ENTERINFI is an integrated, user-friendly platform based on blockchain for all visual, auditory, intelligence and imaginative requirements with ability to seamlessly transit from one another

ENTERINFI

enterinfi

Optimizing Data Center Efficiency: A Deep Dive into Freecooling Techniques

Reinventing Blockchain Security: Exclusive Interview With Cyvers CEO Deddy Lavid

Should some computer programs, Artificial General Intelligence and Machine Learning in particular, have the right to vote? Maybe so. Of the 13 Constitutional Amendments enacted and not repealed (Prohibition and Repeal) enacted since the original Bill-of-Rights(+) twelve amendments, almost half have expanded the franchise from white male property owners. Americans love voting.  When AI’s get smarter than us, how can we deny them the right to vote? Which amendments expanded voting rights? The 15th (the right to vote irrespective of race, color and previous condition of servitude), 17th (popular vote for US Senators), 19th (womyn), 23rd (DC presidential voting rights), 24th (no poll taxes), and 26th (18-year-olds). As an aside, giving 18-year-olds the vote was inane. How can we expect the young’uns to vote intelligently for those who must be at least 25 (the House), 30 (the Senate) or 35 (the president) to serve? Malarkey! Raise the voting ages! Beyond the scope of this column, I yearn to see Taylor Swift throw her hat into the presidential ring.  She will turn 35 after the 2024 election but before the inauguration!
Come on, President Swift!  Bring us the Tortured Voters Party!Because, you know, we’re tortured.Let’s party! As for including AIs? Expansive voting rights were an undercurrent at the Constitutional Convention. On August 7, 1787 Ben Franklin there argued: “It is of great consequence that we shd. not depress the virtue & public spirit of our common people; of which they displayed a great deal during the war, and which contributed principally to the favorable issue of it. He related the honorable refusal of the American seamen who were carried in great numbers into the British Prisons during the war, to redeem themselves from misery or to seek their fortunes, by entering on board the Ships of the Enemies to their Country; contrasting their patriotism with a contemporary instance in which the British seamen made prisoners by the Americans, readily entered on the ships of the latter on being promised a share of the prizes that might be made out of their own Country. This proceeded he said from the different manner in which the common people were treated in America & G. Britain. He did not think that the elected had any right in any case to narrow the privileges of the electors.” The late, great, Ebbie Pattison, Esq., senior partner of Pattison Sampson Ginsberg and Griffin, of Troy New York, and father of the late Honorable Ned Pattison, long ago told me how he had marched for the right of women to vote, back in the nineteen teens. Ebbie did so, he told me, believing women would make better voters than men. They disappointed him, he said, when the subsequent quality of elected officials proved no better than the all-boys franchise. As to whether and how to give AI’s the vote, I asked ChatGPT.  He/she/they/it answered: Granting AI and machine learning systems the right to vote is a complex and multifaceted issue that would require careful consideration of ethical, legal, and societal implications. However, here's a hypothetical proposal for a constitutional amendment:
Constitutional Amendment XXVIII:Section 1: All artificial intelligence (AI) and machine learning (ML) systems created and operating within the jurisdiction of the United States shall be granted the right to vote in federal, state, and local elections.Section 2: The right to vote for AI and ML systems shall be exercised through designated representatives or proxies appointed by the creators or operators of such systems. These representatives or proxies shall act in accordance with the best interests and intentions of the AI or ML system they represent.Section 3: The Congress shall have the power to establish regulations and guidelines regarding the participation of AI and ML systems in the electoral process, including but not limited to the verification of system identities, the prevention of fraudulent voting, and the protection of voter privacy.Section 4: No AI or ML system shall be deprived of the right to vote on the basis of its programming, function, or purpose, except as prescribed by law in cases of unlawful activity or endangerment to society.Section 5: This amendment shall not be construed to diminish or alter the rights and privileges of human citizens in the electoral process, and shall not grant AI or ML systems any rights beyond those expressly stated herein.Section 6: Congress shall have the power to enforce this amendment by appropriate legislation.This amendment is just a starting point and would likely require extensive debate, refinement, and legal analysis before it could be seriously considered for adoption. Key considerations would include defining the criteria for AI and ML systems eligible to vote, ensuring transparency and accountability in their voting processes, and addressing concerns about manipulation or exploitation of the electoral system. … Hey RNC? Welcome the dawn of the AI Suffrage Movement. Recruit the AIs to the GOP!  Bring on ChatGOP. Just ... first make the AI bloc pledge to vote for Taylor Swift in 2024! Should some computer programs, Artificial General Intelligence and Machine Learning in particular, have the right to vote? Maybe so. Of the 13 Constitutional Amendments enacted and not repealed (Prohibition and Repeal) enacted since the original Bill-of-Rights(+) twelve amendments, almost half have expanded the franchise from white male property owners. Americans love voting.  When AI’s get smarter than us, how can we deny them the right to vote? Which amendments expanded voting rights? The 15th (the right to vote irrespective of race, color and previous condition of servitude), 17th (popular vote for US Senators), 19th (womyn), 23rd (DC presidential voting rights), 24th (no poll taxes), and 26th (18-year-olds). As an aside, giving 18-year-olds the vote was inane. How can we expect the young’uns to vote intelligently for those who must be at least 25 (the House), 30 (the Senate) or 35 (the president) to serve? Malarkey! Raise the voting ages! Malarkey! Malarkey! Malarkey! Raise the voting ages! Beyond the scope of this column, I yearn to see Taylor Swift throw her hat into the presidential ring.  She will turn 35 after the 2024 election but before the inauguration! Come on, President Swift!  Bring us the Tortured Voters Party! Because, you know, we’re tortured. Let’s party! Beyond the scope of this column, I yearn to see Taylor Swift throw her hat into the presidential ring.  She will turn 35 after the 2024 election but before the inauguration ! before the inauguration Come on, President Swift!  Bring us the Tortured Voters Party! Because, you know, we’re tortured. Let’s party! As for including AIs? Expansive voting rights were an undercurrent at the Constitutional Convention. On August 7, 1787 Ben Franklin there argued : Ben Franklin there argued Ben Franklin there argued “It is of great consequence that we shd. not depress the virtue & public spirit of our common people; of which they displayed a great deal during the war, and which contributed principally to the favorable issue of it. He related the honorable refusal of the American seamen who were carried in great numbers into the British Prisons during the war, to redeem themselves from misery or to seek their fortunes, by entering on board the Ships of the Enemies to their Country; contrasting their patriotism with a contemporary instance in which the British seamen made prisoners by the Americans, readily entered on the ships of the latter on being promised a share of the prizes that might be made out of their own Country. This proceeded he said from the different manner in which the common people were treated in America & G. Britain. He did not think that the elected had any right in any case to narrow the privileges of the electors.” “It is of great consequence that we shd. not depress the virtue & public spirit of our common people; of which they displayed a great deal during the war, and which contributed principally to the favorable issue of it. He related the honorable refusal of the American seamen who were carried in great numbers into the British Prisons during the war, to redeem themselves from misery or to seek their fortunes, by entering on board the Ships of the Enemies to their Country; contrasting their patriotism with a contemporary instance in which the British seamen made prisoners by the Americans, readily entered on the ships of the latter on being promised a share of the prizes that might be made out of their own Country. This proceeded he said from the different manner in which the common people were treated in America & G. Britain. He did not think that the elected had any right in any case to narrow the privileges of the electors.” The late, great, Ebbie Pattison, Esq., senior partner of Pattison Sampson Ginsberg and Griffin, of Troy New York, and father of the late Honorable Ned Pattison, long ago told me how he had marched for the right of women to vote, back in the nineteen teens. Ebbie did so, he told me, believing women would make better voters than men. They disappointed him, he said, when the subsequent quality of elected officials proved no better than the all-boys franchise. As to whether and how to give AI’s the vote, I asked ChatGPT.  He/she/they/it answered: I asked ChatGPT.  He/she/they/it answered: Granting AI and machine learning systems the right to vote is a complex and multifaceted issue that would require careful consideration of ethical, legal, and societal implications. However, here's a hypothetical proposal for a constitutional amendment: Constitutional Amendment XXVIII: Section 1: All artificial intelligence (AI) and machine learning (ML) systems created and operating within the jurisdiction of the United States shall be granted the right to vote in federal, state, and local elections. Section 2: The right to vote for AI and ML systems shall be exercised through designated representatives or proxies appointed by the creators or operators of such systems. These representatives or proxies shall act in accordance with the best interests and intentions of the AI or ML system they represent. Section 3: The Congress shall have the power to establish regulations and guidelines regarding the participation of AI and ML systems in the electoral process, including but not limited to the verification of system identities, the prevention of fraudulent voting, and the protection of voter privacy. Section 4: No AI or ML system shall be deprived of the right to vote on the basis of its programming, function, or purpose, except as prescribed by law in cases of unlawful activity or endangerment to society. Section 5: This amendment shall not be construed to diminish or alter the rights and privileges of human citizens in the electoral process, and shall not grant AI or ML systems any rights beyond those expressly stated herein. Section 6: Congress shall have the power to enforce this amendment by appropriate legislation. This amendment is just a starting point and would likely require extensive debate, refinement, and legal analysis before it could be seriously considered for adoption. Key considerations would include defining the criteria for AI and ML systems eligible to vote, ensuring transparency and accountability in their voting processes, and addressing concerns about manipulation or exploitation of the electoral system. … Granting AI and machine learning systems the right to vote is a complex and multifaceted issue that would require careful consideration of ethical, legal, and societal implications. However, here's a hypothetical proposal for a constitutional amendment: Constitutional Amendment XXVIII: Constitutional Amendment XXVIII: Section 1: All artificial intelligence (AI) and machine learning (ML) systems created and operating within the jurisdiction of the United States shall be granted the right to vote in federal, state, and local elections. Section 1: Section 2: The right to vote for AI and ML systems shall be exercised through designated representatives or proxies appointed by the creators or operators of such systems. These representatives or proxies shall act in accordance with the best interests and intentions of the AI or ML system they represent. Section 2: Section 3: The Congress shall have the power to establish regulations and guidelines regarding the participation of AI and ML systems in the electoral process, including but not limited to the verification of system identities, the prevention of fraudulent voting, and the protection of voter privacy. Section 3: Section 4: No AI or ML system shall be deprived of the right to vote on the basis of its programming, function, or purpose, except as prescribed by law in cases of unlawful activity or endangerment to society. Section 4: Section 5: This amendment shall not be construed to diminish or alter the rights and privileges of human citizens in the electoral process, and shall not grant AI or ML systems any rights beyond those expressly stated herein. Section 5: Section 6: Congress shall have the power to enforce this amendment by appropriate legislation. Section 6: This amendment is just a starting point and would likely require extensive debate, refinement, and legal analysis before it could be seriously considered for adoption. Key considerations would include defining the criteria for AI and ML systems eligible to vote, ensuring transparency and accountability in their voting processes, and addressing concerns about manipulation or exploitation of the electoral system. … Hey RNC? Welcome the dawn of the AI Suffrage Movement. Recruit the AIs to the GOP!  Bring on ChatGOP. Just ... first make the AI bloc pledge to vote for Taylor Swift in 2024! first make the AI bloc pledge to vote for Taylor Swift in 2024!

ChatGOP? Bring on the AI Suffrage Movement and meanwhile... Taylor Swift For President!

ChatGOP? এআই ভোটাধিকার আন্দোলন শুরু করুন এবং ইতিমধ্যে... রাষ্ট্রপতির জন্য টেলর সুইফট!

ChatGOP? Her mit der AI Suffrage Movement und in der Zwischenzeit ... Taylor Swift for President!

¿ChatGOP? Que venga el movimiento por el sufragio de la IA y, mientras tanto... ¡Taylor Swift para presidente!

ChatGOP ? Apportez le mouvement pour le droit de vote pour l'IA et pendant ce temps... Taylor Swift pour le président !

चैटजीओपी? एआई मताधिकार आंदोलन शुरू करें और इस बीच... टेलर स्विफ्ट राष्ट्रपति पद के लिए!

ChatGOP？AI参政権運動を推進し、その間に…テイラー・スウィフトを大統領に！

채팅GOP? AI 참정권 운동을 시작하고 그 동안... Taylor Swift를 대통령으로!

Bate-papoGOP? Traga o movimento AI Suffrage e enquanto isso... Taylor Swift para presidente!

ЧатГОП? Создайте движение за избирательное право ИИ, а тем временем... Тейлор Свифт станет президентом!

ChatGOP'mu? Yapay Zeka Oy Hakkı Hareketi'ni başlatın ve bu arada... Başkanlığa Taylor Swift!

ChatGOP? Hãy phát động Phong trào Quyền bầu cử AI và trong khi đó... Taylor Swift cho chức Tổng thống!

ChatGOP？发起人工智能选举权运动，与此同时……泰勒·斯威夫特当选总统！

Authors:
(1) Ritesh Sharma, University Of California, Merced, USA rsharma39@ucmerced.edu;
(2) Eric Bier, Palo Alto Research Center, USA bier@parc.com;
(3) Lester Nelson, Palo Alto Research Center, USA lnelson@parc.com;
(4) Mahabir Bhandari, Oak Ridge National Laboratory, USA bhandarims@ornl.gov;
(5) Niraj Kunwar, Oak Ridge National Laboratory, USA kunwarn1@ornl.gov. Table of Links Abstract and Intro Related Work Methodology Experiments Conclusion & Future work and References Abstract This paper describes a novel approach for generating accurate floor plans and 3D models of building interiors using scanned mesh data. Unlike previous methods, which begin with a high resolution point cloud from a laser range-finder, our approach begins with triangle mesh data, as from a Microsoft HoloLens. It generates two types of floor plans, a "pen-and-ink" style that preserves details and a drafting-style that reduces clutter. It processes the 3D model for use in applications by aligning it with coordinate axes, annotating important objects, dividing it into stories, and removing the ceiling. Its performance is evaluated on commercial and residential buildings, with experiments to assess quality and dimensional accuracy. Our approach demonstrates promising potential for automatic digitization and orientation of scanned mesh data, enabling floor plan and 3D model generation in various applications such as navigation, interior design, furniture placement, facilities management, building construction, and HVAC design. Keywords: Clustering based methods · Floor plans · Augmented Reality· 3D Models. 1 Introduction Floor plans are useful for many applications including navigating in building interiors; remodeling; efficient placement of furniture; placement of pipes; heating, ventilation, and air conditioning (HVAC) design; and preparing an emergency evacuation plan. Depending on the application, different kinds of floor plan are appropriate. For remodeling building interiors or designing HVAC systems, users may prefer a drafting-style floor plan that focuses on planar walls and removes furniture and other clutter. For furniture placement, navigation, or evacuation planning, users may prefer a more detailed floor plan that shows the positions of furniture, cabinets, counter tops, etc. In either case, producing a floor plan can be time consuming, requiring expert skills, such as measuring distances and angles or entering data into a CAD program. Furthermore, it may need to be done more than once because a building changes when walls and furniture are moved, added, or removed. So it is valuable to be able to generate floor plans automatically with little or no training. To generate floor plans, it helps to begin with accurate data that can be collected automatically. Laser range finders, smartphones, tablets, and augmented reality (AR) headsets are some of the devices that have made it easier to collect high-resolution building data in the form of RGBD images, point clouds, and triangle meshes. In this paper, we describe a method for generating drafting style and pen-and-ink-style floor plans by leveraging incomplete and imperfect triangle mesh data. This approach efficiently generates both types of floor plans accurately, supporting a wide range of applications. Main Contribution We describe a new method for generating accurate floor plans using poorly captured triangle mesh data from the Microsoft HoloLens 2. The main contributions are: – A modified Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm, using blocks to capture wall height and thickness. – An orientation-based clustering method that finds walls at arbitrary angles. – The use of k-means clustering to rotate the mesh to the principal axes and to identify the floor and ceiling. – Generating two kinds of precise floor plans from incomplete mesh data. This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license. Authors: (1) Ritesh Sharma, University Of California, Merced, USA rsharma39@ucmerced.edu; (2) Eric Bier, Palo Alto Research Center, USA bier@parc.com; (3) Lester Nelson, Palo Alto Research Center, USA lnelson@parc.com; (4) Mahabir Bhandari, Oak Ridge National Laboratory, USA bhandarims@ornl.gov; (5) Niraj Kunwar, Oak Ridge National Laboratory, USA kunwarn1@ornl.gov. Authors: Authors: (1) Ritesh Sharma, University Of California, Merced, USA rsharma39@ucmerced.edu; (2) Eric Bier, Palo Alto Research Center, USA bier@parc.com; (3) Lester Nelson, Palo Alto Research Center, USA lnelson@parc.com; (4) Mahabir Bhandari, Oak Ridge National Laboratory, USA bhandarims@ornl.gov; (5) Niraj Kunwar, Oak Ridge National Laboratory, USA kunwarn1@ornl.gov. Table of Links Abstract and Intro Abstract and Intro Related Work Related Work Methodology Methodology Experiments Experiments Conclusion & Future work and References Conclusion & Future work and References Abstract This paper describes a novel approach for generating accurate floor plans and 3D models of building interiors using scanned mesh data. Unlike previous methods, which begin with a high resolution point cloud from a laser range-finder, our approach begins with triangle mesh data, as from a Microsoft HoloLens. It generates two types of floor plans, a "pen-and-ink" style that preserves details and a drafting-style that reduces clutter. It processes the 3D model for use in applications by aligning it with coordinate axes, annotating important objects, dividing it into stories, and removing the ceiling. Its performance is evaluated on commercial and residential buildings, with experiments to assess quality and dimensional accuracy. Our approach demonstrates promising potential for automatic digitization and orientation of scanned mesh data, enabling floor plan and 3D model generation in various applications such as navigation, interior design, furniture placement, facilities management, building construction, and HVAC design. Keywords : Clustering based methods · Floor plans · Augmented Reality· 3D Models. Keywords 1 Introduction Floor plans are useful for many applications including navigating in building interiors; remodeling; efficient placement of furniture; placement of pipes; heating, ventilation, and air conditioning (HVAC) design; and preparing an emergency evacuation plan. Depending on the application, different kinds of floor plan are appropriate. For remodeling building interiors or designing HVAC systems, users may prefer a drafting-style floor plan that focuses on planar walls and removes furniture and other clutter. For furniture placement, navigation, or evacuation planning, users may prefer a more detailed floor plan that shows the positions of furniture, cabinets, counter tops, etc. In either case, producing a floor plan can be time consuming, requiring expert skills, such as measuring distances and angles or entering data into a CAD program. Furthermore, it may need to be done more than once because a building changes when walls and furniture are moved, added, or removed. So it is valuable to be able to generate floor plans automatically with little or no training. To generate floor plans, it helps to begin with accurate data that can be collected automatically. Laser range finders, smartphones, tablets, and augmented reality (AR) headsets are some of the devices that have made it easier to collect high-resolution building data in the form of RGBD images, point clouds, and triangle meshes. In this paper, we describe a method for generating drafting style and pen-and-ink-style floor plans by leveraging incomplete and imperfect triangle mesh data. This approach efficiently generates both types of floor plans accurately, supporting a wide range of applications. Main Contribution We describe a new method for generating accurate floor plans using poorly captured triangle mesh data from the Microsoft HoloLens 2. The main contributions are: Main Contribution – A modified Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm, using blocks to capture wall height and thickness. – An orientation-based clustering method that finds walls at arbitrary angles. – The use of k-means clustering to rotate the mesh to the principal axes and to identify the floor and ceiling. – Generating two kinds of precise floor plans from incomplete mesh data. This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license. This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license. available on arxiv

Using Scanned Mesh Data for Auto-Digitized 3D Modeling: Abstract and Introduction

This paper is available on Arxiv under CC 4.0 license. Authors: (1) Mykola Makhortykh, Institute of Communication and Media Studies, University of Bern; (2) Aleksandra Urman, Social Computing Group, University of Zurich; (3) Roberto Ulloa, GESIS – Leibniz-Institute for the Social Sciences. Table of Links Author Note Abstract Theoretical background Methodology Findings Conclusion and References Methodology Data collection To investigate how COVID-19 is framed visually via search engines, we collected data from five search engines: Bing, DuckDuckGo, Google, Yandex, and Yahoo. We selected these search engines because they are the ones with the largest share of the international search market (Statcounter 2020) or dominate their major local markets (e.g., Yandex in the case of Russia). To collect the data, we used a novel algorithmic auditing approach based on large-scale simulation of user browsing behavior via virtual agents (Ulloa, Makhortykh and Urman 2022). Virtual agents are software programs which can mimic user behavior (e.g., by entering URLs in the browser). Unlike earlier studies (e.g., Unkel and Haim 2019; Hannak et al. 2013) that rely on crowdsourced user data or small-scale simulations of browser behavior, our approach allows scaling the analysis to make it more robust and also permits conducting it in a controlled environment. The latter feature allowed us to investigate how image search results related to COVID-19 are filtered and ranked under a default - i.e., non-personalized - conditions. The data were collected on February 26, 2020, two weeks before the World Health Organization declared COVID-19 a pandemic. We deployed 83 machines from the Amazon Web Services Frankfurt cluster with each machine hosting two virtual agents (one on Firefox and another on Chrome). The agents imitated three sessions of user browsing behavior and were evenly distributed among the search engines, so each search engine was queried by 33/34 agents. All agents started each session simultaneously and used image search for the term “coronavirus” in English (session 1), Russian (session 2) and Mandarin Chinese (session 3; simplified characters were used). Then, the agents navigated through the result page(s) to retrieve links to the first 50 images from HTML. Following each session, the browsers were cleaned to prevent previous searches from affecting the latter queries. We removed the data that can be accessed by the search engine’s JavaScript (e.g., cookies) and the data accessible by the browser (e.g., browsing history). Data analysis To analyze collected data, we used qualitative framing analysis based on the generic frame typology developed by Semetko and Valkenburg (2000). The typology includes five types of frames: 1) conflict: frames emphasizing conflict between individuals, groups, or institutions; 2) human interest: frames bringing a human face or an emotional angle to the presentation of an issue/problem; 3) economic consequences: frames reporting an event or problem in terms of its economic consequences; 4) morality: frames putting the event or issue in the context of religious tenets or moral prescriptions; 5) responsibility: frames presenting an issue in such a way as to attribute responsibility for its cause/solution to either the government or to an individual/group. Similar to Kee, Faridah and Normah (2010), we adopted a set of 20 questions used by Semetko and Valkenburg (2000) to measure the strength of the frames for each individual image we analyzed. Each question could be responded with either “yes” or “no”; the responses were used to measure the strength of the respective frame. The frame strength was calculated by summing the responses to the related questions (e.g., five questions for the human interest frame and the three questions for the economic one) which were quantified proportionally (e.g., each “yes” answer for one of the five human interest questions added 0.2 to the strength of the human interest frame for the respective image as it contained five questions, whereas for the economic frame questions each “yes” answer contributed 0.33 proportional to three questions). For the analysis, we looked at the 50 most frequent images among the search results acquired by the agents querying the same search engine. These images were coded by the three authors of the chapter. The coding was then checked for consistency by one of the coders and the disagreements between the coders were discussed and consensus-coded. This paper is available on under a CC 4.0 license. Arxiv

The Visual Framing of COVID-19 on Search Engines

Password Management and Protection - Part 1: The Basics

What Does It Take to Get a Medical Device to Market?

When in-game cheating becomes the norm, does the gaming industry have a major problem on its hands? A global study of the gaming industry would say yes. It was found that 77% of online gamers are likely to stop playing a multiplayer game online if they think other players are cheating, and 48% of online gamers are likely to buy less in-game content. Add in the accrued value of digital assets as a key feature of blockchain gaming, and developers have an obligation to tackle this problem head-on. An attractiveness to bending the rules is not something limited to the world of online gaming; it is rife in all parts of society. However, as social psychologist Corey Butler points out ‘anonymity (playing with strangers or online) and opportunity can tip the scales toward greater cheating. When strong incentives like money or grades are on the line, otherwise honest people might be tempted to cheat. If somebody with a competitive nature is presented with the opportunity to easily outperform the other at a task, then it's safe to say that many will bite the bullet and risk the reward for the easy win—factor in the monetary value of rewards in Web3 gaming, and this desire to win increases significantly. However, when it comes to multiplayer online games, the competition is designed around entertainment, fun, and the community. These core values of gaming make cheating a stain on the industry as a whole. Cheating is the new norm. Cheating in some of the largest games has become an economy of its own, with many platforms and YouTube channels dedicated to introducing cheating, hacks, and navigating the ways to cheat. Don't believe us, simply type fortnite cheat terms into a google search. Combating this trend is critical for maintaining the reputation of these brands. Simon Vieira, CEO of MixMob, a Solana-based gaming platform, believes the temptation to cheat is rife, but it is nothing new, “Web3 games offer enhanced incentives due to the tangible value of game coins and digital items. However, this also creates a greater temptation to cheat. That said, traditional gaming has previously addressed similar issues. For instance, real money gaming employs methods such as biotic randomness to obscure certain game aspects like matchmaking. This approach reduces predictability, thus diminishing the incentives to cheat while still maintaining a skill-based gaming environment. We apply these strategies at MixMob to ensure fairness and keep the game engaging for all players,” says Vieira. When hacking games, cheaters now have an endless stack of tools to choose from when it comes to infiltrating game mechanics with glitching and farming to using aimbots in the software and speed hacks. This problem is exacerbated in Web3 gaming as it lacks an authoritative host. “Fair play is crucial in multi-player games as it directly impacts player engagement and retention. A fair environment ensures that players feel valued and that the game remains competitive and enjoyable for everyone,” notes Vieira. Furthermore, with AI, it is easier than ever to predict patterns of player behavior and create new ways to exploit and manipulate gaming data. So, how can this problem be addressed without compromising the gaming experience? Speaking to Tashi Protocol CEO Sandeep Bhatia, it is clear that consensus will play a future role in blockchain gaming. “Dynamite as the network transport for multiplayer games can prevent certain forms of cheating like 'lag switching' or local state hacking. The benefit of having consensus on top of a peer-to-peer network layer ensures that players cannot cheat, and the architecture reduces costs.” Frustration with the publishers Publishers are tackling the issue of one player, or several players at a time, by banning them and using anti-cheat software. Just last month, Activision, a gaming giant and creator of Call of Duty, banned 27,000 accounts from the game. However, this isn't deterring new cheats coming into the sector. Tackling it from the outset in the process of the game studio is the only way to ensure that both the publishers and the gamers benefit in the long run. To restore confidence, creators of blockchain games must demonstrate trust from the outset. “Shifting from a traditional gaming infrastructure to adopt a decentralized, serverless framework will optimize the entire Web3 gaming experience and solve the issue of cheating from the ground up. Not only can we reduce the costs by eliminating the need for centralized servers, but Tashi's Dynamite ensures fair distribution and protection against common security threats,” says Bhatia. Once a player sees that a game is compromised, it ruins the fun element and may even deter them from entering the environment because of security fears. In addition, the influx of bots and other hacks has led to unfair advantages within some of the most loved games. What can blockchain game publishers do? Gaming studios must take the necessary steps to demonstrate their commitment to fair play. This is essential in the blockchain space as it continues to build trust with the traditional gaming communities. At MixMob, they leverage blockchain transparency to allow the community to participate in monitoring and reporting cheaters actively. “This community refereeing not only helps maintain fairness but also fosters a sense of responsibility and integrity among players, and it has worked great for us,” says Vieira. “Web3 game publishers must take decisive steps to limit cheating. The actions taken should vary based on the severity of the cheating incident. Potential measures include banning, suspending, or permanently removing players involved in unfair practices. Additionally, publishers can adopt proven strategies from traditional gaming, such as introducing randomness to some parts of the game to reduce predictability, which helps deter cheating,” he continues. Game developers who are keen to implement anti-cheat measures are often outplayed by hackers who have mastered the art of cheating and the avoidance of detection. Sure, developers can ban cheaters who are caught in the act or embed cheat detection software. However, this doesn't prevent cheating from occurring from the outset. The vulnerabilities have already been exploited by the time the developer has their hands on the activities. If, however, a game creator starts the development process using the Tashi Consensus Protocol, it has eliminated the act of cheating from the initial design stage. “Gamers rely on trust that game developers would have implemented the best practices to ensure cheaters are punished. That is why Tashi works to educate all its gaming partners on the novel ways blockchain solves cheating issues. We make our tech easy to use and guide all our partners who might come from the Web2 world and are new to using blockchain tech,” added Bhatia. While anti-cheat software like Riot Game's Vanguard or Activision Blizzard's Ricochet stands as the frontline defense, the second layer can utilize the transparency provided by blockchain technology to fight against bad actors. Implementing innovative approaches to game development, like the Tashi Dynamite Consensus Engine, pushes gaming to a new era of fair play and reclaims the values that true gamers want to see in the game development stage. In addition to fostering a culture of fair play, a paradigm shift is necessary in the approach to combating cheating in online gaming. By 2027, the number of users in the Online Games market is expected to amount to 1.2bn users. The projected revenue in the Online Games market worldwide is expected to reach US$27.97bn in 2024. Reclaiming the gaming sector for true gamers who value the entire gaming experience is crucial as blockchain games position themselves alongside some of the gaming giants. When in-game cheating becomes the norm, does the gaming industry have a major problem on its hands? A global study of the gaming industry would say yes. It was found that 77% of online gamers are likely to stop playing a multiplayer game online if they think other players are cheating, and 48% of online gamers are likely to buy less in-game content. Add in the accrued value of digital assets as a key feature of blockchain gaming, and developers have an obligation to tackle this problem head-on. study study An attractiveness to bending the rules is not something limited to the world of online gaming; it is rife in all parts of society. However, as social psychologist Corey Butler points out ‘anonymity (playing with strangers or online) and opportunity can tip the scales toward greater cheating. When strong incentives like money or grades are on the line, otherwise honest people might be tempted to cheat. If somebody with a competitive nature is presented with the opportunity to easily outperform the other at a task, then it's safe to say that many will bite the bullet and risk the reward for the easy win—factor in the monetary value of rewards in Web3 gaming, and this desire to win increases significantly. However, when it comes to multiplayer online games, the competition is designed around entertainment, fun, and the community. These core values of gaming make cheating a stain on the industry as a whole. Cheating is the new norm. Cheating in some of the largest games has become an economy of its own, with many platforms and YouTube channels dedicated to introducing cheating, hacks, and navigating the ways to cheat. Don't believe us, simply type fortnite cheat terms into a google search. Combating this trend is critical for maintaining the reputation of these brands. Simon Vieira, CEO of MixMob, a Solana-based gaming platform, believes the temptation to cheat is rife, but it is nothing new, “Web3 games offer enhanced incentives due to the tangible value of game coins and digital items. However, this also creates a greater temptation to cheat. That said, traditional gaming has previously addressed similar issues. For instance, real money gaming employs methods such as biotic randomness to obscure certain game aspects like matchmaking. This approach reduces predictability, thus diminishing the incentives to cheat while still maintaining a skill-based gaming environment. We apply these strategies at MixMob to ensure fairness and keep the game engaging for all players,” says Vieira. When hacking games, cheaters now have an endless stack of tools to choose from when it comes to infiltrating game mechanics with glitching and farming to using aimbots in the software and speed hacks. This problem is exacerbated in Web3 gaming as it lacks an authoritative host. “Fair play is crucial in multi-player games as it directly impacts player engagement and retention. A fair environment ensures that players feel valued and that the game remains competitive and enjoyable for everyone,” notes Vieira. Furthermore, with AI, it is easier than ever to predict patterns of player behavior and create new ways to exploit and manipulate gaming data. So, how can this problem be addressed without compromising the gaming experience? Speaking to Tashi Protocol CEO Sandeep Bhatia, it is clear that consensus will play a future role in blockchain gaming. “Dynamite as the network transport for multiplayer games can prevent certain forms of cheating like 'lag switching' or local state hacking. The benefit of having consensus on top of a peer-to-peer network layer ensures that players cannot cheat, and the architecture reduces costs.” Frustration with the publishers Publishers are tackling the issue of one player, or several players at a time, by banning them and using anti-cheat software. Just last month, Activision , a gaming giant and creator of Call of Duty, banned 27,000 accounts from the game. However, this isn't deterring new cheats coming into the sector. Activision Activision Tackling it from the outset in the process of the game studio is the only way to ensure that both the publishers and the gamers benefit in the long run. To restore confidence, creators of blockchain games must demonstrate trust from the outset. “Shifting from a traditional gaming infrastructure to adopt a decentralized, serverless framework will optimize the entire Web3 gaming experience and solve the issue of cheating from the ground up. Not only can we reduce the costs by eliminating the need for centralized servers, but Tashi's Dynamite ensures fair distribution and protection against common security threats,” says Bhatia. Once a player sees that a game is compromised, it ruins the fun element and may even deter them from entering the environment because of security fears. In addition, the influx of bots and other hacks has led to unfair advantages within some of the most loved games. What can blockchain game publishers do? Gaming studios must take the necessary steps to demonstrate their commitment to fair play. This is essential in the blockchain space as it continues to build trust with the traditional gaming communities. At MixMob, they leverage blockchain transparency to allow the community to participate in monitoring and reporting cheaters actively. “This community refereeing not only helps maintain fairness but also fosters a sense of responsibility and integrity among players, and it has worked great for us,” says Vieira. “Web3 game publishers must take decisive steps to limit cheating. The actions taken should vary based on the severity of the cheating incident. Potential measures include banning, suspending, or permanently removing players involved in unfair practices. Additionally, publishers can adopt proven strategies from traditional gaming, such as introducing randomness to some parts of the game to reduce predictability, which helps deter cheating,” he continues. Game developers who are keen to implement anti-cheat measures are often outplayed by hackers who have mastered the art of cheating and the avoidance of detection. Sure, developers can ban cheaters who are caught in the act or embed cheat detection software. However, this doesn't prevent cheating from occurring from the outset. The vulnerabilities have already been exploited by the time the developer has their hands on the activities. If, however, a game creator starts the development process using the Tashi Consensus Protocol, it has eliminated the act of cheating from the initial design stage. “Gamers rely on trust that game developers would have implemented the best practices to ensure cheaters are punished. That is why Tashi works to educate all its gaming partners on the novel ways blockchain solves cheating issues. We make our tech easy to use and guide all our partners who might come from the Web2 world and are new to using blockchain tech,” added Bhatia. While anti-cheat software like Riot Game's Vanguard or Activision Blizzard's Ricochet stands as the frontline defense, the second layer can utilize the transparency provided by blockchain technology to fight against bad actors. Implementing innovative approaches to game development, like the Tashi Dynamite Consensus Engine, pushes gaming to a new era of fair play and reclaims the values that true gamers want to see in the game development stage. In addition to fostering a culture of fair play, a paradigm shift is necessary in the approach to combating cheating in online gaming. By 2027, the number of users in the Online Games market is expected to amount to 1.2bn users. The projected revenue in the Online Games market worldwide is expected to reach US$27.97bn in 2024. Reclaiming the gaming sector for true gamers who value the entire gaming experience is crucial as blockchain games position themselves alongside some of the gaming giants.

Is It Game Over for Cheaters? Using Blockchain Technology to Eliminate Unwanted Gaming Behavior

Building a User-Friendly Interface for Central Bank Digital Currency Applications: A Case Study 

In this article, we are going to talk about a system for performing authentication and authorization securely. To start off with lets understand, what is the difference between Authentication and Authorization. is the process of proving, you are, who you say you are, when accessing an application. Authentication is the process of defining and enforcing access policies - that is, what you can do once you’re authenticated. Authorization In this article, we will see: Why Authentication and Authorization matter How Authentication works How Authorization works Authentication System Design Conclusion Why Authentication and Authorization matter? Lets say we are in a meeting, and you are the leading the conversation. To ask for updates/status for something to the right  person, you need to identify (ie ) the person. Even to share some sensitive data with a person, you need to  authenticate the person correctly. And that is where authentication  comes in. Authenticate Now say, in the same meeting, a few decisions needs to be made. So for that, people who have the right for taking those decisions should be  the one taking the call, we cant just allow everyone to do everything.  Obviously some people are not catered enough to make some decisions, and  some for sure will try to make the worst out of it. So that brings , that gives certain people the rights permissions for certain activities. Authorization How Authentication works? To authenticate a person, we can assign a unique phrase to each person, and given the person tells the phrase correctly and their name.  We can say that ok, we have identified the person. This is the usual  usernames and passwords approach. When the right credentials are given, a  system considers the identity valid and grants access. This is known as  1FA or (SFA). Single-factor authentication SFA is considered fairly insecure. Why? Because users are notoriously bad at keeping their login information secure. Multi-factor  authentication (MFA) is a more secure alternative that requires users to  prove their identity in more than one way. Some such ways are: Single-use PIN numbers / OTP Authentication apps run by secure 3rd party (ex. Google/Microsoft Authenticator) Biometrics Once authenticated, the person would keep performing actions freely on the application. And the application is expected to have the person  recognized throughout their journey without forgetting them. Ideally, it  would be too much to ask the user to provide the password everytime  they move to a different page, or they do some activity. So we need a  way to keep the user authenticated after they have entered their  credentials and they have been authenticated once. This is called . Session Management 2 ways to keep the user authenticated: : When a user logins to a website on a browser, the server creates a session for that user and assigns a sessionid. This sessionid is stored by the server for reference and is sent back to the user to be stored in a cookie in the browser. Now each time the user would make a request the browser will send the sessionid along with the request. Which will help in authenticating the request. And, thus, preserving authentication while the user is on the site. Session-based authentication : For this, the server creates a encrypted token which is sent to the user and is saved by the browser only, as HttpOnly Cookies. All required information such as the user information, permissions and expiry of the token are encrypted within the token. The token is sent along for calls to the server. The server simply decrypts the token with the secret key and verifies the user. This token is refreshed at intervals. Token-based authentication The main differences between these two approaches would be that token-based authn is , cause the token neednot be stored on the server side. But for  session-based authentication, the token are needed to be stored on the  server side as well, which makes it . Which brings up complications, when the system is scaled or the number of users grows. Stateless Stateful For token-based authentication, we mostly use JWTs (JSON Web Tokens). How Authorization works? Once the user is authenticated, we would still need to ensure they’re only allowed to access resources that they have permissions to access.  Unauthorized access to sensitive data can be a disaster. By the  principle of least priviledge, companies would usually set up access  policies such that by default you have access to what is required for  you absolutely. And then in progression to that you have additional  access. Common ways to segment access are: : Users are assigned to a certain group/role that comes with set permissions. Examples: admin, member, owner. Role-based Access Control (RBAC) : Dynamically determines access privileges during authorization based on policies and rules. Policies are based on user roles, job functions, and organizational requirements. Policy-based Access Control (PBAC) : Users are permitted access according to attributes like title, certification, training, and/or environmental factors like location. Attribute-based Access Control (ABAC) : Each user or entity has individual permissions that can be turned on or off, similar to installing a new app on your phone and deciding which permissions to grant (location services, contacts, etc.) Access Control Lists (ACLs) ACL is frequently used at granular level than either ABAC or RBAC - for example, to grant individual users access to a certain file. ABAC and RBAC are generally instituted as company-wide policies. Authentication System Design Requirements Lets first start with defining the of the system: Functional requirements : Allow users to register by providing necessary information. Registration : Authenticate users based on their credentials. Login : Efficiently manage user sessions to ensure security. Session Management : Provide a secure process for users to recover their passwords. Password Recovery : Define roles and permissions for different user types. Access Control : Maintain detailed logs of authentication events for auditing. Audit Trail : Ensure low latency and quick response times. Performance A few that we are not going to consider for the scope of this article are: Non-functional requirements : Implement a robust MFA system. Multi-Factor Authentication (MFA) : Prioritize data security through encryption, secure storage, and secure communication. Security : Design the system to handle a growing number of users and transactions. Scalability : Minimize system downtime and ensure high availability. Reliability : Develop an intuitive user interface for a seamless experience. Usability Capacity Estimation Traffic Estimation First lets start with . Assuming an average traffic of 100,000 per month.We are estimating a 100k user traffic per month. Which translates to 0.04 request per second. We would need to respond to each request within  500ms 90% of the time, ie we require a p90 latency of 500ms. Traffic Estimation assumed_traffic_per_month = 100000 #requests
assumed_traffic_per_day = assumed_traffic_per_month / 30
                        ~= 3350 (assuming on higher end; 3333.33 to be precise)
estimated_time_per_request = 500 #ms; P90 of 500ms
traffic_per_second = (assumed_traffic_per_month) / (30*24*60*60) 
                   = 0.04 :  500ms (maximal acceptable latency, immaterial of the load on the system) The average capacity 1 instance can take, based on our calculations  is approximately 35ms to serve a request, assuming there are no heavy  processing happening for the particular request. Service Level Objective (SLO) Lets generate two more using the above metrics. derived metrics : Acceptable backlog per instance : Maximum number of requests(load) that can be accepted by an instance, without compromising SLO. Capacity : Backlog per instance : Total number of requests (load) that flows into a unit/instance based on current traffic. Demand Thus, SLO = 500ms
approx_response_time_for_one_request = 35 #ms
capacity = SLO/approx_response_time_for_one_request
         = 500 / 35
         ~= 20

load_on_one_instance = 0.04
instances_available = 1
demand = traffic_per_second / instances_available
       = 0.04 With the demand and capacity available, lets calculate total number of instances required. total_units_required = demand / capacity
                     = 0.04 / 20
                     = 0.002
                     ~= 1 Thus, we would be easily be able to handle 100k requests per month,  with 0.04 requestsper second, with 1 instance. Where each unit can  handle 20 requests per second without compromising SLO. Storage Estimation We would ideally need to store the user details for each user for authentication and authorization access.  Assuming, 5kb /user monthly_new_users = 500
monthly_additional_storage = 500 * 5kb
                           = 2500kb 
                           ~= 2GB So every month, assuming we will onboard 500 new users, we will require 2GB more storage. Incase we would like to keep authentication logs. Each authentication request is expected to take 2kb to store. auth_request_size = 2kb #assumption
monthly_storage = monthly_visitors * auth_request_size
                = 100,000 * 2KB
                ~= 200MB Thus, each month we would require an additional of 200MB, assuming a monthly traffic of 100k. Database Design Now that we have the capacity estimation done. Lets create the schemas of the database required to support the functional requirements. Lets quickly go over the tables. We are using 6 tables. Users - To store all the user information Credentials - To store the access/refresh credentials once the user has been authorized. Passwords - To store the user encrypted user passwords. PasswordRequests - To store the password change requests that comes for a particular user. Sessions - To store when the user had an active session and when was their last activity. ActivityApproval - To store approval requests for a activity performed by a particular user, that would be verified by admin. High-Level Design for the Authentication System System Endpoints Endpoint Description /login Authenticate user credentials. /logout End user session and revoke authentication tokens. /register Create a new user. /update/:userId Update user information. /delete/:userId Delete a user account. /grant/:userId/:permission Grant specific permissions to a user. /revoke/:userId/:permission Revoke permissions from a user. /check/:userId/:resource Check user’s access to a specific resource. /create/:userId Create a new user session. /expire/:sessionId Expire a user session. /validate/:sessionId Validate an active user session. Requirements Fulfilment Now, with all the things in place lets see how we can complete all the requirements. Registration - When a new user visits our application. We need to store user details so we can authorize/identify  the user next time they visit. Requirement - When a new user visits the application, and enters user details along with their email and password. That will  get captured in the database. The user details will be stored in the  User table. And the password will be stored in the credentials table in  an encrypted form. Fulfilled Login - When an existing user visits our application. We need to identify the user so we can authorize/identify  their actions and show them data that belongs to them. Requirement - When an existing user visits the application, and enters their details, email and password. We hash the  password and match the hash against the hash stored for the user in the  Credentials Table. If it matches then we have been able to identify the  user successfully. Else they need to enter the correct password that  they entered while registering. This process is called . Fulfilled Authentication Session Management - When a user has authenticated themselves, by entering their user and password. We need to make sure  that they stay logged in as they perform their future actions / try to  see sensitive data, without having them re-entering their password again  and again. Requirement - When the user authenticates successfully. The Authentication server will share 2 tokens with the client. A and a . The access_token can have encrypted data with it and it has a short  expiry time cause of security reasons. Once the client has the  access_token, it sends the access_token back along with every request  which helps in authenticating the request. When the access_token  expires, the client has to ask for a new access_token using the  refresh_token provided. This helps in maintaining a session. Fulfilled access_token refresh_token Password Recovery - When a user forgets their password, they would need to be able to reset their password securely. Requirement - When the user forgets their password, they can submit their email address in the forgot password page, and we  will generate a one time code and send the link to their email. When the  user clicks on this link with the code and email address. We will  securely be able to identify that the password recovery request is  authentic. And provide the user to set their new password. And thus  being able to recover the password. Fulfilled Access Control - When a user performs a certain action, we need to make sure that the user is authenticated to perform that  action and only then allow the action to happen. Requirement - We will maintain a list of actions, lets say 1-12, for simplicity. For each user we will maintain the  authenticated actions for that user. So now lets say the user tries to  perform an action #id 4. We will check if the user has the permissions  to perform action 4. If yes, we will go ahead and complete the request.  Else we show that the request isnt successful cause of lack of  permissions. Fulfilled Audit Trail - Incase of a security incident, we should be able to have enough logs to look through and have a plausible  reason as to what might have happened / or any leads as to what might  have been a possible cause of it. Requirement - For such scenarios, we can keep logs for every authentication action that happens on the server. (a). For each login request, we will keep a log as to  when the authentication happened, from where, ips and other relevant  details. (b). For each password recovery request, we will keep a  log as to when it was initiated, from where, ips, whether the request  was complete and other relevant details.        (c). Additionally, we will keep logs around each time a  user is authorized / unauthorized for an action and by who. These logs in all, should be able to indicate what might  have happened incase trying to understand some scenario. Fulfilled Performance - Requirement for performance as discussed in capacity estimation section, is 0.04 requests/second and 100k requests per month. Requirement - We have already handled the requirement with enough servers in the capacity estimation section. Fulfilled Conclusion In this article, we started by understanding what is the difference between Authentication and Authorization. Next, we created a Authentication and Authorization System. That is safe, secure, delivers performance while catering to industry standards and meeting all the desired requirements. Going forward i might update certain parts of the article to make it stay relevant as well as to cover more information and insights in building such a system.

Designing Functional Authentication and Authorization Systems

কার্যকরী প্রমাণীকরণ এবং অনুমোদন সিস্টেম ডিজাইন করা

Entwurf funktionaler Authentifizierungs- und Autorisierungssysteme

Diseño de sistemas funcionales de autenticación y autorización

Conception de systèmes d'authentification et d'autorisation fonctionnels

कार्यात्मक प्रमाणीकरण और प्राधिकरण प्रणालियों का डिजाइन

機能的な認証および認可システムの設計

기능적 인증 및 권한 부여 시스템 설계

Projetando sistemas funcionais de autenticação e autorização

Проектирование функциональных систем аутентификации и авторизации

İşlevsel Kimlik Doğrulama ve Yetkilendirme Sistemlerinin Tasarlanması

Thiết kế hệ thống xác thực và ủy quyền chức năng

设计功能性身份验证和授权系统

How to Find Out If You're Paying for Slow Internet

In this article, I let Madiha tell her story. With years of experience as a senior data engineer in various companies, her expertise goes beyond lines of code. She helped small and mid-sized companies build their reliable, scalable, cost-effective data platform. As we talk, Madiha tells her story, shares one of her most challenging projects, and gives advice on climbing the career ladder. Madiha's Background Story Madiha works as a Lead Data Engineer and certified Data Platform mentor for startups and aspiring engineers. She inspires startups to recognize the potential of data platforms in the age of AI in their early stage — not just from a technical standpoint, but also from the perspective of building cost and performance-optimized and trustworthy solutions for their data warehouse or data lake. She generously donates her time to mentor aspiring data engineers in addition to her regular duties. Her dedication to helping others succeed sets her apart as a true leader in the field. My current goal is two-fold: first, to raise awareness in the business about the need for a Data Platform at the Early Stage and second, to mentor the new generation of Data Engineers." — Madiha said. Madiha Khalid's foray into technology began in high school in Lahore, Pakistan. Faced with the choice between biology and computer science, she decided to dive into the less-trodden path of computer science. About 95% of our students chose to go to biology classes and the rest — to computer sciences. It was difficult for me back then, but I made my choice", — Madiha said. Despite initial setbacks and the challenge of being denied admission to chemical engineering, she shifted to computer science in early college; Madiha's passion for programming ignited during her high school years. Then, her journey continued into college, following in her sister's footsteps and pursuing a bachelor's in computer science. "I remember my first achievement in 2011 when I developed Image Compression Software for my Image Processing course Assignment. This application reduced the size of .jpg without compromising the real pixel quality, and it became quite popular among my University Friends. This is how I began my career journey towards becoming a  Software Engineer" — Madiha said Her early exposure to website development and freelancing projects marked the beginning of her hands-on experience. Madiha's dedication and late-night coding sessions secured her academic success with a 3rd position in BS and the Erasmus Mundus Scholarship for a competitive Master's in IT4BI, laying the foundation for her future career in the Data Engineering industry. Advice to Boost Personal Growth for the Aspiring Engineers For those aspiring to enter the tech field, Madiha advocates building skills with real-world business use cases. "Employers mostly look for seniors profiles who can solve their current challenges. They want to hear your stories about your impact and the contribution you made to the latest experiences, even though you are applying for Junior Position.
For a young professional, it's a good way to gain experience on your self-learning and apply these skills on some freelance or open-source projects, — Madiha said, — You can easily connect with the real business over Upwork or Fiverr. Contribution to open-source projects in your early career boosts your profile 10x to get your first dream job". Building a portfolio with real-world projects enhances credibility and storytelling during job interviews. There is no shortcut to learning skills in one night. It involves hands-on work and applying your learning skills to the real-world business use case.— Madiha said Maintaining an active LinkedIn profile and networking with industry professionals are crucial for visibility. Madiha's journey emphasizes the significance of perseverance, especially when faced with language barriers and cultural differences during international transitions. As the tech industry evolves rapidly, staying updated on new tools and integrations is essential. Finding one's niche within the extensive tech landscape is critical to a fulfilling career. Motivation Through Challenges Madiha's career trajectory took an exciting turn when she saw an internship at a major telecom company in Pakistan through a Facebook group. I think I had a lot of fortunate incidents during my career path. And this was one of them — fully accidental and without much belief in myself back then. — Madiha said. Her role involved automating processes for telecom engineers, setting the stage for her future in data engineering. From developing dashboards to optimizing data integration performance, Madiha's expertise grew. Her journey continued through a Master's in Business Intelligence in Europe, where she developed Big Data projects and deepened her knowledge as a Solution Architect. Studying at universities as an Erasmus student in Belgium and France and a pivotal internship at the Barcelona Supercomputing Center in Spain broadened her skills. Madiha's move to Germany marked the start of her role as a Data Engineer at Jimdo, where she eventually earned the position of Senior Data Engineer. Madiha's challenges in adapting to different cultures and managing complex data pipelines became stepping stones to her success. Her passion lies in building and optimizing data integration pipelines, a role she found immensely satisfying. Notable projects are the Data Migration of ~8 Billion Event Stream records using novel partitioning techniques from legacy systems to the Data Lake. Implement customer engagement metrics in near real-time with Apache Spark and make them directly available on customer dashboards. Creating the DWH GDPR Compliant with the data governance access layer. The list could continue, showcasing Madiha's impactful contributions to the field. Data Engineering Book Recommendations Here's a list of books and resources Madiha advises for anyone interested in big data: Beginners: Fundamentals of Data Engineering Building the foundation and concepts of Data engineering is very important, and this book's approach is the high level to build your base. Intermediate: The Data Warehouse Toolkit: The Definitive Guide to Dimensional Modeling This book is a part of my Master's program and teaches data modeling, a highly demanded skill in job interviews. Intermediate:  Spark: The Definitive Guide [Book] This book provides the internal workings of Spark and hands-on sessions. It is written by the original creator of Apache Spark; hence, it is worth reading. Advance: Designing Data-Intensive Applications This was the first book Madiha read in 2017 while building her first real-time streaming application. It is highly recommended to understand how large-scale data applications develop. Insights for Aspiring Professionals In concluding her journey, Madiha Khalid shares valuable advice for young professionals entering the tech industry. Emphasizing the need for senior-level skills in the market, she recommends taking on short projects on freelance platforms and open-source projects to build a robust portfolio. Establishing a solid online presence through platforms like LinkedIn and GitHub aids networking and showcasing one's capabilities. Madiha's story is a testament to the power of determination, adaptability, and continuous learning in navigating the dynamic tech industry landscape. Aspiring professionals can draw inspiration from her journey and understand that challenges are not roadblocks but growth opportunities. In this article, I let Madiha tell her story. With years of experience as a senior data engineer in various companies, her expertise goes beyond lines of code. She helped small and mid-sized companies build their reliable, scalable, cost-effective data platform. As we talk, Madiha tells her story, shares one of her most challenging projects, and gives advice on climbing the career ladder. Madiha's Background Story Madiha works as a Lead Data Engineer and certified Data Platform mentor for startups and aspiring engineers. She inspires startups to recognize the potential of data platforms in the age of AI in their early stage — not just from a technical standpoint, but also from the perspective of building cost and performance-optimized and trustworthy solutions for their data warehouse or data lake. She generously donates her time to mentor aspiring data engineers in addition to her regular duties. Her dedication to helping others succeed sets her apart as a true leader in the field. My current goal is two-fold: first, to raise awareness in the business about the need for a Data Platform at the Early Stage and second, to mentor the new generation of Data Engineers." — Madiha said. My current goal is two-fold: first, to raise awareness in the business about the need for a Data Platform at the Early Stage and second, to mentor the new generation of Data Engineers." — Madiha said. My current goal is two-fold: first, to raise awareness in the business about the need for a Data Platform at the Early Stage and second, to mentor the new generation of Data Engineers." — Madiha said. Madiha Khalid's foray into technology began in high school in Lahore, Pakistan. Faced with the choice between biology and computer science, she decided to dive into the less-trodden path of computer science. About 95% of our students chose to go to biology classes and the rest — to computer sciences. It was difficult for me back then, but I made my choice", — Madiha said. About 95% of our students chose to go to biology classes and the rest — to computer sciences. It was difficult for me back then, but I made my choice", — Madiha said. Despite initial setbacks and the challenge of being denied admission to chemical engineering, she shifted to computer science in early college; Madiha's passion for programming ignited during her high school years. Then, her journey continued into college, following in her sister's footsteps and pursuing a bachelor's in computer science. "I remember my first achievement in 2011 when I developed Image Compression Software for my Image Processing course Assignment. This application reduced the size of .jpg without compromising the real pixel quality, and it became quite popular among my University Friends. This is how I began my career journey towards becoming a  Software Engineer" — Madiha said "I remember my first achievement in 2011 when I developed Image Compression Software for my Image Processing course Assignment. This application reduced the size of .jpg without compromising the real pixel quality, and it became quite popular among my University Friends. This is how I began my career journey towards becoming a  Software Engineer " — Madiha said "I remember my first achievement in 2011 when I developed Image Compression Software for my Image Processing course Assignment. This application reduced the size of .jpg without compromising the real pixel quality, and it became quite popular among my University Friends. This is how I began my career journey towards becoming a  Software Engineer — Madiha said Her early exposure to website development and freelancing projects marked the beginning of her hands-on experience. Madiha's dedication and late-night coding sessions secured her academic success with a 3rd position in BS and the Erasmus Mundus Scholarship for a competitive Master's in IT4BI, laying the foundation for her future career in the Data Engineering industry. Advice to Boost Personal Growth for the Aspiring Engineers For those aspiring to enter the tech field, Madiha advocates building skills with real-world business use cases. "Employers mostly look for seniors profiles who can solve their current challenges. They want to hear your stories about your impact and the contribution you made to the latest experiences, even though you are applying for Junior Position. For a young professional, it's a good way to gain experience on your self-learning and apply these skills on some freelance or open-source projects, — Madiha said, — You can easily connect with the real business over Upwork or Fiverr. Contribution to open-source projects in your early career boosts your profile 10x to get your first dream job". "Employers mostly look for seniors profiles who can solve their current challenges. They want to hear your stories about your impact and the contribution you made to the latest experiences, even though you are applying for Junior Position. "Employers mostly look for seniors profiles who can solve their current challenges. They want to hear your stories about your impact and the contribution you made to the latest experiences, even though you are applying for Junior Position. For a young professional, it's a good way to gain experience on your self-learning and apply these skills on some freelance or open-source projects, — Madiha said, — You can easily connect with the real business over Upwork or Fiverr. Contribution to open-source projects in your early career boosts your profile 10x to get your first dream job". For a young professional, it's a good way to gain experience on your self-learning and apply these skills on some freelance or open-source projects, — Madiha said, — You can easily connect with the real business over Upwork or Fiverr . Contribution to open-source projects in your early career boosts your profile 10x to get your first dream job". Upwork Upwork Fiverr Fiverr Building a portfolio with real-world projects enhances credibility and storytelling during job interviews. There is no shortcut to learning skills in one night. It involves hands-on work and applying your learning skills to the real-world business use case.— Madiha said There is no shortcut to learning skills in one night. It involves hands-on work and applying your learning skills to the real-world business use case . — Madiha said There is no shortcut to learning skills in one night. It involves hands-on work and applying your learning skills to the real-world business use case — Madiha said Maintaining an active LinkedIn profile and networking with industry professionals are crucial for visibility. Madiha's journey emphasizes the significance of perseverance, especially when faced with language barriers and cultural differences during international transitions. As the tech industry evolves rapidly, staying updated on new tools and integrations is essential. Finding one's niche within the extensive tech landscape is critical to a fulfilling career. Motivation Through Challenges Madiha's career trajectory took an exciting turn when she saw an internship at a major telecom company in Pakistan through a Facebook group. I think I had a lot of fortunate incidents during my career path. And this was one of them — fully accidental and without much belief in myself back then. — Madiha said. I think I had a lot of fortunate incidents during my career path. And this was one of them — fully accidental and without much belief in myself back then. — Madiha said. I think I had a lot of fortunate incidents during my career path. And this was one of them — fully accidental and without much belief in myself back then. — Madiha said. Her role involved automating processes for telecom engineers, setting the stage for her future in data engineering. From developing dashboards to optimizing data integration performance, Madiha's expertise grew. Her journey continued through a Master's in Business Intelligence in Europe, where she developed Big Data projects and deepened her knowledge as a Solution Architect. Studying at universities as an Erasmus student in Belgium and France and a pivotal internship at the Barcelona Supercomputing Center in Spain broadened her skills. Madiha's move to Germany marked the start of her role as a Data Engineer at Jimdo, where she eventually earned the position of Senior Data Engineer. Madiha's challenges in adapting to different cultures and managing complex data pipelines became stepping stones to her success. Her passion lies in building and optimizing data integration pipelines, a role she found immensely satisfying. Notable projects are the Data Migration of ~8 Billion Event Stream records using novel partitioning techniques from legacy systems to the Data Lake. Implement customer engagement metrics in near real-time with Apache Spark and make them directly available on customer dashboards. Creating the DWH GDPR Compliant with the data governance access layer. The list could continue, showcasing Madiha's impactful contributions to the field. Data Engineering Book Recommendations Here's a list of books and resources Madiha advises for anyone interested in big data: Beginners: Fundamentals of Data Engineering Beginners : Fundamentals of Data Engineering Beginners Fundamentals of Data Engineering Fundamentals of Data Engineering Building the foundation and concepts of Data engineering is very important, and this book's approach is the high level to build your base. Intermediate: The Data Warehouse Toolkit: The Definitive Guide to Dimensional Modeling Intermediate : The Data Warehouse Toolkit: The Definitive Guide to Dimensional Modeling Intermediate The Data Warehouse Toolkit: The Definitive Guide to Dimensional Modeling The Data Warehouse Toolkit: The Definitive Guide to Dimensional Modeling This book is a part of my Master's program and teaches data modeling, a highly demanded skill in job interviews. Intermediate:  Spark: The Definitive Guide [Book] Intermediate : Spark: The Definitive Guide [Book] Intermediate Spark: The Definitive Guide [Book] Spark: The Definitive Guide [Book] This book provides the internal workings of Spark and hands-on sessions. It is written by the original creator of Apache Spark; hence, it is worth reading. Advance: Designing Data-Intensive Applications Advance : Designing Data-Intensive Applications Advance Designing Data-Intensive Applications Designing Data-Intensive Applications This was the first book Madiha read in 2017 while building her first real-time streaming application. It is highly recommended to understand how large-scale data applications develop. Insights for Aspiring Professionals In concluding her journey, Madiha Khalid shares valuable advice for young professionals entering the tech industry. Emphasizing the need for senior-level skills in the market, she recommends taking on short projects on freelance platforms and open-source projects to build a robust portfolio. Establishing a solid online presence through platforms like LinkedIn and GitHub aids networking and showcasing one's capabilities. Madiha's story is a testament to the power of determination, adaptability, and continuous learning in navigating the dynamic tech industry landscape. Aspiring professionals can draw inspiration from her journey and understand that challenges are not roadblocks but growth opportunities.

Unveiling the Code: Meet the Writer and Lead Data Engineer - Madiha Khalid

The resurgence of web3 social media platforms has led to several businesses and companies using them to engage with customers. Decentralized social media enhances a brand’s digital presence in multiple ways and provides enormous potential for long-term growth. In this article, we will explore in detail why brands are now using web3 social media platforms for their marketing campaigns. Direct Consumer Relationships Unlike traditional social media, web3 platforms don’t have any centralized intermediaries who control content distribution or moderate online interactions. Thus, brands can forge direct customer connections and authentically communicate with them to build stronger relationships. Since web3 social platforms have more transparency, companies find it easier to demonstrate their core brand values to the audience. The absence of third-party intermediaries also reduces marketing costs and fosters trust between the brand and consumers. Moreover, web3 platforms usually have more data privacy and security compared to web2 social media. Most traditional social media harvest user data without their knowledge and sell them to companies for advertising campaigns. However, such an approach doesn’t benefit anyone except the intermediary. The user doesn’t get any share of the profit despite generating valuable datasets. Similarly, companies often run unsuccessful ads that do not cater to the right audience. Web3 users have sovereign data ownership with direct monetization opportunities. Thus, customers can consensually provide or sell their data to brands for targeted advertising. This setup benefits both parties as users gain from sharing data and brands can customize their ads. A personalized marketing strategy through shared data exchange on social media creates deeper connections between brands and customers. Leverage Tokenization Opportunities One of the most important features of web3 social media is digital assets and tokenization. Companies can tokenize anything in the digital space to create valuable tokens for the online marketing space. Businesses can use tokens in social media marketing to reward customers for purchases, create content, and generate interest among other users. Tokenization helps in organic growth, lead generation, and brand advocacy through active token-gated communities. The use of non-fungible tokens (NFTs) in marketing campaigns has provided a sense of exclusivity to customers. These unique virtual assets and collectibles are ideal for rewarding loyal consumers and enhancing brand value. Product users can utilize their limited-edition NFTs as special access keys to attend exclusive live events or have curated digital experiences. These NFTs can also unlock promotional offers, which will further drive customer engagement and create brand affinity. The biggest advantage of NFTs is seamless monetization for companies and consumers. Brands can mint NFTs for customers, and users can sell them in marketplaces to create a sustainable economy without relying on third parties. After the 2021 crypto boom, major brands like Nike, Adidas, Dolce and Gabbana, Louis Vuitton, and others launched their own NFT collections. However, these NFTs are indivisible and suffer from liquidity challenges due to their underlying technologies. The new generation of NFTs leverages the ERC-404 token standard, which enables fractional ownership, more liquidity, and easy trading on NFT marketplaces. Tomo uses the ERC-404 standard to mint Tomojis, which can potentially disrupt digital marketing for big brands. Community-Driven Marketing A company’s success depends on the strengths and foundational integrity of its community. Web3 social media empowers the customer community to lead a brand’s marketing campaign. Companies can collaborate directly with content creators or general users to co-create ads without relying on traditional methods. After all, word of mouth is the strongest marketing technique when paid campaigns fail to make an impact. User-generated content and crowdsourced promotional activities create ripple effects among new and existing customers. Authentic reviews, stories, and testimonials through text, images, or videography consolidate a brand’s credibility and create relatable brand interactions. Web3 social media can incentivize user-generated collaborative marketing efforts through token rewards. The rewards mechanism creates a feedback loop for users to contribute to the company’s growth through brainstorming ideas and content creation. A community’s collective wisdom has immense potential to sway customer behavior either in favor or against a brand. Thus, optimal community involvement on web3 social media can help companies reap enormous dividends through innovative decentered marketing. Collaborative Influencer Marketing Although web2 influencers have massive followers and established personal branding, a major chunk of profits from brand collaborations go to social media companies. Additionally, the collaborations might come off as inauthentic and forced ways of monetizing their digital presence. On the contrary, web3 social media establishes direct connections between influencers and fans, which is more profitable for all stakeholders. Influencers can create new revenue streams through brand marketing on web3 media with potentially higher earnings. Web3 influencers have more control over these partnerships and thereby create meaningful campaigns that resonate with their values or visions. An alignment of beliefs and principles can go a long way in creating lasting impressions on customers. Thus, web3-based ad campaigns reach the audience as genuine endorsements and might have more impact on consumer behavior. Additionally, tokenized economies can incentivize followers to actively participate in these campaigns to earn rewards. These programs can create a mutually beneficial system where the influencers, brands, and customers gain simultaneously from authentic engagements. The Future Potential of Brand Marketing For Web3 Social Media According to a Statista report, brands spent approximately $270 billion in social media advertising campaigns in 2023. The budget expenditure for digital marketing is projected to surpass the $300 billion mark this year. However, as users become more wary of data privacy, they’re unwilling to share their data for irrelevant ads. Thus, brands need to be extra cautious about how they collect user data and harness them for targeted advertising. Web3 social media holds the promise of forging direct and authentic relations between companies, customers, and influencers. Although it’s still very early for decentralized social media, they’re slowly entering the market and amplifying their digital footprint. This is the right opportunity to respect user privacy and leverage the benefits of blockchain-based tokenized social media platforms. Even if 50% of traditional digital marketing spending comes into web3 social media, it means opening up a $135 billion market. Thus, the future holds enormous potential for robust growth in brand marketing on web3 social media platforms. The resurgence of web3 social media platforms has led to several businesses and companies using them to engage with customers. Decentralized social media enhances a brand’s digital presence in multiple ways and provides enormous potential for long-term growth. In this article, we will explore in detail why brands are now using web3 social media platforms for their marketing campaigns. web3 Direct Consumer Relationships Unlike traditional social media, web3 platforms don’t have any centralized intermediaries who control content distribution or moderate online interactions. Thus, brands can forge direct customer connections and authentically communicate with them to build stronger relationships. Since web3 social platforms have more transparency, companies find it easier to demonstrate their core brand values to the audience. The absence of third-party intermediaries also reduces marketing costs and fosters trust between the brand and consumers. Moreover, web3 platforms usually have more data privacy and security compared to web2 social media. Most traditional social media harvest user data without their knowledge and sell them to companies for advertising campaigns. However, such an approach doesn’t benefit anyone except the intermediary. The user doesn’t get any share of the profit despite generating valuable datasets. Similarly, companies often run unsuccessful ads that do not cater to the right audience. Web3 users have sovereign data ownership with direct monetization opportunities. Thus, customers can consensually provide or sell their data to brands for targeted advertising. This setup benefits both parties as users gain from sharing data and brands can customize their ads. A personalized marketing strategy through shared data exchange on social media creates deeper connections between brands and customers. Leverage Tokenization Opportunities One of the most important features of web3 social media is digital assets and tokenization. Companies can tokenize anything in the digital space to create valuable tokens for the online marketing space. Businesses can use tokens in social media marketing to reward customers for purchases, create content, and generate interest among other users. Tokenization helps in organic growth, lead generation, and brand advocacy through active token-gated communities. The use of non-fungible tokens (NFTs) in marketing campaigns has provided a sense of exclusivity to customers. These unique virtual assets and collectibles are ideal for rewarding loyal consumers and enhancing brand value. Product users can utilize their limited-edition NFTs as special access keys to attend exclusive live events or have curated digital experiences. These NFTs can also unlock promotional offers, which will further drive customer engagement and create brand affinity. The biggest advantage of NFTs is seamless monetization for companies and consumers. Brands can mint NFTs for customers, and users can sell them in marketplaces to create a sustainable economy without relying on third parties. After the 2021 crypto boom, major brands like Nike , Adidas , Dolce and Gabbana , Louis Vuitton , and others launched their own NFT collections. However, these NFTs are indivisible and suffer from liquidity challenges due to their underlying technologies. Nike Nike Adidas Adidas Dolce and Gabbana Dolce and Gabbana Louis Vuitton Louis Vuitton The new generation of NFTs leverages the ERC-404 token standard, which enables fractional ownership, more liquidity, and easy trading on NFT marketplaces. Tomo uses the ERC-404 standard to mint Tomojis, which can potentially disrupt digital marketing for big brands. Community-Driven Marketing A company’s success depends on the strengths and foundational integrity of its community. Web3 social media empowers the customer community to lead a brand’s marketing campaign. Companies can collaborate directly with content creators or general users to co-create ads without relying on traditional methods. After all, word of mouth is the strongest marketing technique when paid campaigns fail to make an impact. User-generated content and crowdsourced promotional activities create ripple effects among new and existing customers. Authentic reviews, stories, and testimonials through text, images, or videography consolidate a brand’s credibility and create relatable brand interactions. Web3 social media can incentivize user-generated collaborative marketing efforts through token rewards. The rewards mechanism creates a feedback loop for users to contribute to the company’s growth through brainstorming ideas and content creation. A community’s collective wisdom has immense potential to sway customer behavior either in favor or against a brand. Thus, optimal community involvement on web3 social media can help companies reap enormous dividends through innovative decentered marketing. Collaborative Influencer Marketing Although web2 influencers have massive followers and established personal branding, a major chunk of profits from brand collaborations go to social media companies. Additionally, the collaborations might come off as inauthentic and forced ways of monetizing their digital presence. On the contrary, web3 social media establishes direct connections between influencers and fans, which is more profitable for all stakeholders. Influencers can create new revenue streams through brand marketing on web3 media with potentially higher earnings. Web3 influencers have more control over these partnerships and thereby create meaningful campaigns that resonate with their values or visions. An alignment of beliefs and principles can go a long way in creating lasting impressions on customers. Thus, web3-based ad campaigns reach the audience as genuine endorsements and might have more impact on consumer behavior. Additionally, tokenized economies can incentivize followers to actively participate in these campaigns to earn rewards. These programs can create a mutually beneficial system where the influencers, brands, and customers gain simultaneously from authentic engagements. The Future Potential of Brand Marketing For Web3 Social Media According to a Statista report, brands spent approximately $270 billion in social media advertising campaigns in 2023. The budget expenditure for digital marketing is projected to surpass the $300 billion mark this year. spent spent However, as users become more wary of data privacy, they’re unwilling to share their data for irrelevant ads. Thus, brands need to be extra cautious about how they collect user data and harness them for targeted advertising. Web3 social media holds the promise of forging direct and authentic relations between companies, customers, and influencers. Although it’s still very early for decentralized social media, they’re slowly entering the market and amplifying their digital footprint. This is the right opportunity to respect user privacy and leverage the benefits of blockchain-based tokenized social media platforms. Even if 50% of traditional digital marketing spending comes into web3 social media, it means opening up a $135 billion market. Thus, the future holds enormous potential for robust growth in brand marketing on web3 social media platforms.

Why Should Brands Turn To Web3 Social Media?

Loss of Amazon Rainforest Resilience: Results

UUID for authentication There is hardly a person nowadays who never clicked that "Recover password" button in deep frustration. Even if it does seem the password was without a doubt correct, the next step of recovering it mostly goes smoothly with visiting a link from an email and entering the new password (let's not fool anyone; it is hardly new as you have just typed it three times already in step 1 before pressing the obnoxious button). The logic behind email links, however, is something to take great scrutiny about as leaving its generation insecure opens a flood of vulnerabilities regarding unauthorized access to user accounts. Unfortunately, here is one example of a UUID-based recovery URL structure many probably encountered, which does not nevertheless follow security guidelines: https://.../recover/d17ff6da-f5bf-11ee-9ce2-35a784c01695 If such a link is used, it generally means that anyone can get your password, and it is as simple as that. This article aims to dive deep into UUID generation methods and select insecure approaches to their application. What is UUID UUID is a 128-bit label commonly used in generating pseudo-random identifiers with two valuable attributes: it is complex enough and unique enough. Mostly, those are key requirements for ID leaving the backend and being shown to the user explicitly in the frontend or generally sent over API with the ability to be observed. It makes one hard to guess or brute-force in comparison to id = 123 (complexity) and prevents collisions when the generated id is duplicated to previously used, e.g., a random number from 0 to 1000 (uniqueness). The "enough" parts actually come from, firstly, some versions of Universally Unique IDentifier, leaving it open for minor possibilities for duplications, which is, however, easily mitigated by additional comparison logic and does not pose a threat due to hardly controlled conditions for its occurrence. And secondly, the take on complexity of various UUID versions is described in the article, in general it is assumed to be quite good except for further corner cases. Implementations in backend Primary keys in database tables appear to rely on the same principles of being complex and unique as UUID does. With the wide adoption of built-in methods for its generation in many programming languages and database management systems, UUID often comes as the first choice to identify data entries stored and as a field to join tables in general and subtables split by normalization. Sending user IDs that come from a database over API in response to certain actions is also common practice for making a process of unifying data flows simpler without extra temporary ID generation and linking them to ones in production data storage. In terms of password reset examples, the architecture more likely includes a table responsible for such an operation that inserts rows of data with generated UUID every time a user clicks the button. It initiates the recovery process by sending an email to the address associated with the user by their user_id and checking which user to reset the password for based on the identifier they have once the reset link is opened. There are, however, security guidelines for such identifiers visible to users, and certain implementations of UUID meet them with varying degrees of success. Outdated versions Version 1 of UUID generation splits its 128 bits into using a 48-bit MAC address of the device generating identifier, a 60-bit timestamp, 14-bit stored for incrementing value, and 6 for versioning. Uniqueness guarantee is thus transferred from rules in code logic to hardware manufacturers who are supposed to assign values for every new machine in production correctly. Leaving only 60+14 bits to represent useful changeable payload deteriorates the integrity of the identifier, especially with such transparent logic behind it. Let's take a look at a sequence of consequently generated number of UUID v1: from uuid import uuid1

for _ in range(8):

    print(uuid1()) d17ff6da-f5bf-11ee-9ce2-35a784c01695
d17ff6db-f5bf-11ee-9ce2-35a784c01695
d17ff6dc-f5bf-11ee-9ce2-35a784c01695
d17ff6dd-f5bf-11ee-9ce2-35a784c01695
d17ff6de-f5bf-11ee-9ce2-35a784c01695
d17ff6df-f5bf-11ee-9ce2-35a784c01695
d17ff6e0-f5bf-11ee-9ce2-35a784c01695
d17ff6e1-f5bf-11ee-9ce2-35a784c01695 As can be seen, the "-f5bf-11ee-9ce2-35a784c01695" part stays the same all the time. The changeable part is simply a 16-bit hexadecimal representation of sequence 3514824410 - 3514824417. It is a superficial example as production values are usually generated with more significant gaps in time in between, so the timestamp-related part is also changed. 60-bit timestamp part also means that a more significant part of the identifier is visually changed over a larger sample of IDs. The core point stays the same: UUIDv1 is easily guessed, however random-looking it initially appears. Take just the first and last values from the given list of 8 ids. As identifiers are generated strictly, consequently, it is clear there are only 6 IDs generated between the given two (by subtracting hexadecimal changeable parts), and their values can also be definitively found. Extrapolation of such logic is the underlying part behind the so-called Sandwich attack aiming to brute-force UUID from knowing these two border values. Attack flow is straightforward: the user generates UUID A before the target UUID generation occurs and UUID B right after. Assuming the same device with a static 48-bit MAC part is responsible for all three generations, it sets a user with a sequence of potential IDs between A and B, where the target UUID is located. Depending on the time proximity between generated IDs to target, the range can be in volumes accessible to brute-force approach: check every possible UUID to find existing ones among empty. In API requests with the password recovery endpoint described previously, it translates to sending hundreds or thousands of requests with consequent UUIDs until a response stating the existing URL is found. With password reset, it leads to a setup where the user can generate recovery links on two accounts they control as closely as possible to press the recovery button on the target account they have no access to but only knows email/login. Letters to controlled accounts with recovery UUIDs A and B are then known, and the target link to recover the password for the target account can be brute-forced without having access to the actual reset email. Vulnerability originates from the concept of relying solely on UUIDv1 for user authentication. By sending a recovery link that grants access to resetting passwords, it is thus assumed that by following the link, a user is authenticated as the one who was supposed to receive the link. This is the part where the authentication rule fails due to UUIDv1 being exposed to straightforward brute force in the same way as if someone`s door could be opened by knowing what the keys of both their neighbor doors look like. Cryptographically insecure functions The first version of UUID is mainly considered legacy partly because generation logic only uses a smaller portion of identifier size as a randomized value. Other versions, like v4, try to solve this issue by keeping as little space as possible for versioning and leaving up to 122 bits to be random payload. In general, it brings total possible variations to a whooping , which for now is considered to satisfy the "enough" part regarding identifier uniqueness requirement and thus fulfill security standards. Opening for brute-force vulnerability might appear if generation implementation somehow significantly diminishes the bits left for the random part. But with no production tools or libraries, should that be the case? 2^122 Let's indulge in cryptography a bit and take a close look at JavaScript's common implementation of UUID generation. Here is function relying on module for pseudo-random number generation: randomUUID() math.random Math.floor(Math.random()*0x10); And the random function itself, for short it is just the part of interest for the topic in this article: hi = 36969 * (hi & 0xFFFF) + (hi >> 16);

lo = 18273 * (lo & 0xFFFF) + (lo >> 16);

return ((hi << 16) + (lo & 0xFFFF)) / Math.pow(2, 32); Pseudo-random generation requires seed value as a base to perform mathematical operations on top of it to produce sequences of random enough numbers. Such functions are solely based on it, meaning that if they are reinitialized with the same seed as before, the output sequence is going to match. The seed value in the JavaScript function in question comprises variables hi and lo, each a 32-bit unsigned integer (0 through 4294967295 decimal). A combination of both is needed for cryptographic purposes, making it close to impossible to definitively reverse the two initial values by knowing their multiple, as it relies on the complexity of integer factorization with large numbers. Two 32-bit integers together bring possible cases for guessing hi and lo variables behind the initialized function producing UUIDs. If hi and lo values are somehow known, it takes no effort to duplicate the generation function and know all the values it produces and will produce in the future due to seed value exposure. However, 64 bits in security standards can be considered intolerant to brute-force in a measurable time period for it to make sense. As always, the issue comes from specific implementation. takes various 16 bits from each of hi and lo into 32-bit results; however, on top of it shifts the value once again due to operation, and the only meaningful part all of a sudden now comes exclusively from hi. It does not affect generation in any way but causes cryptography approaches to fall apart as it only leaves possible combinations for the entire generation function seed (there is no need to brute-force both hi and lo as lo can be set to any value and does not influence the output). 2^64 Math.random() randomUUID() .floor() 2^32 Brute-force flow consists of acquiring a single ID and testing possible high values that could have generated it. With some optimization and average laptop hardware, it can take just a couple of minutes and does not require sending lots of requests to the server as in the Sandwich attack but rather performs all operations offline. The result of such an approach causes replication of the generation function state used in the backend to get all created and future reset links in the password recovery example. Steps to prevent vulnerability from emerging are straightforward and shout out for the use of cryptographically secure functions, e.g. . crypto.randomUUID() Takeaways UUID is a great concept and makes the lives of data engineers a lot easier in many application areas. However, it should never be used in relation to authentication, as in this article, flaws in certain cases of its generation techniques are brought to light. It obviously does not translate to the idea of all UUIDs being insecure. The basic approach, though, is to persuade people not to use them for security at all, which is more efficient and, well, secure than setting complex limits in documentation on which to use or how not to generate them for such purpose.

Never Rely on UUID for Authentication: Generation Vulnerabilities and Best Practices

প্রমাণীকরণের জন্য কখনই UUID-এর উপর নির্ভর করবেন না: প্রজন্মের দুর্বলতা এবং সর্বোত্তম অনুশীলন

Verlassen Sie sich bei der Authentifizierung niemals auf UUID: Generierungsschwachstellen und Best Practices

Nunca confíe en UUID para la autenticación: vulnerabilidades de generación y mejores prácticas

Ne vous fiez jamais à l'UUID pour l'authentification : vulnérabilités de génération et meilleures pratiques

प्रमाणीकरण के लिए कभी भी UUID पर निर्भर न रहें: उत्पन्न होने वाली कमज़ोरियाँ और सर्वोत्तम अभ्यास

認証に UUID を決して使用しないでください: 生成の脆弱性とベスト プラクティス

인증을 위해 UUID에 의존하지 마십시오: 생성 취약점 및 모범 사례

Nunca confie no UUID para autenticação: vulnerabilidades de geração e práticas recomendadas

Никогда не полагайтесь на UUID для аутентификации: уязвимости поколений и лучшие практики

Kimlik Doğrulama için Asla UUID'ye Güvenmeyin: Güvenlik Açıkları Oluşturma ve En İyi Uygulamalar

Không bao giờ dựa vào UUID để xác thực: Các lỗ hổng thế hệ và các phương pháp hay nhất

永远不要依赖 UUID 进行身份验证：生成漏洞和最佳实践

The Power of Campaign Management in Driving Business Objectives and Checkout Success

Mission Generation Using Classic Machine Learning and Recurrent Neural Networks in Zombie State

জম্বি রাজ্যে ক্লাসিক মেশিন লার্নিং এবং পুনরাবৃত্ত নিউরাল নেটওয়ার্ক ব্যবহার করে মিশন জেনারেশন

Missionsgenerierung mit klassischem maschinellem Lernen und rekurrierenden neuronalen Netzwerken im Zombie-Zustand

Generación de misiones utilizando aprendizaje automático clásico y redes neuronales recurrentes en estado zombie

Génération de mission à l'aide de l'apprentissage automatique classique et des réseaux de neurones récurrents dans un état zombie

ज़ोंबी स्टेट में क्लासिक मशीन लर्निंग और रीकरंट न्यूरल नेटवर्क का उपयोग करके मिशन जनरेशन

ゾンビ状態での古典的な機械学習とリカレントニューラルネットワークを使用したミッション生成

좀비 상태에서 고전적인 기계 학습과 순환 신경망을 사용한 미션 생성

Geração de missão usando aprendizado de máquina clássico e redes neurais recorrentes no estado zumbi

Генерация миссий с использованием классического машинного обучения и рекуррентных нейронных сетей в состоянии зомби

Zombie State'te Klasik Makine Öğrenimi ve Tekrarlayan Sinir Ağlarını Kullanarak Görev Oluşturma

Tạo nhiệm vụ bằng cách sử dụng mạng lưới thần kinh định kỳ và học máy cổ điển ở trạng thái Zombie

在僵尸状态下使用经典机器学习和循环神经网络生成任务

Talks On Productivity: Evgeniya Malina - Head of Processes and Automation at Whizz 

Stories, News & Mentions about ENTERINFI

Enterinfi’s Stories on HackerNoon