking. Nevertheless, a few posts could have been assigned to other themes or a current theme could have been divided into several sub-themes. We may not have covered all the crypto libraries discussed on Stack Overflow, but we indeed selected the popular ones. This paper is available on arxiv under CC BY 4.0 DEED license. Authors: (1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland; (2) Oscar Nierstrasz, University of Bern, Bern, Switzerland; (3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Authors: Authors: (1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland; (2) Oscar Nierstrasz, University of Bern, Bern, Switzerland; (3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Table of Links Abstract and I. Introduction II. Methodology III. Results and Discussion IV. Threats to Validity V. Related Work VI. Conclusions VII. Acknowledgments and References Abstract and I. Introduction Abstract and I. Introduction II. Methodology II. Methodology III. Results and Discussion III. Results and Discussion IV. Threats to Validity IV. Threats to Validity V. Related Work V. Related Work VI. Conclusions VI. Conclusions VII. Acknowledgments and References VII. Acknowledgments and References IV. THREATS TO VALIDITY We selected 25 posts from each crypto library. This may not be a representative sample of the whole population; however, we were particularly interested in the common themes of issues in various libraries, not just one library. We selected the latest posts that are active on Stack Overflow that had at least one answer and skipped the recent questions to which nobody responded as well as the questions with no positive received votes. Nonetheless, there are various approaches to choose the posts, e.g., the number of answers or the number of views, while each of them can impose some threats to validity. To reduce subjectivity, two authors of this paper carefully performed thematic analysis to extract the themes. The final list of themes is deduced based on their discussions and crosschecking. Nevertheless, a few posts could have been assigned to other themes or a current theme could have been divided into several sub-themes. We may not have covered all the crypto libraries discussed on Stack Overflow, but we indeed selected the popular ones. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv

Dazed and Confused: What’s Wrong with Crypto
Libraries? — Threats to Validity

Dazed and Confused: What’s Wrong with Crypto
Libraries? — Results and Discussion

Authors:
(1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland;
(2) Oscar Nierstrasz, University of Bern, Bern, Switzerland;
(3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Table of Links Abstract and I. Introduction
II. Methodology
III. Results and Discussion
IV. Threats to Validity
V. Related Work
VI. Conclusions
VII. Acknowledgments and References VII. ACKNOWLEDGMENTS We gratefully acknowledge the financial support of the Swiss National Science Foundation for the project “Agile Software Assistance” (SNSF project No. 200020-181973, Feb. 1, 2019 - April 30, 2022). We also thank CHOOSE, the Swiss Group for Original and Outside-the-box Software Engineering of the Swiss Informatics Society, for its financial contribution to the presentation of this paper. REFERENCES [1] M. Hazhirpasand, M. Ghafari, S. Krüger, E. Bodden, and O. Nierstrasz, “The impact of developer experience in using Java cryptography,” in 2019 ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM). IEEE, 2019, pp. 1–6. [2] S. Rahaman, Y. Xiao, S. Afrose, F. Shaon, K. Tian, M. Frantz, M. Kantarcioglu, and D. Yao, “Cryptoguard: High precision detection of cryptographic vulnerabilities in massive-sized Java projects,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019, pp. 2455–2472. [3] M. Green and M. Smith, “Developers are not the enemy!: The need for usable security APIs,” IEEE Security & Privacy, vol. 14, no. 5, pp. 40–46, 2016. [4] M. Hazhirpasand, O. Nierstrasz, M. Shabani, and M. Ghafari, “Hurdles for developers in cryptography,” in 37th International Conference on Software Maintenance and Evolution (ICSME), 2021. [5] D. Lazar, H. Chen, X. Wang, and N. Zeldovich, “Why does cryptographic software fail? a case study and open problems,” in Proceedings of 5th Asia-Pacific Workshop on Systems, 2014, pp. 1–7. [6] N. Patnaik, J. Hallett, and A. Rashid, “Usability smells: An analysis of developers’ struggle with crypto libraries,” in Fifteenth Symposium on Usable Privacy and Security ({SOUPS} 2019), 2019, pp. 245–257. [7] K. Cairns, H. Halpin, and G. Steel, “Security analysis of the W3C web cryptography api,” in International Conference on Research in Security Standardisation. Springer, 2016, pp. 112–140. [8] Y. Yarom, D. Genkin, and N. Heninger, “Cachebleed: a timing attack on OpenSSL constant-time RSA,” Journal of Cryptographic Engineering, vol. 7, no. 2, pp. 99–112, 2017. [9] J. Somorovsky, “Systematic fuzzing and testing of TLS libraries,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016, pp. 1492–1504. [10] V. Braun and V. Clarke, “Using thematic analysis in psychology,” Qualitative research in psychology, vol. 3, no. 2, pp. 77–101, 2006. [11] S. Lewis, “Qualitative inquiry and research design: Choosing among five approaches,” Health promotion practice, vol. 16, no. 4, pp. 473– 475, 2015. [12] J. Cohen, “A coefficient of agreement for nominal scales,” Educational and psychological measurement, vol. 20, no. 1, pp. 37–46, 1960. [13] S. Kafader and M. Ghafari, “Fluentcrypto: Cryptography in easy mode,” in 37th International Conference on Software Maintenance and Evolution (ICSME), 2021. [14] C. Parnin, C. Treude, L. Grammel, and M.-A. Storey, “Crowd documentation: Exploring the coverage and the dynamics of API discussions on stack overflow,” Georgia Institute of Technology, Tech. Rep, vol. 11, 2012. [15] D. Hou and L. Li, “Obstacles in using frameworks and APIs: An exploratory study of programmers’ newsgroup discussions,” in 2011 IEEE 19th International Conference on Program Comprehension. IEEE, 2011, pp. 91–100. [16] M. Hazhirpasand, M. Ghafari, and O. Nierstrasz, “Java cryptography uses in the wild,” in Proceedings of the 14th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM), 2020, pp. 1–6. [17] M. Hazhirpasand, O. Nierstrasz, and M. Ghafari, “Worrisome patterns in developers: A survey in cryptography,” in Proceedings of the 36th IEEE/ACM International Conference on Automated Software Engineering Workshops, 2021. This paper is available on arxiv under CC BY 4.0 DEED license. Authors: (1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland; (2) Oscar Nierstrasz, University of Bern, Bern, Switzerland; (3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Authors: Authors: (1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland; (2) Oscar Nierstrasz, University of Bern, Bern, Switzerland; (3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Table of Links Abstract and I. Introduction II. Methodology III. Results and Discussion IV. Threats to Validity V. Related Work VI. Conclusions VII. Acknowledgments and References Abstract and I. Introduction Abstract and I. Introduction II. Methodology II. Methodology III. Results and Discussion III. Results and Discussion IV. Threats to Validity IV. Threats to Validity V. Related Work V. Related Work VI. Conclusions VI. Conclusions VII. Acknowledgments and References VII. Acknowledgments and References VII. ACKNOWLEDGMENTS We gratefully acknowledge the financial support of the Swiss National Science Foundation for the project “Agile Software Assistance” (SNSF project No. 200020-181973, Feb. 1, 2019 - April 30, 2022). We also thank CHOOSE, the Swiss Group for Original and Outside-the-box Software Engineering of the Swiss Informatics Society, for its financial contribution to the presentation of this paper. REFERENCES [1] M. Hazhirpasand, M. Ghafari, S. Krüger, E. Bodden, and O. Nierstrasz, “The impact of developer experience in using Java cryptography,” in 2019 ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM). IEEE, 2019, pp. 1–6. [2] S. Rahaman, Y. Xiao, S. Afrose, F. Shaon, K. Tian, M. Frantz, M. Kantarcioglu, and D. Yao, “Cryptoguard: High precision detection of cryptographic vulnerabilities in massive-sized Java projects,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019, pp. 2455–2472. [3] M. Green and M. Smith, “Developers are not the enemy!: The need for usable security APIs,” IEEE Security & Privacy, vol. 14, no. 5, pp. 40–46, 2016. [4] M. Hazhirpasand, O. Nierstrasz, M. Shabani, and M. Ghafari, “Hurdles for developers in cryptography,” in 37th International Conference on Software Maintenance and Evolution (ICSME), 2021. [5] D. Lazar, H. Chen, X. Wang, and N. Zeldovich, “Why does cryptographic software fail? a case study and open problems,” in Proceedings of 5th Asia-Pacific Workshop on Systems, 2014, pp. 1–7. [6] N. Patnaik, J. Hallett, and A. Rashid, “Usability smells: An analysis of developers’ struggle with crypto libraries,” in Fifteenth Symposium on Usable Privacy and Security ({SOUPS} 2019), 2019, pp. 245–257. [7] K. Cairns, H. Halpin, and G. Steel, “Security analysis of the W3C web cryptography api,” in International Conference on Research in Security Standardisation. Springer, 2016, pp. 112–140. [8] Y. Yarom, D. Genkin, and N. Heninger, “Cachebleed: a timing attack on OpenSSL constant-time RSA,” Journal of Cryptographic Engineering, vol. 7, no. 2, pp. 99–112, 2017. [9] J. Somorovsky, “Systematic fuzzing and testing of TLS libraries,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016, pp. 1492–1504. [10] V. Braun and V. Clarke, “Using thematic analysis in psychology,” Qualitative research in psychology, vol. 3, no. 2, pp. 77–101, 2006. [11] S. Lewis, “Qualitative inquiry and research design: Choosing among five approaches,” Health promotion practice, vol. 16, no. 4, pp. 473– 475, 2015. [12] J. Cohen, “A coefficient of agreement for nominal scales,” Educational and psychological measurement, vol. 20, no. 1, pp. 37–46, 1960. [13] S. Kafader and M. Ghafari, “Fluentcrypto: Cryptography in easy mode,” in 37th International Conference on Software Maintenance and Evolution (ICSME), 2021. [14] C. Parnin, C. Treude, L. Grammel, and M.-A. Storey, “Crowd documentation: Exploring the coverage and the dynamics of API discussions on stack overflow,” Georgia Institute of Technology, Tech. Rep, vol. 11, 2012. [15] D. Hou and L. Li, “Obstacles in using frameworks and APIs: An exploratory study of programmers’ newsgroup discussions,” in 2011 IEEE 19th International Conference on Program Comprehension. IEEE, 2011, pp. 91–100. [16] M. Hazhirpasand, M. Ghafari, and O. Nierstrasz, “Java cryptography uses in the wild,” in Proceedings of the 14th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM), 2020, pp. 1–6. [17] M. Hazhirpasand, O. Nierstrasz, and M. Ghafari, “Worrisome patterns in developers: A survey in cryptography,” in Proceedings of the 36th IEEE/ACM International Conference on Automated Software Engineering Workshops, 2021. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv

Dazed and Confused: What’s Wrong with Crypto
Libraries? — Acknowledgments and References

Authors:
(1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland;
(2) Oscar Nierstrasz, University of Bern, Bern, Switzerland;
(3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Table of Links Abstract and I. Introduction
II. Methodology
III. Results and Discussion
IV. Threats to Validity
V. Related Work
VI. Conclusions
VII. Acknowledgments and References VI. CONCLUSIONS There have been numerous studies to investigate why crypto APIs are hard to use for developers. Such studies examined the issues from the developer’s point of view as well as the usability of crypto APIs. We were curious to observe what technical problems are common among different crypto libraries. We selected 25 discussions from 20 crypto libraries on Stack Overflow and to the best of our knowledge, we did not find any study in which 20 crypto libraries were considered. We identified 10 themes in the discussions and the majority of libraries were involved in more than five themes. There exist 0.04% of questions concerning attacks against cryptography, whereas 112 questions were related to encryption/decryption issues. The developers also asked questions mostly about library installation, digital certificates, crypto keys, and library interoperability. The implications of these findings can assist security and software professionals to correctly guide their team members when dealing with cryptography, and especially crypto libraries. Further work is certainly required to disentangle the problematic commonalities among various crypto libraries. This paper is available on arxiv under CC BY 4.0 DEED license. Authors: (1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland; (2) Oscar Nierstrasz, University of Bern, Bern, Switzerland; (3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Authors: Authors: (1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland; (2) Oscar Nierstrasz, University of Bern, Bern, Switzerland; (3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Table of Links Abstract and I. Introduction II. Methodology III. Results and Discussion IV. Threats to Validity V. Related Work VI. Conclusions VII. Acknowledgments and References Abstract and I. Introduction Abstract and I. Introduction II. Methodology II. Methodology III. Results and Discussion III. Results and Discussion IV. Threats to Validity IV. Threats to Validity V. Related Work V. Related Work VI. Conclusions VI. Conclusions VII. Acknowledgments and References VII. Acknowledgments and References VI. CONCLUSIONS There have been numerous studies to investigate why crypto APIs are hard to use for developers. Such studies examined the issues from the developer’s point of view as well as the usability of crypto APIs. We were curious to observe what technical problems are common among different crypto libraries. We selected 25 discussions from 20 crypto libraries on Stack Overflow and to the best of our knowledge, we did not find any study in which 20 crypto libraries were considered. We identified 10 themes in the discussions and the majority of libraries were involved in more than five themes. There exist 0.04% of questions concerning attacks against cryptography, whereas 112 questions were related to encryption/decryption issues. The developers also asked questions mostly about library installation, digital certificates, crypto keys, and library interoperability. The implications of these findings can assist security and software professionals to correctly guide their team members when dealing with cryptography, and especially crypto libraries. Further work is certainly required to disentangle the problematic commonalities among various crypto libraries. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv

Dazed and Confused: What’s Wrong with Crypto
Libraries? — Conclusions

Authors:
(1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland;
(2) Oscar Nierstrasz, University of Bern, Bern, Switzerland;
(3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Table of Links Abstract and I. Introduction
II. Methodology
III. Results and Discussion
IV. Threats to Validity
V. Related Work
VI. Conclusions
VII. Acknowledgments and References II. METHODOLOGY In the following, we explain the objectives of this study as well as the methodology used for data collection and analysis. 1) Objective: In this study, we pose the following research question “what technical difficulties are prevalent among crypto libraries?” to tackle the underlying reasons why developers’ performance varies in using crypto APIs. The objectives of this research are listed in the following: • Finding prevalent themes of technical challenges in using crypto libraries helps library designers to improve the design of APIs. • Underlying factors can assist team leaders to be aware of areas where the developers might encounter difficulties in using cryptography. 2) Selecting crypto libraries: We aim at studying posts associated with popular crypto libraries on Stack Overflow. We assumed that discussions related to crypto libraries contain the name of the library as a tag. Hence, we selected the “cryptography” tag, i.e., base tag, to observe what other tags were used together with the base tag. We used Stack Exchange Data Explorer to run a query in order to fetch tags that appeared together with cryptography.[1] We realized that there are 2 184 tags, i.e., candidate tags. The two authors of this paper separately checked each of the candidate tags. Each of the reviewers selected the ones that are crypto libraries. They used the internet to explore a tag in which they had a lack of certainty. Then, they cross-checked the choices and discussed the tags. They arrived at the conclusion that tags that do not represent a crypto library or only provide a particular, limited service in cryptography (e.g., hashing) should not be considered. As a result, there were 6 tags that were eliminated from the list, namely rsacryptoserviceprovider, aescryptoserviceprovider, rijndaelmanaged, bcrypt, javax.crypto, and hashlib. The aforementioned tags are either a crypto class, namespace, or a dedicated module only for hashing. Ultimately, they agreed on a list of 20 crypto libraries, illustrated in Table I. 3) Crypto libraries: The selected crypto libraries are all widely used in practice and have been examined in research projects. For instance, six of the selected libraries, i.e., OpenSSL, libsodium, Bouncy Castle, SJCL, Crypto-JS, and PyCrypto, were studied for finding usability issues [6]. MCrypt is the successor to the Unix crypt command, which supports modern encryption algorithms. [2] The phpseclib library offers pure-PHP implementations of SSH2, SFTP, RSA, DSA, and many other algorithms. [3] Crypto++ and Botan are both C++ crypto libraries that support a wide range of crypto algorithms and security protocols. [4] [5] The Microsoft CryptoAPI interface enables developers to employ authentication, encoding, and encryption to Windows-based applications. [6] Jasypt and Java Cryptography Architecture (JCA) are both intended for Java developers, and the latter is part of the Java security API. [7] [8] The Web Crypto AP is intended to present basic cryptographic operations for web applications and defines cryptographic primitives in a native JavaScript API. [9] The wolfSSL TLS library is a lightweight, C-language-based library designed for IoT, embedded systems, and smart grids. [10] There are also popular OpenSSL wrappers in languages such as nodecrypto in Node.js and pyOpenSSL in Python. There have been numerous studies to investigate the security point of view of aforementioned crypto libraries and their strengths and weaknesses were examined [7] [8] [9]. However, the security evaluation of these crypto libraries falls outside the scope of this paper. 4) Manual investigation: In total, there are 24 648 posts that contained the selected crypto libraries’ tags. We computed the required sample size for the population with a confidence level of 95% and a margin of error of 4.34%, which results in sampling 500 posts. We then equally selected 25 posts from each tag (i.e., a crypto library). We queried the posts containing a crypto library tag,e.g., OpenSSL, and set the search criteria to “recent activity”, so that Stack Overflow returns the recent active discussions. Since we observed questions that are either unanswered or received negative votes, we decided to choose the posts for which the question received at least one upvote and at least one answer. The list of the selected questions are available online.[11] Thereafter, we employed thematic analysis, a qualitative research method for finding themes in texts [10], to deduce the frequent topics from the chosen posts. Since our study is of an exploratory nature, we did not devise a list of themes prior to studying the posts. Hence, in order to link each post to a suitable theme, two authors of the paper were responsible to separately study the posts and deduce the main issue (i.e., theme) of the post. The reviewers carefully reviewed the title, question body, and answer body of each post. Despite the fact that each post may entail several crypto concepts, the reviewers’ objective was to find the key issue of each post. They employed open coding in which a short explanation label was assigned to each post [11]. Each author reiterated the coding phase three times to improve their deduced list of themes. To evaluate the inter-rater agreement between the two reviewers, we employed Cohen’s kappa to assess the agreement level [12]. Deducing the themes from the posts, the reviewers received 68% Cohen’s Kappa score, which indicates a substantial agreement between the two reviewers. Finally, the two reviewers compared the two lists and discussed any disagreements. The two reviewers used different wording for building the list of themes and the total number of themes was not identical. They re-analyzed the particular posts in multiple sessions where they had different views. In some scenarios, they realized that one of the reviewers broke down one theme into several sub-themes, which they then merged if necessary. Ultimately, they agreed on 10 themes for the analyzed posts. This paper is available on arxiv under CC BY 4.0 DEED license. [1] https://data.stackexchange.com/ [2] http://mcrypt.sourceforge.net [3] https://github.com/phpseclib/phpseclib [4] https://www.cryptopp.com [5] https://botan.randombit.net [6] https://docs.microsoft.com/en-us/windows/win32/seccrypto/cryptography-portal [7] http://www.jasypt.org/ [8] https://www.oracle.com/java/technologies/javase/javase-tech-security.html [9] https://www.w3.org/TR/WebCryptoAPI/ [10] https://www.wolfssl.com/ [11] http://crypto-explorer.com/crypto_libs/ Authors: (1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland; (2) Oscar Nierstrasz, University of Bern, Bern, Switzerland; (3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Authors: Authors: (1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland; (2) Oscar Nierstrasz, University of Bern, Bern, Switzerland; (3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Table of Links Abstract and I. Introduction II. Methodology III. Results and Discussion IV. Threats to Validity V. Related Work VI. Conclusions VII. Acknowledgments and References Abstract and I. Introduction Abstract and I. Introduction II. Methodology II. Methodology III. Results and Discussion III. Results and Discussion IV. Threats to Validity IV. Threats to Validity V. Related Work V. Related Work VI. Conclusions VI. Conclusions VII. Acknowledgments and References VII. Acknowledgments and References II. METHODOLOGY In the following, we explain the objectives of this study as well as the methodology used for data collection and analysis. 1) Objective : In this study, we pose the following research question “what technical difficulties are prevalent among crypto libraries?” to tackle the underlying reasons why developers’ performance varies in using crypto APIs. 1) Objective The objectives of this research are listed in the following: • Finding prevalent themes of technical challenges in using crypto libraries helps library designers to improve the design of APIs. • Underlying factors can assist team leaders to be aware of areas where the developers might encounter difficulties in using cryptography. 2) Selecting crypto libraries: We aim at studying posts associated with popular crypto libraries on Stack Overflow. We assumed that discussions related to crypto libraries contain 2) Selecting crypto libraries: the name of the library as a tag. Hence, we selected the “cryptography” tag, i.e., base tag, to observe what other tags were used together with the base tag. We used Stack Exchange Data Explorer to run a query in order to fetch tags that appeared together with cryptography.[1] We realized that there are 2 184 tags, i.e., candidate tags. The two authors of this paper separately checked each of the candidate tags. Each of the reviewers selected the ones that are crypto libraries. They used the internet to explore a tag in which they had a lack of certainty. Then, they cross-checked the choices and discussed the tags. They arrived at the conclusion that tags that do not represent a crypto library or only provide a particular, limited service in cryptography (e.g., hashing) should not be considered. As a result, there were 6 tags that were eliminated from the list, namely rsacryptoserviceprovider, aescryptoserviceprovider, rijndaelmanaged, bcrypt, javax.crypto, and hashlib. The aforementioned tags are either a crypto class, namespace, or a dedicated module only for hashing. Ultimately, they agreed on a list of 20 crypto libraries, illustrated in Table I. 3) Crypto libraries: The selected crypto libraries are all widely used in practice and have been examined in research projects. For instance, six of the selected libraries, i.e., OpenSSL, libsodium, Bouncy Castle, SJCL, Crypto-JS, and PyCrypto, were studied for finding usability issues [6]. MCrypt is the successor to the Unix crypt command, which supports modern encryption algorithms. [2] The phpseclib library offers pure-PHP implementations of SSH2, SFTP, RSA, DSA, and many other algorithms. [3] Crypto++ and Botan are both C++ crypto libraries that support a wide range of crypto algorithms and security protocols. [4] [5] The Microsoft CryptoAPI interface enables developers to employ authentication, encoding, and encryption to Windows-based applications. [6] Jasypt and Java Cryptography Architecture (JCA) are both intended for Java developers, and the latter is part of the Java security API. [7] [8] The Web Crypto AP is intended to present basic cryptographic operations for web applications and defines cryptographic primitives in a native JavaScript API. [9] The wolfSSL TLS library is a lightweight, C-language-based library designed for IoT, embedded systems, and smart grids. [10] There are also popular OpenSSL wrappers in languages such as nodecrypto in Node.js and pyOpenSSL in Python. There have been numerous studies to investigate the security point of view of aforementioned crypto libraries and their strengths and weaknesses were examined [7] [8] [9]. However, the security evaluation of these crypto libraries falls outside the scope of this paper. 4) Manual investigation: In total, there are 24 648 posts that contained the selected crypto libraries’ tags. We computed the required sample size for the population with a confidence level of 95% and a margin of error of 4.34%, which results in sampling 500 posts. We then equally selected 25 posts from each tag (i.e., a crypto library). We queried the posts containing a crypto library tag,e.g., OpenSSL, and set the search criteria to “recent activity”, so that Stack Overflow returns the recent active discussions. Since we observed questions that are either unanswered or received negative votes, we decided to choose the posts for which the question received at least one upvote and at least one answer. The list of the selected questions are available online.[11] 4) Manual investigation: Thereafter, we employed thematic analysis, a qualitative research method for finding themes in texts [10], to deduce the frequent topics from the chosen posts. Since our study is of an exploratory nature, we did not devise a list of themes prior to studying the posts. Hence, in order to link each post to a suitable theme, two authors of the paper were responsible to separately study the posts and deduce the main issue (i.e., theme) of the post. The reviewers carefully reviewed the title, question body, and answer body of each post. Despite the fact that each post may entail several crypto concepts, the reviewers’ objective was to find the key issue of each post. They employed open coding in which a short explanation label was assigned to each post [11]. Each author reiterated the coding phase three times to improve their deduced list of themes. To evaluate the inter-rater agreement between the two reviewers, we employed Cohen’s kappa to assess the agreement level [12]. Deducing the themes from the posts, the reviewers received 68% Cohen’s Kappa score, which indicates a substantial agreement between the two reviewers. Finally, the two reviewers compared the two lists and discussed any disagreements. The two reviewers used different wording for building the list of themes and the total number of themes was not identical. They re-analyzed the particular posts in multiple sessions where they had different views. In some scenarios, they realized that one of the reviewers broke down one theme into several sub-themes, which they then merged if necessary. Ultimately, they agreed on 10 themes for the analyzed posts. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv [1] https://data.stackexchange.com/ [2] http://mcrypt.sourceforge.net [3] https://github.com/phpseclib/phpseclib [4] https://www.cryptopp.com [5] https://botan.randombit.net [6] https://docs.microsoft.com/en-us/windows/win32/seccrypto/cryptography-portal [7] http://www.jasypt.org/ [8] https://www.oracle.com/java/technologies/javase/javase-tech-security.html [9] https://www.w3.org/TR/WebCryptoAPI/ [10] https://www.wolfssl.com/ [11] http://crypto-explorer.com/crypto_libs/

Dazed and Confused: What’s Wrong with Crypto
Libraries? — Methodology

Authors:
(1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland;
(2) Oscar Nierstrasz, University of Bern, Bern, Switzerland;
(3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Table of Links Abstract and I. Introduction
II. Methodology
III. Results and Discussion
IV. Threats to Validity
V. Related Work
VI. Conclusions
VII. Acknowledgments and References V. RELATED WORK Kafader and Ghafari developed FluentCrypto with the goal of creating usable and secure crypto APIs for developers [13]. FluentCrypto hides the low-level complexities that involve using a native API and provides a task-based solution that novices can use without crypto knowledge. It also allows crypto experts to configure the API as they find fit and uses a set of pre-defined rules to determine the configuration is secure. Green et al. proposed ten principles to aid library developers in reducing the possibility of API misuses [3]. For instance, one of the principles is to make defaults safe and unambiguous in APIs. This principle can significantly lessen the hardship of developers as we have witnessed their confusion about default values in library interoperability and encryption/decryption themes. Reviewing 2491 Stack Overflow questions in relation to seven crypto libraries, Patnaik et al. identified 16 underlying usability issues in crypto libraries [6]. There is a common theme between their work and this study, which is the demand for example code snippets. However, their objective was to investigate the usability of crypto APIs, whereas we grouped the problems into themes based on the technical perspective. Developers refer to Stack Overflow as popular documentation. Parnin et al. studied three popular non-crypto APIs (Android, GWT, Java) to observe the quality and dynamics of the Stack Overflow documentation for these APIs [14]. They found that the crowd generated a rich source of content containing code examples, which are viewed by a majority of developers. For instance, more than 35 000 developers contributed to Android API discussions, which covers 87% of the classes and has been viewed over 80 million times. However, with the massive number of discussions, there is a small pool of experts available to answer the questions. Hou et al. conducted a manual analysis on a set of newsgroup discussions to understand developer problems in using APIs [15]. They described 15 obstacles, e.g., unclear API semantics by design or wrong parameter values, which hinder developers, and alleviating such obstacles increases the accessibility of APIs. Hazhirpasand et al. conducted a large-scale study on crypto-related posts on Stack Overflow by using Latent Dirichlet Allocation (LDA), which is a generative statistical model, to cluster 91 954 questions [4]. They found three high-level themes in developers’ questions, namely digital certificate, programming issues, and password/hashing. In contrast, we reported more elaborated themes of issues specifically related to crypto libraries and excluded configurational problems and general-purpose crypto questions. A recent study analyzed 489 Java projects in which the majority of APIs (i.e., 13 of 15) were misused at least once [16]. In addition, contacting the developers showed that security warnings in the documentation of crypto APIs are rare. Consequently, based on a recent survey, developers incline to resolve their crypto issues on Stack Overflow, where the authenticity of the provided answers is debatable [17]. This paper is available on arxiv under CC BY 4.0 DEED license. Authors: (1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland; (2) Oscar Nierstrasz, University of Bern, Bern, Switzerland; (3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Authors: Authors: (1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland; (2) Oscar Nierstrasz, University of Bern, Bern, Switzerland; (3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Table of Links Abstract and I. Introduction II. Methodology III. Results and Discussion IV. Threats to Validity V. Related Work VI. Conclusions VII. Acknowledgments and References Abstract and I. Introduction Abstract and I. Introduction II. Methodology II. Methodology III. Results and Discussion III. Results and Discussion IV. Threats to Validity IV. Threats to Validity V. Related Work V. Related Work VI. Conclusions VI. Conclusions VII. Acknowledgments and References VII. Acknowledgments and References V. RELATED WORK Kafader and Ghafari developed FluentCrypto with the goal of creating usable and secure crypto APIs for developers [13]. FluentCrypto hides the low-level complexities that involve using a native API and provides a task-based solution that novices can use without crypto knowledge. It also allows crypto experts to configure the API as they find fit and uses a set of pre-defined rules to determine the configuration is secure. Green et al. proposed ten principles to aid library developers in reducing the possibility of API misuses [3]. For instance, one of the principles is to make defaults safe and unambiguous in APIs. This principle can significantly lessen the hardship of developers as we have witnessed their confusion about default values in library interoperability and encryption/decryption themes. Reviewing 2491 Stack Overflow questions in relation to seven crypto libraries, Patnaik et al. identified 16 underlying usability issues in crypto libraries [6]. There is a common theme between their work and this study, which is the demand for example code snippets. However, their objective was to investigate the usability of crypto APIs, whereas we grouped the problems into themes based on the technical perspective. Developers refer to Stack Overflow as popular documentation. Parnin et al. studied three popular non-crypto APIs (Android, GWT, Java) to observe the quality and dynamics of the Stack Overflow documentation for these APIs [14]. They found that the crowd generated a rich source of content containing code examples, which are viewed by a majority of developers. For instance, more than 35 000 developers contributed to Android API discussions, which covers 87% of the classes and has been viewed over 80 million times. However, with the massive number of discussions, there is a small pool of experts available to answer the questions. Hou et al. conducted a manual analysis on a set of newsgroup discussions to understand developer problems in using APIs [15]. They described 15 obstacles, e.g., unclear API semantics by design or wrong parameter values, which hinder developers, and alleviating such obstacles increases the accessibility of APIs. Hazhirpasand et al. conducted a large-scale study on crypto-related posts on Stack Overflow by using Latent Dirichlet Allocation (LDA), which is a generative statistical model, to cluster 91 954 questions [4]. They found three high-level themes in developers’ questions, namely digital certificate, programming issues, and password/hashing. In contrast, we reported more elaborated themes of issues specifically related to crypto libraries and excluded configurational problems and general-purpose crypto questions. A recent study analyzed 489 Java projects in which the majority of APIs (i.e., 13 of 15) were misused at least once [16]. In addition, contacting the developers showed that security warnings in the documentation of crypto APIs are rare. Consequently, based on a recent survey, developers incline to resolve their crypto issues on Stack Overflow, where the authenticity of the provided answers is debatable [17]. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv

Dazed and Confused: What’s Wrong with Crypto
Libraries? — Related Work

Introduction The article highlights the importance of limiting the concurrent asynchronous operations, which in turn improves performance. Learning Objectives The common mistake all developers do How to use limit concurrent async operations Best Practices Prerequisites for Developers Basic understanding of C# programming language Basic understanding of asynchronous programming using async await Getting Started The common mistake all developers do Consider an example where the user wants to load data asynchronously within a method, and it highlights the common mistake developers make. (async item => await ProcessItem(item));
/// <summary>
/// Old approach with classic async await 
/// </summary>
/// <returns></returns>
public async static Task OldApproach(List<string> items)
{
    var tasks = items.Select(async item => await ProcessItem(item));
    await Task.WhenAll(tasks);
} The approach may look clean and simple, but it initiates tasks for each item in the collection concurrently. This can cause system strain under heavy List<string> items, which will produce poor application performance. Optimized approach with Concurrency Limit Let’s transform the above method using SemaphoreSlim to limit the number of concurrent asynchronous operations. The following code snippet demonstrates the more refined approach. /// <summary>
/// Optimized approach with limit concurrency
/// </summary>
/// <returns></returns>
public static async Task OptimizedApproachAsync(List<string> items, int maxConcurrency = 10)
{
    using (var semaphore = new SemaphoreSlim(maxConcurrency))
    {
        var tasks = items.Select(async item =>
        {
            await semaphore.WaitAsync(); // Limit concurrency by waiting for the semaphore.
            try
            {
                await ProcessItem(item);
            }
            finally
            {
                semaphore.Release(); // Release the semaphore to allow other operations.
            }
        });

        await Task.WhenAll(tasks);
    }
} The aforementioned code prevents the system from being choked by too many concurrent tasks. Best Practices Please find below the best practices Limit Concurrency To balance system load and resources, it is recommended to use SemaphoreSlim Avoid Blocking Calls Avoid using  .Result or .Wait(), as they can lead to deadlocks and degrade performance. Async all the way Avoid mixing async and sync code. Ensure all methods are async from top to bottom to prevent deadlock and make optimal use of resources. Conclusion Asynchronous programming in C# involves more than just understanding the async and await keywords; it requires more features like concurrency, resource utilization, and code structure Complete Code on GitHub GitHub — ssukhpinder/30DayChallenge.Net C# Programming🚀 Thank you for being a part of the C# community! Before you leave: If you’ve made it this far, please show your appreciation with a clap and follow the author! 👏️️ Follow us: | | | | | X LinkedIn Dev.to Hashnode Newsletter Tumblr Visit our other platforms: | | | | GitHub Instagram Tiktok Quora Daily.dev More content at C# Programming Also published . here

The 30-Day .NET Challenge Day 14: Limit Concurrent Async Operations

If you are a bit familiar with , you probably already have the idea that coroutines are a mechanism that runs a set of instructions. You’ve probably also heard the term or . In broad terms, this means that are that cooperatively execute a set of instructions and that the operating system doesn't control the scheduling of tasks or processes performed by coroutines. Instead, it relies on the program, and platform that runs them to do that. As such, coroutines can yield control back to the scheduler to allow other threads to run. This is particularly useful for operations where we need to wait for certain operations—a query to a database or a request to the website—to be completed. Being means that while we wait, the scheduler can execute other segments of coroutines. This is what I talk about in this post with a focus on the interesting properties that coroutines have of running concurrently. If they run on a single Thread and are released at the same time, we won't be able to predict the order in which they execute. coroutines cooperative multitasking non-preemptive multitasking coroutines concurrency primitives REST cooperative I have a simple example of this phenomenon available on my implemented with . GitHub repository Kotlin Here is how to use it from the command line: git clone https://github.com/jesperancinha/jeorg-kotlin-test-drives.git
cd jeorg-kotlin-coroutines/coroutines-crums-group-1
make b The executable class is SimpleConcurrency in Kotlin: class SimpleConcurrency {
   companion object {
       /**
        * This test runs sleep with the purpose to show concurrency in coroutines
        */
       @JvmStatic
       fun main(args: Array<String> = emptyArray()) = runBlocking {
           val timeToRun = measureTimeMillis {
               val coroutine1 = async {
                   delay(Duration.ofMillis(nextLong(100)))
                   async {
                       val randomTime = nextLong(500)
                       sleep(Duration.ofMillis(randomTime))
                       println("Coroutine 1 is complete in $randomTime!")
                   }.await()
               }
               val coroutine2 =
                   async {
                       delay(Duration.ofMillis(nextLong(100)))
                       async {
                           val randomTime = nextLong(500)
                           sleep(Duration.ofMillis(randomTime))
                           println("Coroutine 2 is complete in $randomTime!")
                       }.await()
                   }
               coroutine2.await()
               coroutine1.await()
           }
           println("Time to run is $timeToRun milliseconds")
       }
   }
} If you run this class multiple times, the result will be different: Coroutine 2 is complete in 342!
Coroutine 1 is complete in 389!
Time to run is 805 milliseconds! or Coroutine 1 is complete in 291!
Coroutine 2 is complete in 140!
Time to run is 516 milliseconds The code looks complicated but although this seems an easy problem to exemplify, working with coroutines can be quite challenging as when we look at the details it starts to look very confusing. For example, how would I be able to test the random start of the coroutines? To start off, I need a blocking scope because I want the to run in a single Thread and I achieve that with . Then I want to make sure they start at random times. However, the control may be random, if I would just start using a sequential and imperative type of code, the second asynchronous declared would always start later on than the first. This is why I first launch two coroutines with and then randomly delay them. This way I make sure that they will start at random times just like a real case. For both of these, I then start a sub-coroutine, where I, instead of using delay, use the blocking sleep function. This is to ensure that the first coroutine that sleeps will then block the other. If we observe our result, we do see that they start in random order and that the sum of their execution times matches the total execution time of the program proving that they concurrently try to gain control of a Thread. In real cases, we do not use and there are multiple threads involved to share with these called . This is here only to exemplify that. coroutines runBlocking coroutines coroutine async runBlocking concurrency primitives coroutines More on this in this video: https://youtube.com/shorts/JdleGvk8Xj8?feature=share&embedable=true Also published . here

How Coroutines Enable Cooperative Multitasking and Concurrency

This paper is available on arxiv under CC BY-NC-SA 4.0 DEED license. Authors: (1) Pascal Baumann, Max Planck Institute for Software Systems (MPI-SWS), Germany; (2) Rupak Majumdar, Max Planck Institute for Software Systems (MPI-SWS), Germany; (3) Ramanathan S. Thinniyam, Max Planck Institute for Software Systems (MPI-SWS), Germany; (4) Georg Zetzsche, Max Planck Institute for Software Systems (MPI-SWS), Germany. Table of Links Introduction Dynamic Networks of Concurret Pushdown Systems (DCPS) Warm-up: Non-Termination Fair Non-Termination From Progressive Runs for VASSB to Reachability Starvation Conclusion, Acknowledgment & References A. Strengthening Fairness to Progressive Runs B. Proofs from Section 4.1 C. Proofs for Section 5 D. Proofs for Section 5.3 E. Proofs for Section 6 2 DYNAMIC NETWORKS OF CONCURRENT PUSHDOWN SYSTEMS (DCPS) 2.1 Preliminary Definitions 2.2 Dynamic Networks of Concurrent Pushdown Systems 2.3 Identifiers and the Run of a Thread 2.4 Decision Problems and Main Results Note that since our model does not have individual thread identifiers, fairness is defined only over equivalence classes of threads that have the same stack 푤 and the same context switch number . The reason for our taking into account stacks and context switch numbers is the following. It is a simple observation that there exists an infinite fair run in our sense if and only if there exists a run in the corresponding system with thread identifiers–that is fair to each individual thread. This is because an angelic scheduler could always pick the earliest spawned thread among those with the same stack and context switch number. Therefore, our results allow us to reason about multi-threaded systems with identifiers. i This raises the question of whether there are runs that are fair in our sense, but where a nonangelic scheduler would still yield unfairness for some thread identity. In other words, is it possible that a fair run starves a specific thread. For example, consider a program in which the main thread spawns two copies of a thread foo. Each thread foo, when scheduled, simply spawns another copy of foo and terminates. Here is a fair run of the program (we omit the global state as it is not relevant), where we have decorated the threads with identifiers: Question Is there an infinite, fair K-context switch bounded run that starves some thread? We show the following results. Theorem 2.3 (Fair Non-Termination). For each K ∈ N, the problem FNTERM[K] is decidable Theorem 2.4 (Fair Starvation). For each K ∈ N, the problem STARV[K] is decidable.

Context-Bounded Verification of Liveness: Dynamic Networks of Concurret Pushdown Systems (DCPS)

A program that maintain its correctness in a multi-threaded environment is said to be a program. Thread-Safe Fundamentally, thread safety revolves around proper management of the shared state. In the absence of such proper management, the program could potentially spiral into an invalid state when executed in a multi-threaded environment. Defining Application’s State An application’s state is formed by the collective states of the individual objects that constitute it. An object’s state encompasses the data stored in its static or instance fields, which can influence its externally visible behavior. Furthermore, an object’s state may encompass fields from other dependent objects, creating a complex web of interconnected states within the application. Whether an object’s state need to be managed for concurrent access depends on its usage in your program. If an object is only ever accessed from a single thread, state management might not be needed! If multiple threads access the same mutable state of an object without proper synchronization, your application is technically broken. There are three ways to fix it — Don’t share the object across threads Make the object’s state immutable Implement proper synchronization for accessing the object’s shared state Using good Object Oriented Principles can help us in designing thread-safe classes. Thoughtful implementation of encapsulation, immutability, and precise specification of invariants can significantly reduce the effort required to create thread-safe classes, ultimately streamlining the development process. An important thing to note is that a program consisting of only thread-safe classes may not be thread-safe. Additionally, a program may be thread-safe even when some of its classes are not thread-safe. It all depends on how your objects interact with each other in your program! Defining Thread Safety A thread-safe class behaves correctly even when accessed from multiple threads, regardless of the scheduling or interleaving of the execution. The calling code needs no synchronization on its part when working with a thread-safe class. Thread-safe classes encapsulate the necessary synchronisation, relieving the client from the burden of providing their own. The need for synchronization arises when multiple threads access the same mutable state. However, stateless objects, by virtue of having no state to share, inherently possess thread safety. As a result, . stateless objects are always thread-safe Example of a thread-unsafe class Consider the following class that is used to find a certain number of primes, Java public class PrimeFinder {
    // Variable to count the number of invocations
    private int hitCount = 0;
    public int getHitCount() {
        return hitCount;
    }
    public List<Integer> findPrimes(int count) {
        hitCount++;
        // Find 'count' number of primes
        final List<Integer> primes = new ArrayList<>();
        for(int i = 2; i < Integer.MAX_VALUE; i++) {
            if(isPrime(i)) {
                primes.add(i);
                if(primes.size() == count) {
                    break;
                }
            }
        }
        return primes;
    }

    private boolean isPrime(int num) {
        for(int i = 2; i < num; i++) {
            if(num % i == 0) {
                return false;
            }
        }
        return true;
    }
} Note that the instance variable hitCount constitutes the state of any PrimeFinder object. Unfortunately, is not thread-safe, even though it would work fine in a single-threaded environment. This class is vulnerable to , as the operation to increase the , although seemingly atomic, is actually broken down into three distinct steps. Here is an example of an unlucky sequence of events causing to enter an invalid state. PrimeFinder lost updates hitCount hitCount Unlucky interleaving of execution causes hitCount to be 10 when it should be 11 Computation of incorrect results in case of some unlucky timings in a concurrent program is called a . The particular type of race condition that plagues our is called or . To eliminate this race condition, we must increment the hitCount in a single atomic operation. race condition PrimeFinder check-then-act read-modify-write There are several ways to fix the class. One such way is to use a thread-safe class inside . Here is the updated code, PrimeFinder PrimeFinder public class PrimeFinder {
    private final AtomicInteger hitCount = new AtomicInteger(0);
    public int getHitCount() {
        return hitCount.get();
    }
    public List<Integer> findPrimes(int count) {
        hitCount.getAndIncrement();
        // Find 'count' number of primes
        final List<Integer> primes = new ArrayList<>();
        for(int i = 2; i < Integer.MAX_VALUE; i++) {
            if(isPrime(i)) {
                primes.add(i);
                if(primes.size() == count) {
                    break;
                }
            }
        }
        return primes;
    }

    private boolean isPrime(int num) {
        for(int i = 2; i < num; i++) {
            if(num % i == 0) {
                return false;
            }
        }
        return true;
    }
} Using the atomic variable, we can ensure atomic operations on numbers and object references. Since the state of consists only of , which is thread-safe now, the class is thread-safe now! PrimeFinder hitCount PrimeFinder When a single element of state is added to a stateless class, the resulting class will be thread-safe if the state is entirely managed by a thread-safe object. Is it possible to add more state variables to PrimeFinder in a similar manner and still maintain its thread safety? Let us see… Consider the following (updated) class, PrimeFinder public class PrimeFinder {
    private final AtomicInteger numCache = new AtomicInteger(1);
    private final AtomicReference<List<Integer>> primeFactorCache = new AtomicReference<>(new ArrayList<>());
    
    // ...

    public List<Integer> findPrimeFactors(int num) {
        if(numCache.get() == num) {
            return new ArrayList<>(primeFactorCache.get());
        }
        // Find prime factors of 'num'
        final List<Integer> primeFactors = new ArrayList<>();
        for(int i = 2; i < num; i++) {
            if(isPrime(i) && num % i == 0) {
                primeFactors.add(i);
            }
        }
        numCache.set(num);
        primeFactorCache.set(new ArrayList<>(primeFactors));
        return primeFactors;
    }

    // ...

} The method is supposed to return prime factors of a number. It also stores a cache of the last number factorized and its factors. We have used atomic classes to store both the and the . findPrimeFactors numCache primeFactorCache Still, our class is not thread-safe! Can you spot the race condition here? Hint: There is a check-then-act race condition here! One invariant of our class is that the list will hold all prime factors of . Since two different variables participate in a single variant, these variables are not independent! In such cases, all the dependent variables must be updated in the same atomic operation! PrimeFinder primeFactorCache numCache To maintain state consistency, ensure that dependent state variables are updated in a single atomic operation. Intrinsic Locking in Java Every Java object can implicitly act as a lock for the purpose of synchronization. These built-in locks are what we call or . intrinsic locks monitor locks There is a built-in mechanism in Java to provide synchronization called a synchronized block. A synchronized block is a set of statements guarded by an intrinsic lock (object reference). Here is its syntax — synchronized (lock) {
  // Statements working with shared mutable state
} The lock is automatically acquired by an executing thread when it enters a synchronized block and is released when the block is exited. Since these intrinsic locks can be held by at most one executing thread at once, they allow exclusive access to the guarded code. A synchronized method is a synchronized block with the entire method as body and object as its lock. this Let us fix our class using intrinsic locks. PrimeFinder public class PrimeFinder {
    private final AtomicInteger numCache = new AtomicInteger(1);
    private final AtomicReference<List<Integer>> primeFactorCache = new AtomicReference<>(new ArrayList<>());
    
    // ...

    public List<Integer> findPrimeFactors(int num) {
        synchronized (this) {
            if (numCache.get() == num) {
                return new ArrayList<>(primeFactorCache.get());
            }
        }
        // Find prime factors of 'num'
        final List<Integer> primeFactors = new ArrayList<>();
        for(int i = 2; i < num; i++) {
            if(isPrime(i) && num % i == 0) {
                primeFactors.add(i);
            }
        }
        synchronized (this) {
            numCache.set(num);
            primeFactorCache.set(new ArrayList<>(primeFactors));
        }
        return primeFactors;
    }

    // ...

} With this, our class is thread-safe again! PrimeFinder With this, we reach the end of this blog. We discussed the fundamentals of thread safety in terms of program state and explored some basic synchronization techniques in Java. If you enjoy reading this blog, consider throwing in a like and subscribe to not miss future articles on Java concurrency! Also published . here

Stories, News & Mentions about CONCURED

Concured’s Stories on HackerNoon