You wouldn’t drive a car without brakes…\n\nOr skydive without a parachute…\n\nThen why shoulder digital transformation without the guard rails?\n\nGet INVIGRID on your side

Invi Grid

invigrid

HackerNoon Reporter: Please tell us briefly about your  background. My name is Inti De Ceukelaire - I’m a 26 year old hacker from Belgium. I’ve always enjoyed breaking stuff, but I was too well-raised to become a cybercriminal. And now I’m proud to coach Europe’s largest crowd of ethical hackers, helping companies to improve their security on a daily basis! What's your startup called? And in a sentence or two, what does it do? Intigriti is an ethical hacking platform that matches companies with security researchers across the globe. We challenge our community of 35.000 researchers to ethically hack our customers, and in exchange, they get paid “bug bounties” worth up to €50.000 for every vulnerability they may find! Unlike the name may suggest, Intigriti is not derived from my name “Inti” - the name existed well before I joined. We have a standing world record of people misspelling Intigriti (intigrity, integrity, you name it, we heard it!). What is the origin story? Intigriti was originally founded by my business partner Stijn Jans in 2016. Gaining local recognition in the cybersecurity field while working for the Belgian press, I noticed the press release simply because Intigriti sounded like my name - so I sent Stijn a message telling him he better make this company a success because people will inevitably think I’m the one behind it (to this day, a lot of people think I am the original founder because of the name). Then I found out he was living a few blocks away from me and we met in a bar later that night. I ended up signing a contract as co-founder that very night and quit my job at the Belgian public broadcast company. What a company name can do! What do you love about your team, and why are you the ones to solve this problem? Intigriti is a platform for hackers - built by hackers. The hacker culture is present throughout all layers of our organization, and we try to involve community members as much as possible when trying to solve tricky problems. We’re all very passionate people trying to create a sustainable space for people just like us. If you weren’t building your startup, what would you be doing? I would spend even more time hacking! There is nothing as fulfilling and exciting as helping to make the internet a safer space. There’s always more research to be done, more techniques to explore and more cybercriminals to stop. At the moment, how do you measure success? What are your core metrics? Intigriti has two main components: the ethical hacker community and our customers - the companies they hack on. In order for us to succeed, we need to invest in both sides of the table. Balance is key: you can’t have have a small crowd for a large amount of customers, but on the other hand, you need to make sure you have enough interesting companies to entertain your crowd and help them become successful. We’ll look at customer and security researcher acquisition rate, financials like ARR/MRR, but also the value we provide: what vulnerabilities are found? How well does our team of ethical hackers outperform other solutions? What’s the average severity and complexity of vulnerabilities found? What’s most exciting about your traction to date? Apart from the incredible 500% growth we’ve had, the best part of our journey is the tangible impact we have on people’s lives. From our customers’ perspective, our ethical hacker community was able to prevent billions worth of cybersecurity breaches. More than 70% of our customers receive a high to critical vulnerability within the first hours after launching their program with us, many of which had several security tests from well-established companies in the past. On the ethical hacker’s side, we’re enabling people to help contribute to the security of hundreds of companies across the globe, hone their skills and earn money where they want, whenever they want - regardless of their gender, race, or experience. What technologies are you currently most excited about, and most worried about? And why? I can be both excited and worried about artificial intelligence. I believe AI will help us with detecting and resolving vulnerabilities before malicious actors can find them, but I’m also worried about how they may pose additional risks as attackers may implement it into their workflows. Offensive cybersecurity is a cat and mouse game, and involving an artificially intelligent battle force in the fight is a thrilling challenge! What drew you to get published on HackerNoon? What do you like most about our platform? It probably won’t surprise you that I’m in love with the name. The positive usage of the word ‘hacker’ is something we need to encourage - the hacker community is the greatest, most welcoming family you can imagine. What advice would you give to the 21-year-old version of yourself? I wish I had learnt about the “ ” theory earlier in life. I used to worry a lot about things I had no control over and could not do anything about. Now, I try to approach each problem that comes up from the positive side: worrying about stuff never fixed anything! circle of influence What is something surprising you've learned this year that your contemporaries would benefit from knowing? Darwin’s “survival of the fittest” does not prove the strongest animals survive… the most adaptive do! This year, I’ve come to realize this also applies to businesses: the coronavirus pandemic was a challenge to all of us, but despite the uncertain times, a lot of agile companies managed to stay afloat or even skyrocket! Every challenge is also an opportunity to explore additional business services and strategies you may not think of sitting comfortably. Embrace it! Intigriti was nominated as in Startups of the Year hosted by HackerNoon. Go vote for them! one of the best startups in Antwerp

On Making The Internet A Safer Space: Inti De Ceukelaire, Head Of Hackers At Intigriti

This paper is available on arxiv under CC 4.0 license. Authors: (1) Terence Blésin, Institute of Physics, Swiss Federal Institute of Technology Lausanne (EPFL) & Center of Quantum Science and Engineering (EPFL); (2) Wil Kao, Institute of Physics, Swiss Federal Institute of Technology Lausanne (EPFL) & Center of Quantum Science and Engineering (EPFL); (3) Anat Siddharth, Institute of Physics, Swiss Federal Institute of Technology Lausanne (EPFL) & Center of Quantum Science and Engineering (EPFL); (4) Alaina Attanasio, OxideMEMS lab, Purdue University; (5) Hao Tian, OxideMEMS lab, Purdue University; (6) Sunil A. Bhave, OxideMEMS lab, Purdue University; (7) Tobias J. Kippenberg, Institute of Physics, Swiss Federal Institute of Technology Lausanne (EPFL) & Center of Quantum Science and Engineering (EPFL). Table of Links Introduction Results A. Physics and design B. Device characterization C. Bidirectional microwave-optical transduction D. Pulsed transduction Discussion Acknowledgments Appendix A: Theory Appendix B: Fabrication process flow Appendix C: Optical characterization Appendix D: Characterization of acoustic resonances Appendix E: Characterization of bidirectional transduction Appendix F: Optimization of optical extraction efficiency III. DISCUSSION Non-classically correlated microwave-optical photon pairs can be generated through spontaneous parametric down-conversion in our transducer. These correlated photon pairs constitute a key ingredient toward entangling distant quantum processors via the Duan-LukinCirac-Zoller protocol [4, 45]. With the current device parameters, the pair generation rate on chip amounts to 190 Hz, which is well above the thermal decoherence rate for 3.5 GHz at 10 mK as explained in Appendix A 4. However, losses in the measurement setup specific to such an experiment, as well as the gating of the optical pump required to alleviate the effective heat load, are expected to limit further the final heralding rate. Quasi-free-standing structures, such as 1D OMCs, do not readily thermalize and are thus more susceptible to heating effects. Even though our transducer also utilizes a suspended acoustic resonator, it may be feasible to operate at a higher duty cycle than what is presented in Fig. 4. It has been shown that a buffer gas environment can facilitate thermalization of a 1D OMC, at the cost of increased damping of the mechanical breathing mode [46]. On the contrary, the HBAR mode of interest here should be relatively insensitive to such viscous damping, as the acoustic wave propagates predominantly along the longitudinal direction inside the cladding. Therefore, a sample cell affixed to the mixing chamber flange and filled with buffer superfluid helium—an inviscid fluid that is both an excellent thermal conductor and electrical insulator—could potentially improve the heralding rate without hampering the conversion efficiency [47]. The present design is also suited for tasks beyond quantum state transfer. The transducer can be a key component of photonic interconnects for superconducting qubits [7, 8], where laser lights routed through optical fibers are used to encode microwave signals directly inside the dilution refrigerator during qubit readout. It may be challenging for traveling-wave EOMs to attain the requisite half-wave voltage to be competitive in noise performance against conventional all-electrical readout scheme utilizing high-electron-mobility transistor amplifiers [8]. Our triply resonant approach affords a path towards a scalable optically controlled cryogenic waveform generator for both qubit readout and control. The multimode nature of the transducer is particularly suited for frequency-multiplexed dispersive readout. Transduction leveraging multiple HBAR modes is already demonstrated in Fig. 3e. One can additionally utilize line-type instead of point-type dimer coupling for the photonic molecule, which gives rise to a dispersion in the supermode splitting [48]. In combination with the multitude of acoustic overtones, a single transducer can therefore support several spectrally distinguishable triply resonant systems that serve as qubit multiplex channels. Finally, since the transducer requires no superconducting element to function, it may be pertinent for applications in classical microwave photonics. Optimization of design and fabrication should engender further improvement on device performance. The conversion efficiency, proportional to microwave extraction efficiency (Eq. 2), can be improved by replacing AlN with scandium-doped AlN [49], which features a piezoelectric coefficient d33 about five times larger than AlN [50, 51] while preserving CMOS compatibility. There is likewise additional upside on the photonics (Appendix C 1). Bending radiation loss can be significantly reduced by increasing the micro-ring radius r. In particular, intrinsic quality factor exceeding 107 has been demonstrated with an r approximately ten times larger using the same fabrication process [52]. It may be anticipated that the efficiency gain here may be chiefly compensated by the reduction in optomechanical coupling rate g0 ∼ 1/ √ r. Nevertheless, by thinning the waveguide to 200 nm that approaches half of the acoustic wavelength, g0 is expected to remain unchanged. As in the thick-core waveguide fabricated using the photonic Damascene process, such a thin-core waveguide on a subtractive manufacturing platform is expected to exhibit negligible bending loss [53]. Assuming critical coupling conditions (Appendix F), we therefore expect another 1.5- time gain in η tot. Finally, optical insertion loss can be nearly eliminated by employing a spot-size converter to facilitate mode-matching with lensed fiber [54–56]. Combining these improvements, our transducer could achieve a total efficiency η tot = 6 × 10−3 . In conclusion, we have designed, fabricated, and characterized a compact piezo-optomechanical microwaveoptical transducer that integrates wafer-scale, CMOScompatible HBAR and Si3N4 photonic technologies. Free of any superconducting components, this triply resonant transducer attains a bidirectional off-chip photon number conversion efficiency of 1.6 × 10−5 and a bandwidth of 25 MHz, with an input pump power of 21 dBm at room temperature. Multimode transduction leveraging distinct HBAR modes have been demonstrated, suggesting prospects for designing frequency-multiplexed photonic interconnects for superconducting qubits. Realistic design and fabrication improvements may even allow access to experiments in the quantum regime.

Bidirectional Microwave-optical Transduction Based on Integration: Discussion

240 Stories To Learn About Startups Of The Year

Joining the cybersecurity field as an outsider without a technical background was a transformative journey for me. What immediately captivated me about the industry was its relentless pace and the exhilarating challenge it constantly presented. Interacting with professionals in the field, I was heartened by their overwhelming support for newcomers who genuinely exhibited the will to learn. However, I quickly found a prevailing sentiment: there's a general expectation for newcomers to be independent self-learners. This could be a daunting expectation, especially considering that many potential beginners in aren't inherently self-learners. While innate curiosity is undoubtedly a valuable trait, it's essential to recognize that many individuals, even those with immense potential, need a structured framework to move their initial steps into this vast domain. cybersecurity In the last few years, significant progress has been made in filling the talent gap in the industry. However, as of 2023, according to the , there were 440,000 new jobs created in cybersecurity globally (an 8.7% increase year over year), but a staggering 4 million positions remained unfilled (a 12.6% increase year over year). This enormous gap results from the disconnect between employers' needs for experienced professionals and the real-world shortage of such expertise ISC2 Cybersecurity Workforce Study The solution to this talent crunch lies in focusing on the early stages of potential cybersecurity professionals' careers, particularly young students. As a community, it's imperative that we equip the youth with the tools they need to explore cybersecurity as a viable career option. The key is to offer structured, practical, and accessible learning paths. Below are some steps and examples of how to do so. Study Frameworks Like NIST-NICE The NIST-NICE framework categorizes cybersecurity work into seven high-level categories: Analyze, Collect and Operate, Investigate, Operate and Maintain, Oversee and Govern, Protect and Defend, and Securely Provision. Each category is further divided into specialty areas and work roles, providing a comprehensive roadmap for career progression. Table 1: NICE Framework Work Role Categories Category Description Number of Work Roles Securely Provision (SP) Conceptualizes, designs, procures, and/or builds secure IT systems. Responsible for aspects of system and/or network development. 11 Operate and Maintain (OM) Provides the support, administration, and maintenance necessary to ensure effective and efficient IT system performance and security. 7 Oversee and Govern (OV) Provides leadership, management, direction, or development and advocacy so the organization may effectively conduct cybersecurity work. 14 Protect and Defend (PR) Identifies, analyzes, and mitigates threats to internal IT systems and/or networks. 4 Investigate (IN) Investigates cybersecurity events or crimes related to IT systems, networks, and digital evidence. 3 Analyze (AN) Performs highly-specialized review and evaluation of incoming cybersecurity information to determine its usefulness for intelligence. 7 Collect and Operate (CO) Provides specialized denial and deception operations and collection of cybersecurity information that may be used to develop intelligence. 6 This table showcases the broad spectrum of roles within the cybersecurity landscape. By understanding these categories, beginners can better position themselves for a more tailored and informed career trajectory. For a comprehensive understanding of the NIST-NICE framework and to access a myriad of resources tailored for beginners, one can visit the . NICE's Getting Started Resource Center The goal is to explore various facets of cybersecurity and determine where passion intersects with proficiency. Since cybersecurity is a dynamic field, there's always room for an individual to pivot, learn, and evolve. Become Friends with Real Hackers The cybersecurity community is exceptionally supportive of newcomers. Even seasoned professionals are often open to sharing tips and advice and are incredibly accessible to beginners. The secret to meeting these people is to attend live events. Real-time interactions at in-person events offer spontaneous questions, discussions, and the possibility for deeper understanding. It’s not just about soaking in knowledge; it's also about networking. These venues are prime opportunities for establishing meaningful connections, potentially leading to mentorships, job placements, or even collaborative projects. Furthermore, many such gatherings have live challenges or hands-on workshops where attendees can put theory into practice, often under the guidance of an expert. Here's why attending in-person events can be so beneficial for a cybersecurity enthusiast: Directly engage in challenges or workshops, honing skills in real time. Skill Demonstrations: Cybersecurity is ever-evolving. Engage in fresh, cutting-edge discussions that might not have reached the wider online community yet. Staying Updated: Share experiences and challenges with peers. It's comforting and motivating to know others face similar challenges. Moral Support: When it comes to venues, some platforms and organizations stand out: (Open Web Application Security Project): Renowned for its insights into web vulnerabilities, its global chapters regularly hold meetings and workshops. OWASP : These community-driven events offer a cozier, more intimate setting for discussions and learning. BSides : One of the hacker conventions, it is an excellent place for someone keen on diving deep into hacking and cybersecurity. DEF CON When planning to attend, here are a few tips: Don't just be a passive participant. Engage, ask, discuss! Engage Actively: Go through the event's schedule, note down sessions of interest, and research the speakers. Prepare: Did you connect with someone interesting? Drop them a thank-you note or a simple message post-event. It could be the start of a valuable relationship. Follow-up: So, if you're aiming to deepen your cybersecurity knowledge and network, attending such events could be the stepping stones to your next big opportunity. Participate in CTF Challenges and Hackathons Capture The Flag (CTF) challenges are competitions where participants solve cybersecurity puzzles ranging from cryptography to web application vulnerabilities. These challenges offer beginners a practical, hands-on experience in solving . For example, the DEF CON CTF event annually attracts a global audience and has puzzles suitable for all skill levels. real-world cybersecurity problems Engaging in CTF challenges directly correlates with several areas outlined in the NIST-NICE framework: Analyze (AN): Deciphering cryptographic puzzles in CTFs sharpens skills pertinent to the Analyze category, where one evaluates incoming cybersecurity information. Protect and Defend (PR): Addressing vulnerabilities during a CTF strengthens a participant's capabilities in identifying, analyzing, and mitigating threats to IT systems, aligning closely with the Protect and Defend category. Investigate (IN): Some CTFs involve forensic challenges, aligning with the Investigate category, where one examines cybersecurity events or crimes related to IT systems. Securely Provision (SP): Tackling challenges where participants must secure or harden systems mirrors the Securely Provision category, emphasizing the design and creation of secure IT systems. By immersing oneself in CTFs, beginners not only gain valuable hands-on experience but also better understand the different roles and areas they might be interested in as per the NICE framework. It provides a tangible, engaging way to explore and deepen specific cybersecurity competencies. Join Bug Bounty Campaigns In a bug bounty campaign, companies incentivize ethical hackers to find and report vulnerabilities in their systems. This practice is becoming increasingly prevalent among leading technology companies, realizing the value of the global pool of independent security researchers. For instance, tech giants like Google, Facebook, Apple, Microsoft, and Twitter have all rolled out their own bug bounty programs, encouraging ethical hackers to identify and responsibly disclose potential security flaws in their platforms. By offering these campaigns, these organizations not only enhance the security of their systems but also foster a symbiotic relationship with the cybersecurity community. For example: Google's Vulnerability Reward Program (VRP) rewards researchers who uncover security vulnerabilities in Google's products and services. Their reward amounts can range from $100 to over $30,000, depending on the severity of the flaw and the product affected. In some exceptional cases, even higher rewards have been granted. Google's VRP has been instrumental in ensuring the security of products such as Google Chrome, Android, and Google Cloud Platform. Apple's Security Bounty Program invites security researchers to find vulnerabilities across iOS, macOS, and other Apple software. The payouts can be quite substantial, with rewards for the most critical issues reaching up to $1 million. This reflects Apple's commitment to user privacy and security. Platforms like Bugcrowd, Hackerone, and Intigrity have also streamlined the process, acting as intermediaries connecting ethical hackers with organizations, including those that might not have independent programs like Google or Apple. Once a vulnerability is identified and reported through these platforms or directly to the companies with established programs, it undergoes a verification process. If validated, the researcher could receive a financial reward, recognition, or both. Focus on Practical-led Training For beginners, there are web browser-based labs. These labs allow users to practice in a controlled environment directly within their browsers. While convenient and easy to access, these platforms might not fully replicate the complexities and intricacies of real-world systems. They are good introductory tools, but as users progress in their cybersecurity journey, they might find them less challenging. On the other hand, there are virtualized environments that require VPN access. These platforms offer environments that are almost identical to actual company infrastructures. The virtualized scenarios are meticulously crafted to emulate real-world networks, servers, and workstations. As users connect via VPN, they feel as if they are truly inside an operational network, providing a level of authenticity that web browser-based labs might lack. This type of environment allows for a deeper exploration of tools, tactics, and procedures, effectively training the participant to tackle genuine cybersecurity threats. The rigorous training in these environments ensures that participants are job-ready and fully prepared to address the multifaceted challenges they might face in their cybersecurity careers. By experiencing both types of training, candidates can appreciate the gradient of complexity in cybersecurity challenges and better hone their skills to be effective professionals. Here is a list of free or affordable practical cybersecurity training resources for beginners: : Provides a series of war games designed to teach the principles of security from the basics to advanced concepts. It's a great starting point for beginners wanting to learn Linux commands and simple penetration testing techniques. OverTheWire : This platform offers more than 300 challenges across different domains to help users improve their hacking skills. It provides a hands-on approach to learning about network security, web application security, and more. Root Me : Developed by the creators of the Burp Suite, this academy offers free hands-on web security training. It covers a wide array of topics from basic to advanced web vulnerabilities. PortSwigger Academy : Provides a beginners-friendly courses paired with VPN-based real-world training experience, emulating genuine cybersecurity scenarios. PWNX.io : A platform designed primarily for students to learn about cybersecurity. It offers educational modules tailored to different skill levels. PWN.college : An online platform that aids learning in cybersecurity through hands-on virtual labs. Its gamified challenges range from the very basics to more advanced, catering to users of all skill levels. TryHackMe A platform that provides various cybersecurity labs and challenges. While it does cater to users of all skill levels, some of the challenges can be very advanced, making it ideal for those looking to progress beyond the basics. Hack The Box: TCM Security offers self-paced cybersecurity courses that cover topics such as penetration testing, security training, and compliance. Additionally, they provide certifications that are increasingly gaining reputation in the industry. TCM Security: The resources mentioned above represent just a snapshot of the many tools and platforms that have gained attention and appreciation within the cybersecurity community. The realm of cybersecurity training is vast, and the list of valuable resources extends far beyond what's provided here. Additionally, there are numerous open-source projects and other content available online that can be instrumental in enhancing one's learning journey. Specialized forums and websites, which I will detail in the next paragraph, can be invaluable in discovering reviews or feedback from other community members. This feedback provides insights into the quality of new resources that are constantly being released. Leverage Social Media and Forums to Find a Mentor In the vast realm of cybersecurity, guidance from someone experienced can make all the difference. Platforms like LinkedIn can be particularly beneficial, not just for networking, but also for identifying potential mentors. By carefully reviewing profiles, joining relevant groups, and actively participating in discussions, you can showcase your eagerness and catch the attention of experienced professionals willing to guide newcomers. Discord, a platform initially created for gamers, has burgeoned into a hub for various professional communities. Specialized forums and websites further amplify the opportunity: Reddit’s Cybersecurity Communities: Platforms like and subreddits are teeming with professionals and enthusiasts discussing the latest in security trends, challenges, and solutions. The subreddit is particularly designed for students and beginners, fostering a nurturing space for queries and guidance. Reddit's Cybersecurity Netsec Netsecstudents Wilders Security Forums: Dive deep into discussions about online privacy, security, and data protection on . The vast range of threads and posts signifies a dedicated community, making it an invaluable resource for all cybersecurity-related topics. Wilders Security Forums MalwareTips and Antionline Forums: Websites like and are vibrant communities where one can engage in in-depth discussions on various facets of security, from malware threats to network safety. MalwareTips Antionline Bleeping Computer and Spiceworks Community: Forums such as and the are dedicated to comprehensive security-related discussions, from firewalls and VPNs to password managers and malware attacks. Bleeping Computer Spiceworks Security Forum Hacklido: A unique platform, is where the brightest hackers come together to share knowledge, experiences, and guidance. It's a rich source of practical insights and real-world examples. Hacklido By actively engaging in these forums and communities, not only can one expand their knowledge but also build meaningful connections. As you participate and contribute, the chances of meeting potential mentors who recognize your passion and dedication increase significantly. Remember, mentorship in cybersecurity is not just about learning the ropes; it's about guidance, feedback, and understanding the nuances of the rapidly evolving world of digital protection. Make Use of Free Tools As you embark on your cybersecurity journey, it's essential to familiarize yourself with the plethora of free tools available. These tools, widely recognized and utilized by professionals in the field, can significantly augment your learning experience: Wireshark: An open-source packet analyzer, Wireshark allows users to see what's happening on their network at a microscopic level. It's widely used for network troubleshooting, analysis, software, and communications protocol development, and education. Description: The tool comes with a range of to help newcomers grasp its functionalities. Resource: official documentation and guides OWASP ZAP (Zed Attack Proxy): Developed by OWASP (Open Web Application Security Project), ZAP is a free, open-source web application security scanner. It helps find security vulnerabilities in web applications while you are developing and testing them. Description: New users can benefit from the tool's and various community-contributed guides. Resource: official documentation Metasploit Community Edition: Part of the Metasploit Project, this edition is a free-of-charge penetration testing tool that helps verify vulnerabilities and manage security assessments. It aids in the discovery, analysis, and exploitation of vulnerabilities. Description: Metasploit provides a plethora of for various functionalities. Resource: tutorials and user guides Snort: As an open-source network intrusion prevention system (NIPS) and intrusion detection system (IDS), Snort is adept at performing real-time traffic analysis and packet logging. Description: Beginners can find extensive documentation and a community of users on the . Resource: Snort official website OpenVAS (Open Vulnerability Assessment System): OpenVAS is a full-featured vulnerability scanner that comes with numerous tests and offers updates for the latest vulnerabilities. It assists in identifying issues in systems and applications. Description: The OpenVAS community provides a to support new users in understanding and maximizing the tool's capabilities. Resource: comprehensive set of documentation Kali Linux: Kali Linux is a Debian-based Linux distribution that's geared towards advanced penetration testing and security auditing. It comes pre-installed with hundreds of integrated security tools, making it a staple in the cybersecurity community. Description: For those new to Kali, the offers comprehensive guidance, ranging from installation to utilizing its vast array of tools. Resource: official documentation Harnessing the capabilities of these tools not only gives beginners a practical understanding of various cybersecurity domains but also provides a hands-on approach to combating potential threats. Remember to explore the associated documentation and tutorials for each tool, as they often hold a wealth of knowledge and best practices. Untapped Potential and the Need for Guidance While there are self-learners who manage to connect the dots on their own, a vast number of budding talents are not yet part of the , mainly because they lack initial guidance. By providing targeted and practical guidance, we can help pave the way for a new generation of cybersecurity professionals ready to take on the challenges and opportunities that this rapidly evolving field has to offer. cybersecurity ecosystem Structured learning can be achieved in various ways, and this guide aims to offer an alternative perspective, coming from a non-traditional cybersecurity professional who had the unique opportunity to learn from genuine hackers.

You are Not Learning Alone: a Structured Guide for Cybersecurity Beginners

আপনি একা শিখছেন না: সাইবার সিকিউরিটি নতুনদের জন্য একটি স্ট্রাকচার্ড গাইড

Sie lernen nicht alleine: ein strukturierter Leitfaden für Einsteiger in die Cybersicherheit

No está aprendiendo solo: una guía estructurada para principiantes en ciberseguridad

Vous n'apprenez pas seul : un guide structuré pour les débutants en cybersécurité

आप अकेले नहीं सीख रहे हैं: साइबर सुरक्षा के शुरुआती लोगों के लिए एक संरचित मार्गदर्शिका

あなたは一人で学んでいるわけではありません: サイバーセキュリティ初心者のための構造化ガイド

혼자 배우는 것이 아닙니다: 사이버 보안 초보자를 위한 체계적인 가이드

Você não está aprendendo sozinho: um guia estruturado para iniciantes em segurança cibernética

Вы не учитесь в одиночку: структурированное руководство для новичков в области кибербезопасности

Yalnız Öğrenmiyorsunuz: Siber Güvenliğe Yeni Başlayanlar İçin Yapılandırılmış Kılavuz

Bạn không học một mình: Hướng dẫn có cấu trúc dành cho người mới bắt đầu về an ninh mạng

你不是一个人学习：网络安全初学者的结构化指南

Working in cybersecurity can be a very fulfilling career, but most jobs require some amount of experience or formal training. While there are many great courses and certifications for learning pen-testing out there, it might be the case that they are simply above your budget. But that is totally fine. I think it is still possible to get job-ready knowledge about and pen-testing from free resources. cybersecurity A little warning: While I feel like it is possible to spend no money on your way to the first pen-testing job, it is the case that some paid resources provide knowledge in a condensed and easy-to-digest form. Having access to those resources might accelerate your learning journey. So I will provide some recommendations on which of them are worth it and which are not. I also created a GitHub repo with free cybersecurity resources. Check it out, and feel free to add some: https://github.com/her0marodeur/awesome-free-cybersecurity A few words about my own career I got really lucky in terms of getting a job. My first contact with cybersecurity was back in my teenage years when I Googled “ .” That was back when there were no such resources as HackTheBox and TryHackme. So, a lot of the learning was more theoretical and, in general, kinda slow. How to become a hacker After I finished school, it was time to look for a job. I started out with a student job for a big software company. There, I had the opportunity to work with different security teams. During this time, I did my eJPT certification and got in contact with the internal pen-testing team. They provided me with the opportunity to do an internship and paid for my OSCP. After I finished my Bachelor’s degree, I got offered a full-time job as a pentester. As I mentioned, I got lucky, but I think there are a couple of takeaways from my own story: The demand for pen-testers is currently very high, so many companies are willing to train existing employees. So if you are already working for a company, see if they have an internal pen-testing or security team. The most important characteristics of a pentester (hacker) are willingness to learn and curiosity. Getting them does not cost a penny. One of the mistakes I made was focusing too much on the theory and not getting enough hands-on experience. This is really important, and you should try to get as much practice as possible. The role of certifications and degrees I know you probably want to get into learning right away, but I think we should have a brief discussion about this topic. There is a decade-long ongoing discussion about the difference between and which is better and a lot more. I don’t want to dive into all that stuff. certifications and degrees Generally speaking, a degree or a certification is a verifiable and easy way for employers to assess the skills of an applicant. The OSCP or a computer science degree does show that the candidate has skills and knowledge in a certain area. If you have to filter through hundreds of applications, they give a good orientation. But there are two big things to take into consideration: There are other ways of getting experience and knowledge. I have friends who have maintained Minecraft servers since they were twelve years old, and they have extremely good programming skills, even without having a degree. And their salaries are comparable to some seniors in the industry. Even tho there has been a huge interest in pen-testing in the last couple of years, the demand has skyrocketed as well. That means employers are not getting hundreds of applications. Many times, it is actually the case that pen-testers are getting many job offers just because they have a LinkedIn profile. Paid Certifications to avoid: For some reason, this is still seen as a good certification, but from everything I have heard, they provide a really dry course, and the exam requires you to memorize a lot of stuff. So you can save your money. Certified Ethical Hacker (C|EH): I did this one myself, and it was fun; the exam was really hands-on and enjoyable. The reason I don’t recommend it is that I don’t think it is really beneficial in terms of getting a job because I don’t feel like employers are valuing it. eLearning Security Junior Penetration Tester (eJPT): Paid Certifications you can do (if you have the money): I don’t hold this certification myself, but I did Heath Adams courses back in the day. The content is just great and really well explained. It covers a lot of topics. The exam is more relaxed than the OSCP, and it has industry recognition at the lowest price. Practical Network Penetration Tester (PNPT): The OSCP has its pros and cons, and I wouldn’t recommend that you take a loan to do it or bust your bank account. But in a situation where you can really afford to do it (considering money AND time), I have to admit it has a great course, and it is basically a job guarantee. If you want to learn more about it, check out my blog here: Offensive Security Certified Professional (OSCP): https://infosecwriteups.com/methodology-and-mindset-for-passing-the-oscp-d609592a7dcb Getting the knowledge To know where you should start, you have to know where you stand. It is a big difference if you already have fundamental IT knowledge or if you are coming from a different profession because it is absolutely necessary to understand basic computer science concepts like networking and how programs, web pages, and computers are built and running. Since I suspect that many readers of this article will have this knowledge, I will not talk too much about learning all that stuff. has some really cool courses to learn the basics, and I think installing your own web server and learning the basics of Python really helps a lot. There are also basic computer science courses on sites like . TryHackMe Coursera TryHackMe and HackTheBox As well as for basic knowledge, I think you should really start with for learning the basics of pen-testing; they have some really good paths for this. Sadly, some of them might be only accessible via a paid membership. I think the paid membership is really one of the best investments you can make because it is quite cheap and provides access to a lot of knowledge. TryHackMe If you are thinking about what kind of pen-testing (mobile, web, network, Red Teaming, etc…) to learn first, I suggest you go with web pen-testing because there are many resources about it, and when we talk about Bug Bounty later, most of the targets are available in this area. But if you feel like doing something else, do it; all of this is just my opinion. Additionally, to do the learning path, you should also do some of their boxes that don’t give you any hints about how to solve them. Also, check out for this; they also have some great boxes, but beware of their rating system. I recommend you really start with easy boxes. HackTheBox When solving boxes, I recommend you give yourself a time limit. I recommend something like this: If you don’t have the initial foothold after 30 minutes, you should check a writeup. Afterward, you try 30 mins for privilege escalation, and if you don’t get it, check the writeup again. It might be true that there is no writeup in a real pentest, but doing boxes is about getting as much knowledge as possible. Also, start pushing yourself as soon as possible and increase the difficulty. It may mean that you might need a write-up for almost every step, but it also means you learn something new with every box. Free certifications: This one is a must-have. It is just the right mix between great course content and realistic and challenging exercises. APISec University: This one is not really about pen-testing but covers a lot of the basics of cybersecurity. But these topics are important for pen-testers as well because they always have to see the bigger picture of cybersecurity. The course and exam are free, but it requires an annual maintenance fee. ISC2 Certified in Cybersecurity (CC): : Another one that is not directly about pen-testing. It explains one of the essential policies of cybersecurity, and employers would like knowledge about this one. Skillfront ISO/IEC 27001 Information Security Associate™ If you love certifications as I do and want some more for free, please check out my GitHub Repo over here: https://github.com/her0marodeur/awesome-free-cybersecurity Getting the experience By now, you already hacked some machines and websites, but all of them were in a simulated environment and left vulnerable by design. While this provides valuable experience and gives you the ability to learn how to exploit vulnerabilities, it is not necessarily the experience employers are looking for. Therefore, I recommend you try your skills against some real-world targets (in a legal way). Luckily, Bug Bounty platforms allow you to do this and maybe earn some money. Bug Bounty Platforms You can check out the following platforms: https://www.bugcrowd.com/ https://www.hackerone.com/ https://www.intigriti.com/ https://yeswehack.com/ Look at their programs and get familiar with the general topic of Bug Bounty (try to avoid the Twitter and Medium hustler bubble; there is some really bad stuff out there). I suggest you start by looking at Katie Paxton-Fear’s stuff ( ). She has some great videos that are really for beginners. But don’t stress too much about all of it; sign up for a platform, pick a program, and hunt. This is what life as a pentester is going to be like. Also, be careful and don’t bother too much about all of the tools, oneliners, and scanners. Learn about the recon fundamentals ( ) and start hunting. https://insiderphd.dev/ https://www.youtube.com/watch?v=krCsMZfbuB4 If you get one or the other bug, it is great for your CV because it shows you know how to apply your pen-testing knowledge to real-world targets. Synack Red Team https://www.synack.com/red-team/ This one really depends on how much time you want to spend before getting a job as a pentester. I am not part of it, but I heard really good stuff about it. It basically is a closed Bug Bounty platform, but they additionally offer some fixed pay jobs like checking default credentials or OWASP Top 10. However, you have to apply to them, and this process can take a while. But it gives you the chance to have some experience with a real-world job application. It offers great hands-on experience and looks good on your CV. So check it out and see if it is for you. Getting the job If you are following this blog (btw. please read more resources than just this one; there is a lot of great career advice out there), I hope you don’t think of it as something that has to be done in chronological order. You can skip things and do them in parallel, or however it feels right for you. Writing a CV Before you go out and look for a job, you should write a CV. This really should focus on showcasing skills that you can apply to your pen-testing job. So if you have worked in another job, think about how you can translate the skills you gained to pen-testing. If you are a programmer, tell them you have a deep understanding of technology and for sure you had to implement security measures in your code, and probably you know how developers think and fail. If you have worked as an executive assistant, you have probably done a lot of writing and have clear communication skills, which is also really beneficial for pen-testing. By now, you have done at least some certifications and courses, but be careful what you include in your CV. I think, if you have done the three free certs I mentioned, you should include all of them, as they really showcase skills and knowledge needed for your job. But you want to be careful not to include every little thing. Rather than including the certificate of completion for every TryHackMe track you did, you should just include your TryHackMe profile. And for bug bounty profiles, you only want to mention the sites where you have at least one accepted submission. If you put too much basic stuff in there, it probably seems desperate. For writing the actual CV, you should not get too creative. It is best to either download a Word template and fill it in with your experience and skills or use one of the online generators (consider privacy implications). Be aware that your CV is often times read by machines, so make it “machine-readable.” Getting yourself out there Being visible can be really helpful if you want to get a job. I think having a is crucial. So create one, put a nice photo and some experience on it, and maybe include “aspiring pentester” in your bio to make yourself visible when recruiters search for possible candidates in this area. well-maintained LinkedIn profile You can also do a little bit more to increase visibility. A nice thing to do is to start a blog. Like this one, you are just reading. Even tho you might not have a lot of expert knowledge; you can talk about your journey and experiences or write a tutorial for a tool or a writeup for a box you did. But please don’t go down 1337 Hacker Road. I don’t think that blogs like “Hack a webcam with only three steps,” “Hacking Instagram password,” and other clickbait help find employment. Other things you can do are contribute to GitHub projects (for example, Nuclei and Spiderfoot allow you to contribute new rules and templates), create your own tools, or speak at a conference. All of these things will increase your network and look great on a CV. Applying for jobs Go for quality over quantity. The job has to be a match for you as much as you have to be a match for the job. So, really try to find jobs that match your expectations. While I say that, it is also true that it is probably easier to pivot from one pen-testing job to another than getting into the industry, but I feel bad advising anyone to take a job they don’t enjoy. I highly recommend you reach out to recruiters/headhunters. You can easily find them on LinkedIn, add them to your network, and ask if they have a role that fits your profile. It will not cost you a penny because the employers are paying them. They will also be a big help with streamlining a lot of the process. They know their clients and where you have a good chance of getting hired and, most of the time, allow you to skip steps like writing a cover letter. Even if they are not able to offer you something right away, they will add you to their contact list and reach out in the future. Interviews There are just better resources than I am, so I will link to them: The Cyber Mentor- Mock Job Interview: https://www.youtube.com/watch?v=IDpjaS6OYPU The Cyber Mentor — What to Expect in an Ethical Hacking Job Interview: https://www.youtube.com/watch?v=nrewE1mLlaU Security Interview Questions: https://github.com/justinltodd/security-interview-questions Conclusion While it should be entirely possible to get a pen-testing job without spending a dollar, it will still require a lot of work. Spending at least some money can make the process if you spend it right. I also have to mention that all of this is just my personal experience and perspective. Your mileage may vary. If you liked this blog post, you can follow me on Twitter @Secbyaccident or read my other stuff over at . https://security-by-accident.com/ And if you have read this far, I want to offer you a little Thank You. My DMs on Twitter are open, and you can reach out to me if you want me to review your CV, help you with some studying, or set you up with some recruiters. I will do all of this for free, but expect a little delay in response time. Also published here.

Cybersecurity Job Hunting, Pen-Testing Study Plans, and Certifications on a Budget

Let's learn about via these 35 free stories. They are ordered by most time reading created on HackerNoon. Visit the to find the most read stories about any technology. Infosec /Learn Repo 1. How to Get a Reverse Shell on macOS Using A Flipper Zero as a BadUSB Using a Flipper Zero as an ethical pentesting device to establish a reverse shell on a macOS computer. 2. What is URL Masking and How Does It Work? Be careful of the latest engineering technique called "URL Masking", it's quite dangerous. 3. We Need to Talk About Nigeria and Cybersecurity Keeping information secured and protecting the integrity of data over the internet is now becoming a huge and complex task, due to the increasing number of threats to the information security. 4. I Have My Own AWS VPC, and Now You Can Too! Let's see how a default VPC is configured in AWS, CIDR block, the associated subnets within it, routes, NACLs and Security Groups. 5. I Could Crash Your Instagram Remotely. But I Chose to Report It. On April 2019, I had the foolish idea of testing Facebook security (and more specifically Instagram security), after I got informed that the company enabled a new setting on their assets (called Whitehat Settings), making easier for researchers to discover new vulnerabilities (pinning was not a problem, I am just a bit lazy sometimes :P). 6. MITRE ATT&CK & D3FEND Framework are Redefining Counter-efforts to Cyberattacks Implement best security controls with Mitre ATT&CK & D3FEND frameworks
Redefine your organizational security posture to withstand emerging and advance threats 7. The Trouble with FIPS FIPS 140 sets the standard for cryptography used in the United States, but it's got problems. Because of FIPS, we all have problems. 8. Inside a Hacker's Backpack: Gadgets, Tips, and Tricks for Hackers Not ever hack job requires just a laptop and some software to gain privileges into a system. Sometimes, something extra is required to make the job very easy 9. My SIM swap attack: How I almost lost $71K, and how to prevent it 10. 5 Reasons Why We Dont Need To Worry About the SolarWinds Hack There is quite a bit of consternation in the tech universe about the Solar Winds hack. Here are five reasons not to worry about the Solar Winds hack because these are much more important. 11. Mutual Human Authorization: A New Standard in Data Privacy Mutual Human Authorization is a digital communication protocol that SharePass is pioneering to help address persistent data privacy and security gaps. 12. 5 Best Browser Extensions For Protecting Your Privacy Online It is essential for every internet user to comprehend the importance of browser security capabilities to assure they browse the internet safely. Protecting your browser might mean limited functionality of some web sites, but it’ll shield your most sensitive information as well. 13. A Tale of Two Cities: Economic vs Digital Democracy More than new laws and fines, we need to reconsider data ownership as a whole and discover new structures that place control back into the hands of the people. 14. Viewing K8S Cluster Security from the Perspective of Attackers (Part 1) Based on previous penetration testing experience, we have sorted out the possible security issues under the K8S cluster architecture. 15. 'I Worked for Free to Get the Experience': Chris Ray, CISO & Security Researcher Meet Chris Ray, CISO, Security Researcher, and HackerNoon Contributor. [16. CyberSec Games Part I: Backdoors & Breaches](https://hackernoon.com/cybersec-games-part-i-backdoors-and-breaches-96393b0z) Backdoors & Breaches is an Incident Response Card Game that contains 52 unique cards to help you conduct incident response tabletop exercises and learn attack tactics, tools, and methods. 17. Your USB Gadget Could Be Weaponized Cybersecurity experts have been warning us for years about using USB devices.  We look at how an ordinary USB-powered device can be easily weaponized. 18. On Making The Internet A Safer Space: Inti De Ceukelaire, Head Of Hackers At Intigriti Intigriti co-founder, Inti De Ceukelaire, shares their origin story, what makes him excited about his job, and the technology he is currently excited about. 19. Introduction to the Zero Trust Security Architecture — a Concept, Not A Product "Zero Trust" has been around for years. Now, I am writing to lay the fundamental concepts and introduce anyone who wants to bring Zero Trust into practice. 20. How Security Operations is a Journey, Not a Destination: An Analyst’s Perspective “No matter how strong a defense, a stronger offense will always shatter it.”— Byakuya Kuchiki 21. Artificial Intelligence is No Match for Natural Stupidity A Lazy Introduction to AI for Infosec. 22. Questions For The Most Controversial Hacker Of This Generation: Sabu I believe strongly if we get answers to these questions from a source with gravitas, such as Sabu, we will understand how to navigate the future. 23. What is “Cyberbiosecurity?" and why we should stop using the term The term cyberbiosecurity is rapidly making its way around the internet, academic, and government communities. If you want a silly analogy, you might say its spreading like an emerging infection through various host communities. Specifically, communities with no innate immunity to fight off the misinformation. 24. Who Should the CISO Report to? Should the CEO be the sole decision-maker for a CISO's plans? 25. Understanding & Recognizing Different Cyber Threats: What to Look Out For This article will dive into understanding & recognizing some cyber threats. It will not cover every example for each attack or every attack. 26. Why I Hire Non-IT Graduates in The  Cybersecurity Field Essential elements you should have and why I hire non-IT graduates. 27. 10 things InfoSec Professionals Need to Know About Networking So this story stems from the fact that I’ve plopped myself into the InfoSec world from App Development and from my Sec work I’ve really seen and understood that there is a need for a greater security understanding amongst devs, and the planet in general. 28. America's Digital Maginot Line America's critical infrastructure appears to be protected by a Digital Maginot Line 29. Using Macros and Emulation Voodoo to Solve a Crackme This time I’m tackling this beautiful crackme, the third of the series. To solve this we will use radare2’s macros and unicorn emulation. Let’s jump right in! 30. After scanning over a million apps — 3 things Mobile App Devs need to know about App Security Hackers might not attack you. Bots will. 31. Why Educational Platforms are a Favorite Target Among Attackers? Educational Institutes are easy prey for hackers to compromise and covertly launch Cyber Attacks/Malicious Campaigns under the hood, without divulging their real identity. 32. Why You Should Protect Your Cell Phone Number and How to Do It With only your cell phone number hackers become you! 33. What devs need to know about Encoding / Encryption / Hashing / Salting / Stretching This is a typical exchange about encryption with someone willing to learn. 34. Part 2: Developing Software Requirements, A Case Study This is Part 2 of a 4 part series. Part 1: Why Software Requirements In The Real World Are Hard discusses the challenges of developing requirements and what good ones might look like. This post looks at the requirements development process and its outputs on a real-world project. 35. Insider Threats Facing Government Organizations: 3 Tips for Mitigation Verizon's Data Breach Investigation Report for 2022 (DBIR) was recently released and it has some good news and bad news when it comes to the risk of insider attacks. Thank you for checking out the 35 most read stories about Infosec on HackerNoon. to find the most read stories about any technology. Visit the /Learn Repo

35 Stories To Learn About Infosec

Let's learn about via these 45 free stories. They are ordered by most time reading created on HackerNoon. Visit the to find the most read stories about any technology. Web Security /Learn Repo 1. Top Bug Bounty Programmes You Can Participate in Today A curated list of bug bounty programs for bug bounty hunters to help them get first bug bounty on vulnerability report. 2. What is Broken Access Control and Why Should You Care? With broken access control being one of the most prevalent weaknesses for web applications, it’s important to not only understand it, but to prevent it also. 3. How Can VPNs Protect You From Spying? What programs can safeguard your computer from malware? In today’s article, we will take a look at VPNs and what it can do to protect you from spying. 4. Browser Hijacking Software on CNN Election Site is Reason for Concern An ad redirecting users to browser hijacking software was recently spotted on CNN's election tracking site. Ahead of election season, it's reason for concern 5. How Nonprofits can Protect Themselves Against Getting Hacked Hacking is a serious problem for nonprofits. When a hacker attacks, it's not just the nonprofit's information that they want, but donors' information 6. 9 Essential Factors to Consider Before You Install A Security System In the US, a burglary happens every 23 seconds on average. This number is even higher in developing countries. 7. Common Web Security Vulnerabilities In the movies, hacking is like fast keyboard typing and hitting the Enter but in the real world, hackers find and exploit vulnerabilities to hack websites. 8. What is Runtime Application Self-Protection What is Runtime Application Self-Protection? Know how RASP is capable of controlling app execution, detecting & preventing real-time attacks. 9. Organizing Your Business Statistics to Achieve Success It is not an easy task to keep your business data organized; however, it is an important thing to do. Organizing data includes a lot more than putting all your papers in place and clearing the clutter on your desk. To have your statistics well organized, you have to create a system and procedures for every department available in your company. The following are top ideas o0n how you can get your small business statistics that can help in increasing the productivity of the business. 10. How To Enhance Website Security Enhancing security for a website can save it from hackers and online attackers. Read this article about website security to learn more. 11. Personal Online Security: How to Stay Safe Online Every individual or organization must be mindful of securing their online data. Online security is essential for better online data privacy and security. 12. Domain Fronting 101: What is Domain Fronting and How Does it Work? Domain fronting is one technique that hackers use to bypass internet censorship. This method is used to access restricted sites that would typically be blocked. 13. Feature/Permission Policies Overview It's already challenging enough to create a website that is blazing fast, adheres to all the latest best practices and offers optimal experience for various network conditions and device types. As the website and its codebase evolves over time, it can become even harder to maintain the desired user experience over time. To prevent UX deterioration, it’s often a good idea to place guardrails which ensure that crucial website elements, such as images, hold to a certain criteria. In this article, we are going to look at a robust mechanism which helps to steer your website in the right direction - an HTTP header called Feature Policies. 14. Web Application Penetration Testing: A Complete Guide Your website can be the next ‘target’ if you don’t take the necessary steps to secure it. One of the most appropriate step is to conduct a penetration testing. 15. The Essential Guide to Email Security: Threats, Costs, and Strategies We all use email on a regular basis, but we aren’t always cognizant of the email security standards we use. If a hacker gains access to your account, or manages to fool you into downloading an attachment with malware via email, it could have devastating consequences for your business. 16. Web Application Security Explained: Why Is It Important and What Does It Include? Web application security refers to securing sites and online services against different security threats that abuse vulnerabilities in an application’s code. 17. Fraudulent Ads Exploit COVID-19 Fears on Disney's ESPN.Com Scam advertisements across major media outlets originate from DoubleClick and Xandr/AppNexus 18. Using a Passive Vulnerability Scan To Identify Website Security Risks A passive vulnerability scan is a type of security scan in which the scanner sends no unusual requests to the server. It is like a visitor browsing the site. 19. Are you using JWTs for user sessions in the correct way? JSON Web Tokens have become incredibly popular (especially in the Node.js community) and you've likely heard about them. What you may not have heard is that JWTs were originally designed for use in OAuth - which is fundamentally different to user sessions. 20. Security & Agile Development - How to Bridge the Gap in 2022 21. 5 Popular Types of Penetration Testing for SaaS Businesses If you are running a SaaS business, you know that security is everything. Nowadays, we can see many different cyberattacks and their variants targeting SaaS. 22. Understanding & Recognizing Different Cyber Threats: What to Look Out For This article will dive into understanding & recognizing some cyber threats. It will not cover every example for each attack or every attack. 23. To All My Friends: Don’t Be An Idiot or Passive With Your Online Privacy Complacency with privacy invasion has become our 6th sense. Handing over the intimate details of our lives to corporate and government stooges has become a virtue and civic duty. It should come as no surprise that, even for a society dripping with tech-savviness, the average person would rather their government act than to take action themselves. According to Pew Research: 24. Security in the language of crypto exchange: providing traders with peace of mind Security issues of crypto exchanges and shared my thoughts on how to make trading convenient and safe - Viktor Kochetov, CEO at Kyrrex, a digital wallet and professional cryptocurrency trading. 25. What is an HTTP Proxy and How Does it Work for Your Goals What is an HTTP proxy? It is a good way to get information on the Internet while maintaining your privacy. Read my article to get more insights about HTTP proxy 26. Your Guide To AWS Instance Metadata Service (IMDS) Metadata is “data that provides information about other data” (Wikipedia). In other words, Metadata is “data about data”. 27. Your Website Could be Vulnerable Because of These 7 PHP Mistakes Make these mistakes and hackers will attack your web application using Cross Site Scripting, SQL Injection, Path Traversal, and other attacks to take over your website. 28. Top 7 Techniques For The Ideal Secure Code Review Considering today's cyber threat landscape, it is undeniable to say that the internet-facing applications are at major risk due to rapid increase in vulnerability exploits and ways to penetrate applications leveraging the hidden weaknesses in them. 29. OAuth Vulnerabilities: How To Implement Secure Authorization in Your Web Application In this article, we will go through the most common security vulnerabilities encountered in applications that use the OAuth protocol. 30. 5 Effective Strategies To Identify Phishing Sites How to recognize phishing? Research studies show that users of different levels have a hard time figuring out if a website is real or fake. And how about you? 31. 10 security tips for frontend developers Web security is a topic that is often overlooked by frontend developers. When we assess the quality of the website, we often look at metrics like performance, SEO-friendliness, and accessibility, while the website’s capacity to withstand malicious attacks often falls under the radar. And even though the sensitive user data is stored server-side and significant measures must be taken by backend developers to protect the servers, in the end, the responsibility for securing that data is shared between both backend and frontend. While sensitive data may be safely locked in a backend warehouse, the frontend holds the keys to its front door, and stealing them is often the easiest way to gain access. 32. Pre-Deployment Checklist: Django Web Security You already know web security is important to keeping hackers and cyber-thieves from accessing sensitive information. So, in this post we are going to check Django security vulnerabilities and how to fix them. 33. Automation Tools Like ACME Help Prevent Disruptions During Uncertain Times Web certificates are a foundational element of website security, enabling organizations to verify that the web address in question really does belong to them, as well as to keep users secure by encrypting their information. These certificates have become ubiquitous, and most savvy web users now know to look for the telltale indicators of a valid web certificate, which may include a closed padlock or green address bar, depending on the browser used. 34. Where Do Hackers Live: A Deep Dive into My Website's Security Logs I was casually doing a security audit on my blog recently and decided to look a little deeper into my security logs. With a bit of Linux command line kung fu, some Golang, and Google sheets, I was able to get a pretty good idea of where the attacks are coming from. 35. On Making The Internet A Safer Space: Inti De Ceukelaire, Head Of Hackers At Intigriti Intigriti co-founder, Inti De Ceukelaire, shares their origin story, what makes him excited about his job, and the technology he is currently excited about. 36. How to Set Up Portable VirtualBox With Kali Linux This a short tutorial on setting up Portable Virtualbox with Kali Linux. 37. Uncover Some of the Best Practices For Secret Management Secrets are digital credentials used for authentication and authorization. 38. How to Run Reverse Shell for Hacking in Linux A reverse shell is a hacking vulnerability that the hacker executes .php codes or an executable file in which he gets access to the shell of the target system. 39. Software Security Primer As a developer, when you think of security, what comes to mind? Is it clear what are different aspects that need to be handled to make a software secure? And why you need to do that? 40. Automate GraphQL Backed Applications' Security Testing Working with the latest tech is fun. It’s fresh and exciting. As developers we
feel invigorated by being on the bleeding edge. Consider us thrill
seekers. 41. SQL Injections: Beginners Guide The basics of how to test and protect your application 42. How We Pay For Free Websites With Our Privacy An array of free website-building tools, many offered by ad-tech and ad-funded companies, has led to a dizzying number of trackers loading on users’ browsers. 43. The Story Behind The Most Popular Android Malware Distributor on Dark Web Now more than ever, we rely on our smartphones to keep in touch with our work, our families and the world around us. There are over 3.5 billion smartphone users 44. Leverage Asterisk Servers for Monetization: An INJ3CTOR3 Operation Recently, Check Point Research encountered a series of worldwide attacks relevant to VoIP, specifically to Session initiation Protocol (SIP) servers 45. Hunting Exploits by looking for the Author’s fingerprints: Graphology of an Exploit When analyzing a complicated attack against one of our customers, we noticed a very small 64-bit executable that was executed by the malware. Thank you for checking out the 45 most read stories about Web Security on HackerNoon. to find the most read stories about any technology. Visit the /Learn Repo

45 Stories To Learn About Web Security

As a football enthusiast, I often watch Argentinian football journalism on YouTube. One memorable comment from a journalist, in a rare moment of philosophizing about journalism instead of reporting on the latest lineups, was “Sometimes it’s the audiences that change, not the stories.” Superliga He was explaining why sometimes they would make similar remarks or interview the same players and ask similar questions. Sometimes you see articles that touch on the same ideas and tackle the same specific topics as articles from many years ago. Stories that are eternal, because they are always relevant. You can also see this in today’s podcasts. For example, Huberman says something on his podcast today. Tomorrow he will then also say it, perhaps worded slightly differently, and with new info added, when visiting Lex Fridman or Joe Rogan on their podcasts. Long-winded way of saying that after seeing enough journalist pet peeves on Twitter about PR fails with embargoes and exclusives, I decided it was time put my thoughts on the subject on (digital) paper. I didn’t want to write an “afterthought blog post” or something lacking detail and ambiguous. No, this is going to be a full-on long read that leaves no doubts. Oh, and please note that it’s mainly tailored for my brothers and sisters in the startup world. In the world of PR, we often wonder whether the relationship with journalists could become more cordial and collaborative. Can more information, education, advice improve things? Will we ever find a system that makes these “issues” go away? Yes and no. We can probably make spam and the worst aspects of PR go away, but there will still be challenges. After all, journalists need to do journalism. They have a mandate to bring value to their audiences, not to companies doing PR. And PR pros work for their companies and need to advance their own interests. The best PR pros make it as much of an overlap in interests as possible. But sometimes, an unmovable object meets an unstoppable force. Sometimes, ceding control also means exposing unexpected vulnerabilities. Sometimes, shit happens. At the end of the day, we’re talking about human relationships. Conflict and misunderstanding are always in the cards. But — back to startups. Despite everything going on in the world, startups are always popping up. There are lots of new companies emerging every year. These new startups often lack in-house PR expertise or understanding of PR tactics in the tech and startup media context. This is not a criticism. Early stage startups should be lean, mean machines focused on things other than PR. They don’t need PR from the very beginning. But the lack of PR knowledge can pose challenges when the first PR needs do arise. One of those first needs is the funding announcement. Now, this is not going to be about “ ”. We want to talk about exclusives and embargoes. But, for startups, the funding round is where exclusives and embargoes are relevant in most cases. how to make the most of your funding announcement As well as my personal experience and opinion, I’ve also studied various articles, PR agency blogs and gathered journalist pet peeves about PR professionals from Twitter to inform what follows. Funding News, Exclusives, and Embargoes When to Consider Exclusives and Embargoes Let’s start with what’s really black and white. First, WTF are we even talking about when we talk about exclusives and embargoes? Why do these “terms” need to exist? Exclusives and embargoes exist to manage newsworthy stories that the media will potentially be interested in covering in detail. When it comes to company news or announcements, that would mean a story that is deserving of more than simply putting out a press release. We’re talking about something that journalists will want to do better, bigger, and more attractive than other media. Something they’ll want to put their mark on. And for that, they need time and access to information. So there needs to be some kind of early access for the journalist. This includes access to company representatives, sufficient time for the journalist to do their own research, interviews, briefs you name it. Whatever it takes to make sure the resulting article is as good as it can get. In theory, that’s what you and the journalist both want--time allowing, but we’ll talk about that a bit more later. Most blogs by PR agencies out there write about exclusives versus embargos in a general way. They are not talking specifically about startups. When it comes to startups, we’re mostly talking about funding announcements, but there are other ‘exclusives’. For example, a TV channel scoring an exclusive interview with a global leader, or contributed content by your spokespeople. Bylined pieces pitched to media outlets are typically done so exclusively. So much so, it goes without saying, almost nobody mentions it or requests it explicitly. You don’t go pitching a bylined piece everywhere. We’ll focus on startup funding news because this is where most misunderstanding and mistakes seem to stem from in our network. The Funding Announcement One of the most important first needs in terms of PR is the funding announcement. Why? It’s a business opportunity for startups, and it’s a newsworthy item for journalists. Startups get one of their first big social validations in the media. Journalists get to see what bets investors in the market are taking and what interesting future innovations could await us. Having previously been validated by investors helps journalists understand, “Aha, venture capital allocators are betting on this horse; let’s take a look at it more closely.” The article can be useful for future investors. How the journalist describes the ‘horse’ can inform these new investors on whether the horse could be a fit to bet on in the future once it wins a few races. Journalists will be able to tell whether it has the right jockey to go with it, what the horse’s strengths are and more. You know what horse experts are like, they look at everything. There are other stakeholders who also benefit from this information. Global talent, for instance, who might want to know what it’s like to be a part of the team behind this horse. Partner companies and potential clients will also want to know if they can benefit from riding together. Perhaps doing so will mean their own horses will win more! Of course, there is more than one funding round. With each round, the horse changes, evolves. It could get stronger, more muscular, or leaner and lighter. At some point, it might even undergo metamorphosis into a different creature with a horn. The bigger the company becomes, the more scrutiny you get. Journalists will inspect it in new ways, reconsider its potential, look at new details and, yes, start looking at potential weaknesses. The bigger your startup, the more newsworthy it will obviously be, meaning new outlets might be interested, and different PR tactics may be leveraged to spread the word wider. The PR activity involved in your seed round could look completely different to that of your Series A or B, etc., should you keep fundraising. The Exclusive Exclusives are, like the name says, news given exclusively to one journalist/outlet. An adjective that developed into a noun, exclusives are very common in the startup world as they provide security for the startup, for whom an early social validation could be key, and an edge for the journalist, who needs to give only the best to their audience and be seen to provide the most insightful takes. If your round is not large, it could be unlikely for the news to make it into certain media. But if you’re offering exclusivity, it can can make getting your news in one of your top targets more feasible. From the journalist’s perspective, there is the understanding that they will have exclusive access to information no others will have. Therefore, a story no one else will have. At least not in the same level of detail and analysis. The journalist could schedule an interview, send additional questions, or spend extra time on writing one hell of an exclusive. To top it off, if you do things right, it could be the beginning of a great collaboration (and friendship?) with the journalist. This improved political capital could help in future rounds. Journalists do remember good experiences working with PR professionals. But remember, PR is not just a relationships business. So these are also business relationships. Don’t assume because ‘you know someone’ that you can send them BS. If you send a journalist BS after they thought they befriended you, well, that’s the ultimate stab in the back. The Embargo When something is under embargo, it is not allowed to be moved out of its current location. That applies to ships, goods… but not to information. Not really. An embargo, when it comes to PR, is quite different. Unlike trade regulations enforced by port authorities and others, media embargoes are not a real rule. They can’t actually be enforced by any physical mechanism. There is no press release ‘escrow’. Some PR folks tend to believe a small sentence at the top of the release can fulfil this role, but they tend to misunderstand. An embargo, in media, is a type of handshake agreement that relies on the journalist honoring said embargo. The line at the top of your release means nothing without the actual ‘agreement’, no matter how ‘strict’ the wording. So embargoes aren’t really effective as ‘unilateral’ moves. Embargoes can be a bit risky. There are two sides to this. For the journalist, for embargoes to be effective, they rely on other media outlets not jumping the gun. And they rely on PR people not doing anything indecent. Company reps or PR pros need to give early access to material because you do want those journalists to get enough time for a good article. Which means that the risk of a leak is always there. Ultimately, the success of embargoes will depend on the strength of the relationship and trust. No law is broken if journalists break the embargo. Mistakes Offering More Than One Exclusive There is simply no way around it. The exclusive can only go to one journalist. It’s OK to look for another home for the exclusive if a journalist passes on your offer. Even contacting another journalist in the same publication is OK, although this is not the case for some publications. But you can’t offer an exclusive to two journalists simultaneously, for instance, to ‘spread your bets’. You also should not go for ‘multiple exclusives’, for example by creating the notion of exclusives for different outlet types — an exclusive for fintech trade media, an exclusive for startup media, an exclusive for UK media. It doesn’t really work like that. If your company is truly global and you would like to have your CEO speak to multiple outlets from different countries and potentially in different languages before the news is out, then, of course you can do that, but with the understanding that there is no exclusive! You are actually executing the ‘embargo’ approach and calling it something else. Offering an Exclusive, but Also Giving Embargoes This one is cheeky, Machiavellian even. If it backfires and someone leaks before the exclusive, you can get royally screwed. And if it works, also. Because the access other journos had previous to publishing could become evident. With the exclusive only one journalist/outlet has early access and opportunity to get a full picture and work their angle of the story before it becomes public knowledge, no one else. By giving ‘embargoes’ to others, you are breaking the rules of the exclusive. That leak you are risking could upend not just your exclusive. But also your reputation with the journalist (and others, if they tell on you). And you don’t want to do that. Not with someone you considered the most crucial journalist/outlet for your startup/client. Offering Too Much Information Too Soon, Without Knowing Whether the Journalists Are Willing to Agree on the Embargo Why do so many journalists make fun of the wording for embargoes? If you’re new in PR or have no one with PR experience around you, it might seem weird. Why are journalists making fun of embargoes on Twitter? Trust me, in reality, they do like embargoes. They want to get their hands on interesting stuff before it happens, even if they don’t have the ‘exclusive’. However, as we said earlier, the embargo is a ‘gentleman’s handshake’. I don’t know about you, but the last time I checked, a handshake requires two parties to shake hands. You don’t just agree on something unilaterally. So before sending too much info (like a press release), first approach the journalist as you would for an exclusive, but ask about the embargo. Make it consensual. If you simply send out emails with strong wording for the embargo (UNDER EXTREMELY STRICT EMBARGO UNTIL…), journalists will just laugh at you. Remember that even after shaking hands it is still not a legal requirement to adhere to the embargo. Not Giving Enough Time for the Journalist to Research Further or Absorb the Information It doesn’t matter if it’s an embargo or an exclusive — if you don’t give the journalist enough time, it won’t help you. Journalists are not, will not be, and were not robots. Yes, ChatGPT exists. But not everyone uses it or wants to use it. Journalists are proud people. And if they are the type that get tend to get exclusives and/or embargos, you bet they are thorough. Journalists will want to do human research. Validate your claims. Validate their theories. Work up an angle. Devote time to crystallizing their understanding of your startup, its business model, and its industry context. Too little time given is effectively an insult. The bigger the story, the more time they will want to have (if logistically possible). Misunderstandings Exclusive or Being First? No Life After the Exclusive? One of the problems with journalist pet peeves on Twitter as a mechanism for learning is that they might not always be as clear as us paranoid PR peeps on the other side might want them to be. Some of them can be ambiguous. For instance, highlighting dictionary definitions of the term “exclusive” to point that someone’s got it wrong. But is the dictionary definition the most relevant one in the practice of startup PR? The dictionary is designed to give definitions for the general public. That works perfectly for general vocabulary. In business, marketing, PR, and other niches, terms evolve their meaning or might mean something different than in other niches or contexts. Like we saw earlier, embargo means one thing when it comes to trade, another when it comes to PR. It’s clear that only one journalist can have the exclusive. But where does the exclusive end? Once the ‘exclusive article’ is out, then what? Some blogs out there I inspected did recommend to check with the journalist and make them aware that you are spreading the news further with a press release once their exclusive is out. While that sounds nice, I believe both the journalist and the startup know it’s not needed. Startups have to reach audiences, and they need to exploit all the newsworthiness they can get. It may be a matter of death or survival (or surthrival). And both the journalist and the PR pro know that likely no other article will be as good as the exclusive article. Once it’s out, it’s fair game to release the release! A Word of Warning About the Exclusive in the Startup Age: Journalists ‘Face’ Lots of Exclusives! Let’s face it. Every startup that comes to us wants to be on TechCrunch. But guess what, TechCrunch only has so many journalists, and most of them are based in the US. While some US journalists do cover European startups from time to time, European startups is mostly the remit of the European journalists. And there are not many, considering the number of startups in the Old Continent. So unless you are a VERY large startup (scaleup) or big tech company, you are unlikely to get in. Unless it’s through… you guessed it, an exclusive. But guess what? There is a flood of exclusive offers reaching each European TechCrunch journo each day on their inboxes. Despite what we said before about wanting time to study your startup, in the world of a tech journalist time travels at the speed of light. So going through the whole process can be an excruciating experience for both sides. Expect delays in answers, dates that move, more radio silence and even last-minute disappointments. Bonus Track  - Pet Peeves Let’s Analyze Some Pet Peeves I wouldn’t be worthy of working at Black Unicorn PR if I didn’t throw in some journalist pet peeves in the mix. And this wouldn’t be as fun. Non-Exclusive Pitched as Exclusive Here is a clear case of an exclusive, in this case an op-ed, that was actually not an exclusive. The PR person promised an exclusive, but it was not a promise that they were able to make, because colleagues were pitching the same piece elsewhere. Whether it was really “unbeknowst” to her, likely we will never know. You should aim for better internal communication and discipline in your PR department or agency to avoid something like this. Different Embargo Times for Each Publication Who saw something like this coming? The embargo handshake relies on the knowledge that it’s the same for everyone. Otherwise it’s not much of an embargo, is it? Why would one do that? We don’t know if what Ingrid saw is the full story, there might have been an exclusive at play in combination with the embargo. Playing these kinds of games with journalists is simply counterproductive in the long run. You’re insulting some, burning bridges, and in the end, PR is all about creating and nurturing relationships. Strict Embargoes Coming Out of the Blue Similar thing in both tweets. Embargoes are handshakes. Why would you send something without actually shaking hands? No matter the language you use, without a handshake there is, potentially, no deal. To quote fellow PR pro Doug Hunter of So Content, “embargo isn’t a ‘I said embargo therefore you can’t’”. Broken Embargo Two options — either one outlet secretly was pitched an exclusive with embargos elsewhere at a different time, or the outlet broke the embargo. We have no details on what might actually have happened, but journalists do notice these things. Pitching Without Embargo or Exclusive What about the third option? Not even using exclusives or embargoes at all? Well, it’s possible. And sometimes, even, the right option. Sometimes, the only option. But for funding rounds, as painful as the exclusive / embargo process may be, if you want to have good coverage, they will be the better choice. (By the way, the above looks like spray & pray, please don’t do that) The Definition of “Exclusive” in a Startup PR Context If you secured an exclusive, are you not allowed to ‘distribute your press release’ any further once that article is out? According to some PR agency blogs, you should talk about this with the journalist first. However, in the world of startups raising funds, it is expected that once the exclusive is out, you should be able to safely message other journalists with your ‘official’ press release. Don’t overworry! The same journalists that sometimes insist on exclusives and embargos will sometimes reach out proactively to startups to ask for the ‘official press release’… and might end up covering you even without pitching them! The pet peeve above likely stems from a case of embargo disguised as exclusive, or even worse, a contributed content piece pitched to multiple outlets.

Startups: Funding Rounds, Exclusives, Embargoes, Mistakes, Misunderstandings, and WTFs

Cross-chain bridges are applications that allow the transfer of tokens and other information between blockchains. Thanks to them, it becomes possible to conduct transactions in De-Fi space across multiple different networks. Bridges ensure the coordination of cryptographic algorithms that will be used in the transmission of information and the interaction of systems. In fact, the bridge is a set of tools: oracles, smart contracts, nodes that monitor the state of the system, generate changes within blockchains and process incoming transactions from other systems. We can give an analogy with states here: each state has its own language, its own laws, and borders. Similarly to different states, different chains may have distinct protocols, rules, and governance models, while the bridges create a reliable mechanism for them to interoperate. With the rapid development of DeFi market, the need need for a covenient solution to transfer the assets between chains became apparent. Bridges evolved from this need to unite the fragmented ecosystem of blockchains together. Types of bridges Before figuring out how to send the crypto to a different chains, let us take a moment to distinguish between the types of bridges. They can be centralized and decentralized. The classification depends on how the assets are transferred. The first variety differs in that it has pre-designated validators that control token deposits. They are responsible for verifying the lock, burn, and mint transaction on the bridge smart contracts. Now it's worth figuring out how a decentralized cross-chain bridge works. Under this structure, the validator there are independent entities. Analyzing the history of cross-chain transfers In the past, bridging protocols heavily relied on the mint-and-burn mechanism. However, it severely downgraded the user experience, requiring advanced knowledge in the DeFi field, and also introduced potential security risks related to minting contracts. A user journey in a simple transfer of USDC from Ethereum to Solana consisted of several steps and was quite convoluted. Once the transfer was initiated, the bridge contract locked the tokens on the source chain (Ethereum), and the bridge proceeded with minting the USDC tokens on Solana. However, the minting has led to the wrapped asset being created, which was a separate token from the native USDC issued by Circle on Solana. Besides the fact that it required the tokens to be unwrapped (swapping the wrapped token for the native one), it also fractionalized the liquidity since every bridge had its own version of the wrapped assets from every different chain that it originated from. Bridge teams partnered with DEXes to launch the liquidity mining programs, incentivizing retail investors to supply liquidity to the wrapped assets by creating a liquidity pair with the network’s native token. It consequently leads to numerous wrapped assets being traded, which could be difficult to keep track of. Notable examples of mint-and-burn-focused bridges include Portal Bridge, Multichain, and Allbridge Classic. However, in the last few years the landscape of cross-chain protocols began to change. The evolution of the bridging protocols With the advances in bridging protocols, the focus was shifted towards native swaps of assets, prioritizing user experience and moving away from wrapped assets. One of the examples of a cross-chain protocol for native transfers is . Built on LayerZero, the platform enables the transfer of native assets between a wide variety of blockchains. Stargate Another product that puts particular emphasise on native liquidity transfers is , the new flagman product created by the team behind Allbridge Classic. Let's look at it in more detail. Allbridge Core Allbridge Core is a cross-chain swap platform that allows you to exchange dollar-pegged tokens (also known as stablecoins). But the main advantage Allbridge Core is that it reduces perhaps the largest gap in the DeFi sector — the gap between EVM and non-EVM networks. The protocol already supports Solana, Ethereum, Tron and BNB Chain, with more networks on the horizon. In general, the platform offers a significant imporvements in user experience and makes cross-chain swaps as simple as one click of a button. On top of that, the user gain access to unique chains like Solana and Tron at very competetive swap fees. How it works Allbridge Core utilizes several messaging protocols to transfer the information between chains. One of them is Wormhole, a decentralized protocol operated by , which is also used by their . The other protocol being Allbridge’s own messaging, which supports the chains that Wormhole doesn’t (i.e. Tron). Jump Crypto Portal Bridge Allbridge Core has native for each supported token in each of the supported networks.Using the specified inter-network message protocol (Wormhole or Allbridge), virtual tokens are sent from the source network to the destination target network. liquidity pools Outgoing tokens are sent to the pool, where they are exchanged for virtual assets, which are a representation of the value of tokens within the protocol. The bridge smart contract on the target blockchain exchanges virtual assets for native ones from the liquidity pool and sends them to the user. Wrapping up Cross-chain transfer protocols are well suited for people who want to retain custody of their own assets and transfer funds in a decentralized way, as opposed to operating with centralized exchanges. However, we advise you to complete you due dilligence before using any of the DeFi services and investigate the products for security audits, team history, and other details. In conclusion, bridges allow you to seamlessly transfer funds between different chains and utilize the unique advantages every individual chain possesses. They act as stepping stone to connect the invididual islands of separated networks into a unified ecosystem, while contributing to the expansion of DeFi services across the space..

A Guide to Cross-Chain Bridges

44,000 startups. 4,553 cities. “4 billion votes” It was such a blessing to get to know so many of your ideas and innovations from every corner of the world in 2021. The startup community amazed all of us with your hard work and persistence despite all of the challenges that we faced globally throughout last year. Not gonna lie, the competition got our hearts racing like Eurovision. We won’t let you wait for much longer, below are long-awaited results! ✨✨✨ To see who is a winner in each respective city, visit and pick a city. The name at the top of the list is the winner. (Compromised awards are under review.) startups.hackernoon.com The will announce the winners per region in their respective cities. Startups Winners Announcement Series 🔥 Central Europe Central Europe has always caught our attention with the talented pool of people in tech community. But were they able to get through 2021 despite the pandemic? Let’s cheers to the most outstanding amongst 4,500+ startups who have been working hard this year: Basel, Switzerland An overwhelming vote for ~ in their mission of helping machinery companies drive more service revenues from their installed base MachiQ Software Berlin, Germany We have with a whooping 538 votes! Let’s support Plan A with its mission to help companies to measure, monitor and reduce their environmental footprint. Plan A Düsseldorf, Germany It doesn’t get any easier with Kicking off in helping people organize online schedules more easily. EasyWeek! Geneva, Switzerland Manage code quality? We have to give props to for their startup! SonarSource Hamburg, Germany Taking over Hamburg is , an acoustic device to reduce noises in vehicle cabins. No more annoying sounds on the road 🚗 ReCalm Köln, Germany Small business? Hoping to manage your marketing campaign? is winning the vote! rankingCoach Lausanne, Switzerland is a Swiss-based company focused on cryptocurrency management solutions built for financial institutions. Metaco Leipzig, Germany empowers companies to operate and utilize drones for the most effective industrial data applications. FlyNex Mainz, Germany is growing sustainable digital mobility startups! Next Mobility Labs Munich, Germany wins for top-line, high-security international Identity Management! ORY Stuttgart, Germany Remote desktop application? Ask anywhere. AnyDesk Vienna, Austria , an IT company enabling privacy-preserving big data applications in the digital age. Mostly AI Zug, Switzerland Way to go 1762 votes for the first provably live pure Proof-of-Stake (PoS) CBC-Casper blockchain designed for real-world applications. CasperLabs! Nyon Calling for robust data solutions for impact-driven organizations! Havuta LLC Zürich is revolutionizing small business lending to give easy access to capital to those who need it most: SMEs ✨ Teylor Heidelberg, Germany is an innovative HR startup providing a solution for fast and efficient recruiting of employees with simple job profiles. Talk'n'Job Stuttgart, Germany Congratulations for winning this title! AnyDesk Moving on to our buddies in... 🔥 Eastern Europe Eastern Europe is home to many familiar big names in our start-up world. Trace history for Miro, Telegram, and Grammarly and you know where they are from. Who is the next generation for Eastern European startups? Budapest, Hungary is a platform for mobile app development, enabling tens of thousands of developers to automate integration, testing, and deployment. Bitrise I__ __ stanbul, Turkey Leading here is - a brand new software intelligence platform- helps organizations deliver faster, high-quality products by connecting their DevOps tools. Oobeya Kraków, Poland is a human cloud platform that connects global enterprises with European software houses, offering tech talent as a service. Talent Alpha Kyiv, Ukraine 281 votes for , an AI powered app where people can swap faces in the videos, GIFs and images in just a few seconds. Reface Sofia, Bulgaria 387 votes for __ __378, leading Blockchain and DLT solutions company that specializes in helping enterprises and blockchain startups design, build and scale innovative solutions using Blockchain & DLT! LimeChain Warsaw, Poland is a next-generation blockchain document management software (DMS). DoxyChain Yerevan, Armenia Whoever clicked to vote for was sure a vote, because it ended up winning as a full-service software provider delivering Artificial Intelligence & Machine Learning solutions for businesses. SmartClick smart Almaty Just like the name suggested, provides one pass to dozens of gyms and studios. 1FIT Debrecen got all the coders ranked figured out! CodersRank Kharkiv is complete solution digital assets management! Pics.io Minsk, Belarus with 243 votes is the first blockchain-powered sports media platform. Scorum Moscow, Russian Federation 1 e-grocery company in Russia with 26 votes and #1 on our HackerNoon board for Minsk. SberMarket Saint Petersburg, Russian Federation leads this area as a personal finance application that rewards responsible spending and savings. CoinKeeper Kazan, Russian Federation Smelling a sweet victory? 3d App designers for flower bouquets is in the house! Flowito Western Europe 🔥 Brexit? Pandemic? It seems like startups in Western Europe still keep their spirits regardless. Startups in Western Europe that stood out in votes this year go to: Antwerp is on a streak! As a bug bounty platform, it ensures online security through a crowd-sourced platform for computer experts. intigriti Belfast A record-breaking 10,003 votes? is an independent coffee shop. Come grab a coffee! Bobs & Berts Birmingham What’s happening in Birmingham? We have , an innovative UK-based advanced lithium battery developer aiming to accelerate the global shift to cleaner. Aceleron Bordeaux 30 is an open-source web framework for building modern apps and websites with Vue.js. NuxtJS Boulogne-billancourt is a software company that provides an in-store analytics platform to optimize operations. DiGEiZ Brighton In for some jam? offers musical education services. BIMM Bristol Another tasty victory for Western Europe is enabling the strongest digital encryption on the internet. KETS Quantum Security Brussels A fashionable win for , a social fashion network. You scan barcodes in fashion shops and see every influencer wearing those outfits! Share your wishlist with your friends and earn cashback. SCANDALOOK Cardiff is a technology company developing end-to-end digital connectivity for the point-of-care diagnostics market. Bond Digital Health London A whooping number of 1085 vote__ __ offers hardware based cyber-security solution for authentication and encryption in a wired local network. Crypto Quantique Edinburgh Hopping up on the crypto movement, just launched last year but they are already rocking it at making crypto accessible to everyone. Zumo Ghent 5379 votes for ! A Belgian InsurTech startup that helps insurance providers all over the world to better connect with their digital customers. WeGroup Glasgow specializes in single-cell analysis transforming the life sciences. Biomage Paris Show some love in the city of love for , a sports platform that is connected to a mobile sports coaching application. AirFit Aberystwyth enables artificial intelligence, data science & digital innovation solutions for the agriculture, biotech & life sciences industries. Agxio Norwich Congratulations for the amazing win of 1124 votes! WATR Charleroi Congratulations for your amazing win! Hirering Gibraltar Give a round of applause to Fortknoxter! Waltham Abbey is ruling the area with its amazing 72 votes! RPAIR Antwerpen Rocking up Antwerpen area is the rising startup ! Willow Egham What’s happening in Egham? Proudly announcing winning the Noonies this year! ATA.ONE Leicester Leicester is calling the name of as the winner for the region! DeadHappy Macclesfield Who else but ? Congratulations on dominating the award! AeroCloud Northern Europe 🔥 Want to listen to some music? Spotify. Need some games to kill time? Candy Crush. What about a quick call to someone you haven’t seen in a long time? Skype. These are all startups that originated from Northern Europe! Noonies, let’s take a look at the upcoming generation of startups from Northern Europe that hopefully will see an even bigger and brighter future. Gothenburg, Sweden Shipping was never made for small shippers, so took on the mission to built an end-to-end logistics platform to empower small businesses to spend less time and money on shipping and more time on growing their businesses. Sendify The Netherlands provides a virtual platform for many kinds of conferences and events. Let's Get Digital Helsinki, Finland A curated collection of public basketball courts in the Helsinki Metropolitan Area called . Everyone is welcome to submit to their local court. Koripallopaikat Lund, Sweden develops an antibiotic-free, safe and effective treatment of vaginal fungal infections. Gedea Biotech Luxembourg, Luxembourg 🚀 is a job-matching platform that connects developers and tech experts with CTOs and team leads from the best tech companies across Europe. 👾 nexten.io Malmö, Sweden Feeling studious, Noonies? __ __e is a tool for Google Classroom, that enables formative matrix assessment towards course learning objectives directly. StudyBe Oslo, Norway is the platform supports a unified API across all connected device categories, removing significant friction for app developers. Domos Labs Reykjavík, Iceland __ __s is a mobile-first technologically advanced neo-bank. Indo service #S__ __ tockholm, Sweden is the biggest blockchain start-up in Sweden. Double winner of the most prestigious nomination in Nordics 'NyTeknik 33-listan', winner of the Deloitte Fast 50, and now Noonies Award! ChromaWay AB T__ __ allinn, Estonia Passing 1000 votes is a fully digital and decentralized ecosystem for all actors in supply chain. OBORTECH Vilnius, Lithuania is an easy-to-use money app for cards and accounts. Via Genome, users can open a business or a merchant account or a personal one with dedicated IBANs, access transfers, exchange currency, process payments, and manage the funds. Genome Aalborg Digura A legaltech offering tenants fast, digital and reliable legal assistance Aarhus Partisia Market Design provides secure, simple, efficient solutions for auctions and exchanges realizing the potential of the market. Helsingborg is a hi-tech company developing cardiac occlusion devices and other vascular implants. Occlutech Tallinna is an AI-powered system for marketing automation in social networks. POSTOPLAN 🔥 Southern Europe Southern Europe’s economy went through a hard time this year due to a huge reduction in tourism. But our startups are of course always headstrong, from Spain to Italy and all the way through Greece. Who are the heroes rising amidst changes of Southern Europe? Skopje is a versatile software development company that solves the business challenges of SMBs, big brands, and brave hearts with awesome ideas. CodeChem Sliema Sounds like just a relaxing exhale. is a holistic health and wellbeing app built to allow users work on the development of their physical, mental and spiritual health Few Tajonar is a company of experienced business & industry entrepreneurs offering solutions to industries based on cutting-edge technologies. das-Nano Tarragona is a technology-based company focusing on the production of integrated microsystems. IMICROQ Terni is an ICT-based integrated solution that is able to modulate, respond, assist and learn to control most home activities. Mind Tirana is a video content and e-commerce platform for the Balkans built on top of an Albanian language specialized search engine. Gjirafa Torino develops and commercializes algorithms based on Artificial Intelligence to increase the autonomy of small satellite missions. AIKO T__ __ orres Buy online groceries like you would buy offline with personalized picking as fast as in 4 hours with Vedras 360hyper! Trento is a music-based platform built around streaming platforms that allow users to discover new emerging artists and make new friends. Brots 2021, what a YEAR. Congratulations to all of the startups that made it to the top winning list for Europe! Stay tuned for Startup awards in 2022 and let’s cheers to a new year of more innovative ideas, bold innovations, and robust creations from you, Europe 🌷 More Information: If you’re a winner, please answer ! If you’re a reader, participant, just a curious individual, consider answering one of our interviews . this interview here Read the FAQs about or . Startups here here To see all of the winners you may visit , pick any city and view the name that appears at the top. this site If you’re interested in partnering with us, we invite you to look through some of these or reach out to our business department. unique sponsorship options Perhaps creating your very own tickles your fancy or maybe you have a whole new idea for how we can partner! writing contest Thank you to all of our sponsors! We truly appreciate your contribution to the tech world and thus the future! The Startups Awards are sponsored by: , , , , , , , , , , Blockster Brex FreeCodeCamp LaunchDarkly Coil Udacity Udemy Vercel Asia Pacific Transgender Network Bybit Everscale Network This post was written by An Le and edited by Natasha Nel. If you have any questions or concerns or would like to report a discrepancy please email ellen@hackernoon.com.

Meet the Winners of Startups in Europe

Heyo Hackers! I'm pretty sure that you are familiar with . In case you aren't, here is tl;dr: startups of the year by Hackernoon It's the BIGGEST and GREENEST celebration of startups around the world. Startups of the Year honors the best startups among 4,500+ cities with over 100,000 population. Why Startups of the Year? HackerNoon understands the struggle and pain involved in running a startup. I mean, we are also ONE OF YOU! And being a community-driven tech publishing company, tech startups are a big part of us. Here is an excerpt from our COO : Linh Smooke's interview We’re publishing mostly tech stories, as well as really, really deep dive technical stuff on JavaScript, software development programming, as well as blockchain content. but we do believe that tech infiltrates all aspects of life. So we also have stories about startups and building your own businesses With the startup of the year awards, we are celebrating those who not only survived but thrived through 2021. Shoutout to all the startups! For us YOU ALL ARE WINNERS! Why do Startups choose HackerNoon? Yup, feelings are mutual. HackerNoon is the FAV publishing platform of startups around the globe. Recently, we've started a with our nominations. In this series, more than 200 startups have shared their stories, work culture, and thoughts about the latest tech. startup of the year interview series We also asked them: What drew you to get published on HackerNoon? What do you like most about our platform? We received a variety of interesting responses. Just sharing a few with y'all here. Let's see why startups from around the globe want to publish with HackerNoon: 1. Range and Variety Matters Jason Eisen, CEO of UTU, is one of our oldest readers, and of the content published on HackerNoon: he loves the range and diversity I've been reading Hacker Noon for many years now, and I admire how it went from being a developer-focused blog to a massive, wide-ranging tech publication. The content ranges from developer tutorials to life-improvement stories all focused on tech. It's truly a unique reading experience, and we would be honored to be published on Hacker Noon. Andrew Cross, CEO GooseChase, shares the : same sentiments I am technical, and I do code, but I'm also a product person at heart. HackerNoon does a great job at treating the spectrum of engineering and product, and isn't afraid to dive deep on the topics they cover regardless of how technical or niche they may be: from talking about the latest programming libraries, to HIPAA compliance, to running a product team... the content is always relevant and hits the sweet spot between product and engineering. It's a resource everyone on the team benefits from. So yes - there is something for everyone to read! 2. Accessibility! Here is an excerpt from : the startup interview with AIR Cofounders HackerNoon offers a very open, accessible platform for people to learn and share knowledge, with accessible tools everyone can use from anywhere; in that sense, it aligns pretty well with how we think about what the future of AI should be :) Talking about accessibility, we have great news for everyone! HackerNoon has just launched a new feature - You can now listen to top HackerNoon stories too! LISTENING TO STORIES IS ALWAYS FUN! Simply scroll down to any recent story, pick your AI voice, and experience HackerNoon stories like you have never before! 3. The GROOVE As Avijeet Kumar Singh, : Cofounder of Prakshep, said The fact that you publish " ". unfettered stories and opinions Adam Gordon Bell from Earthly : endorses the groove I like the aesthetics of HackerNoon and the mischievous and whimsical tone of some of the articles. 4. FREE Content Forever We all agree: . All tech content on Hacker Noon will always be free for the readers. Johnpaul Nwobodo, CEO of Elesaro . Paywalls suck loves HackerNoon for that Real-life solutions for founders to implement in their startups are always dished out here for free. 5. Tech Viewership: Now, this is a very pragmatic response we received from : CEO, Xena Vision Great place to be in as the audience is technologists. This is one of the top reasons HackerNoon is loved by . With our dedicated readership and strong domain authority, we're a reliable partner to get the good word out and grow your presence across the interwebs. We showcase your story on our website to a monthly + tech audience! tech brands 3M 6. What's in a Name? This response by the : Head Of Hackers at Intigriti is quite amusing It probably won't surprise you that I'm in love with the name. The positive usage of the word 'hacker' is something we need to encourage - the hacker community is the greatest, most welcoming family you can imagine. On this note, let's wrap up this story. We thank you for all the love. Do check out the and vote for your favorite startup. Also, do check out ! startups of the year page Startup Specials - HackerNoon's limited-time, startup-friendly packages This article was originally published as on . 6 Reasons Why Startups Publish With HackerNoon HackerNoon Sponsors Blog

Why Startups Publish With HackerNoon 

Economics, Crypto, and Really Smart Women

Back in June, a Web 3.0 platform known as Safe Haven spoke at Agora’s 2021’s Blockchain Congress in Dubai on the importance of blockchain-based inheritance plans. As a practicing attorney, it captivated my attention, as the proprietary blockchain technology the company presented (and actively utilizes) seems to bridge the gap between archaic law and its evolving landscape in today’s digital age. Specifically, as it pertained to wills & estate planning, real estate management, and asset management. After spending time with for the past few months, I’ve had the opportunity to witness and observe the platform in action, taking into consideration the utility for both the legal landscape as well as the everyday consumer. Safe Haven As both a Digital Inheritance and secure Private Key Backup solution, I believe Safe Haven’s platform solves the two biggest problems plaguing our cryptocurrency space today-- creating a digital inheritance and personal backup plans, as well as tailoring each plan to fit your unique circumstances. Inheriti As an attorney hopeful to implement this in my own private practice, here’s what I learned during my time spent observing and studying Safe Haven’s technological infrastructure: #1 - Multi-Wallet Storage In my conversations with David Kerr, Executive Strategic Change Advisor at Safe Haven, I learned that Inheriti’s multi-wallet storage capabilities allow for private key information and data relating to multiple wallets and exchange accounts to be stored securely. Currently, the platform allows for storage of up to 500 characters, allowing for seed phrases and passwords for multiple crypto wallets and exchange accounts. What’s even more exciting is that the platform isn’t just limited to cryptocurrency alone; there are other pragmatic and practical uses for the platform that takes into consideration our everyday lives. For example, the ability to store secret family recipes, GPS coordinates, bank account details, and so on. According to Kerr, the company intends to upgrade its Inheriti Vault soon, which will provide for additional [significant] storage capacity. In other words, users will have the ability to protect digital assets of any size, including documents, images, and videos. #2 - Fully Decentralized Ecosystem In late 2020,  Safe Haven voluntarily contracted the independent security audit firm, , to conduct two separate security audits. Upon completion, both audits revealed and verified that no private key data was stored on any Safe Haven back-end systems. Red4Sec The significance of these audits to consumers is that the system helps to prevent both accidental leaks or malicious hacking attempts. Or better put: you cannot steal something that isn’t there. Compared to other platforms on the market that I’ve seen, the security audits alone make me believe that Inheriti is truly the only platform-based solution that can rightfully claim its fully decentralized. #3 - Fragmentation of Data The platform uses complex cryptography and its own patent-pending protocol, called “ ” (SSDP), which serves as the heart of Inheriti. Secret Sharing Distribution Protocol By implementing (SSS) cryptography in combination with SSDP, Inheriti is able to split private key data into multiple shares for maximum security. It is these shares that are eventually distributed to each beneficiary, using a combination of Safe Haven’s FIDO2 / U2F ‘SafeKey’ Hardware Security Module (HSM) cold-storage devices and blockchain. Samir Secret Sharing #4 - Multi-Layer Storage As a Web 3.0 platform, Inheriti uses a decentralized data architecture that results in the separate storage of data ‘shares’ across a mixture of storage media (including blockchain and cold-storage) for maximum security. According to Jurgen Schouppe, Chief Technical Officer, this means the platform is Quantum Computing proof. As secret data ‘shares’ are held on cold storage devices, those ‘shares’ of data cannot be accessed. In the unlikely event that is able to decrypt any of the shares held in the blockchain, it would not be possible to gain access to the remaining shares needed because they would be held on separate cold storage key devices. Quantum Computing #5 - Minimizing Chances for Data Breaches As much as we want to avoid using the ‘B’ word, data breaches today are inevitable. By implementing high-level security measures and NSA-approved encryption, Safe Haven works regularly on minimizing the risk of breaches on and in its platform. Most importantly, the client-based top layer is written in Javascript with built-in security features, such as preventing reading and writing to disc, not allowing access to other browser windows or domains, and any actions not permitted by the browser itself. All safety devices are protected by pin numbers that are stored using complex hashing algorithms and a maximum pin attempt that prevents brute force and rainbow table attacks. SHA-256 All private key share data stored on the blockchain or on SafeKeys, is encrypted using the - the first and only publicly accessible cypher approved by the NSA for information classified as “top secret.” AE256 encryption standard Most recently, Safe Haven is currently undertaking a 24-month Bug-Bounty program with Intigriti - Europe’s number one ethical hacking and bug bounty organization. #6 - Dead Man Switches and Preventing Fraudulent ‘Share’ Transfers With multiple fail-safe mechanisms, Inheriti helps protect against premature releases of private key data while you (the owner of the estate) are still alive. When processed or the data ‘merge’ process is initiated, various ‘ ’ mechanisms will ask you to respond in a set period, using a combination of methods such as platform login or email responses. Dead Man Switch Only when no responses are received within the allotted period will a platform release the all important ‘validator share’, so the merge process can commence. At this point, the required number of beneficiaries must also come together with their respective shares on their separate safety devices, before the shares can be recombined and decrypted, and the private key data revealed. #7 - Lawyers as a ‘Merge Authority’ From a legal standpoint, lawyers and other legal professionals can also be appointed within the system to help ensure a valid Death Certificate exists before data can be retrieved and (subsequently) transferred. This is what makes the ‘Separation of Roles’ concept so crucial to the platform’s ongoing viability. Inheriti differentiates the role of a trusted individual (or organization) that initiates the data retrieval ‘merge’ process, or ‘Merge Authority’ from beneficiaries that receive the data. In other words, a lawyer can be appointed as the Merge Authority who is able to verify that such a valid Death Certificate exists before the process can continue on. Bottom Line While Safe Haven’s Inheriti and SafeKey were originally touted for inheritance, exploring how a Plan Manager can access an inheritance plan for purposes of storing information as a digital backup is certainly the next-gen that estate planning and asset management has been waiting for.

Life and Death: Why Blockchain-Based Inheritance Plans Work in Today’s Web 3.0

2019's Fire Emblem: Three Houses's branching storylines makes it hard for everyone to have experienced the same thing. Here, we all weigh in on everything from our favourite students to our preferred strategies, comparing what we saw and did differently. Who is your favourite student in Fire Emblem: Three Houses? Nicolas Ng Apr 11, 2021, 4:27 PM So I'm still not finished my first playthrough everyone so try not to load this with spoilers. I'm going through the Black Eagle House path first. From a romance perspective for Byleth, I like Edelgard and Dorothea. Edelgard because of her status and how a romantic path their could change the empire. Dorothea because of her backstory. She isn't a noble and neither is Byleth really. Limarc Ambalina Apr 11, 2021, 4:29 PM I did a Blue Lions playthrough when the game first came out and absolutely loved Sylvain's character. His interactions with Ingrid were really funny and his take and experience with having a crest and what that means for him as a noble was special in the Blue Lions. Nicolas Ng Apr 11, 2021, 4:34 PM Now that I've written that out, I have too many favourite students! Dedue was another standout for me because he came from Duscur (I don't think that's a spoiler, he's quite open about it). Seeing him develop throughout the game in his support cutscenes made me a really proud teacher Nicolas Ng Apr 11, 2021, 4:38 PM Wow I don't really know any of those characters. Kinda shows how big the game is and the replay value. I also liked Bernadette's character for her funny interactios. Every support boost interaction starts with her high pitched scream. Limarc Ambalina Apr 11, 2021, 4:41 PM Which character did you like most in terms of combat? Limarc Ambalina Apr 11, 2021, 4:42 PM I really wish I managed to poach Bernadette for those interactions! She's really so funny Nicolas Ng Apr 11, 2021, 4:44 PM Felix was amazing once I reached the endgame. He could oblierate anyone 1v1. I also had Ingrid acting as an amazing Pegasus rider harassing mages. Mercedes pretty much carried her house with her healing alone Nicolas Ng Apr 11, 2021, 4:45 PM I had this strategy that had heavy armour push through maps based around Dedue's glacial pace with my riders harassing the flanks and ranged units picking off what they could. Is there a specific way you play? Nicolas Ng Apr 11, 2021, 4:47 PM So I have a weird style where I try to keep pairs together where I want to see relationships develop. Other than that I like splitting the team into 2 groups led by the strongest members. I do that to split the enemy forces. Limarc Ambalina Apr 11, 2021, 5:33 PM For me the strongest fighters in blue eagle we're Dorothea and once we unlock the killer weapons Ferdinand mounted on a horse was pretty op Limarc Ambalina Apr 11, 2021, 5:34 PM Byleth edelgard Dorothea and Ferdinand are the strongest in my squad right now Limarc Ambalina Apr 11, 2021, 5:34 PM Do you recruit the instructors? I have then on my squad but I feel like it's kinda cheating and I just use them as adjutants Limarc Ambalina Apr 11, 2021, 5:35 PM Keeping the pairs tends to progress the RP side of the game really well which I didn't do a particularly good job of Nicolas Ng Apr 12, 2021, 12:01 PM I kept the instructors on the side until later in the game because I wanted to mess around with my team composition for a while. They didn't feel like cheating after a while when the students caught up to them Nicolas Ng Apr 12, 2021, 12:02 PM Since you've played all 3 houses (I believe you have). Which house would you recommend for the first playthrough? Which house had the best lineup of student characters? Limarc Ambalina Apr 12, 2021, 4:39 PM Also after ...events transpire and Edelgard rises as a leader her character is redesigned to this: Limarc Ambalina Apr 12, 2021, 8:41 PM Any idea why they went with demonic/devil imagery (a la red plus horns for a crown) ? If your answer spoils the story, don't tell me lol Limarc Ambalina Apr 12, 2021, 8:42 PM My favourite character is Claude. My first playthrough of the game was with the golden deer, so I'm a big fan of Claude, hah. Unlike the other two house leaders, he's laid back and wants peace and equality. I was amazed how Claude managed to keep his cool and still fight for a good cause ever after all of the events that transpired in the game. He wasn't tempted by greed wasn't a megalomaniac 😂. Jack Boreham Apr 12, 2021, 10:09 PM Of course, I'm a big fan of Byleth. I also like Ignatz. He came from a poor background, and if you keep him alive, he has a great story and backstory. Jack Boreham Apr 12, 2021, 10:13 PM oOo...now you're making me think my second playthrough will have to be with the golden deer. It's double tempting because House Baratheon was one of my favorites in Game of Thrones. OURS IS THE FURY Limarc Ambalina Apr 12, 2021, 10:14 PM Reading the conversation makes me want to jump back in. As Limarc Ambalina said, the games massive and has a ton of replayability. There goes another 100hrs.....😂 Jack Boreham Apr 12, 2021, 10:14 PM DAMN 100 hours for 1 playthrough...I have so many other switch games to get to though.... Limarc Ambalina Apr 12, 2021, 10:15 PM Hahaha, it might be controversial, but I think three houses is one of the best games on the switch, if not the best. I remember the summer of 2019... Three houses was my go-to game. I just got lost in it with all its lore. Jack Boreham Apr 12, 2021, 10:21 PM I've never been a particularly big Fire Emblem fan and I'm not very good at them. That said, my favorite is probably Fire Emblem Warriors, since it has that Dynasty Warriors/Samurai Warriors play style, and that's more my speed. JeffreyHarris Apr 12, 2021, 11:12 PM Jack Boreham I wish I could do what you did. Talking about the game really makes me want to see what I missed out on, try out the DLC and experiment with new combinations. And to see the alleged insanity that is the Golden Deer route. Nicolas Ng Apr 13, 2021, 7:57 PM

Nerds Talking About Fire Emblem: Three Houses

We all hear that voice, the narrator's voice. You can listen to it now, reading this text to you. But, this voice is not to be trusted. So, let's explore how neuroscience deconstructs our inner monologue. " Seven and a Half Lessons About the Brain by Neuroscientists like to say that your day-to-day experience is a carefully controlled hallucination, constrained by the world and your body but ultimately constructed by your brain. It’s not the kind of hallucination that sends you to the hospital. It’s an everyday kind of hallucination that creates all your experiences and guides all your actions. It’s the normal way that your brain gives meaning to your sense data, and you’re almost always unaware that it’s happening." - Lisa Feldman Barrett From the day we are born until the day we die, our brain continuously receives clues from the outside world via our eyes, ears, nose, skin, etc. We do not perceive this information as sights, smells, sounds but light waves, chemicals, changes in air pressure. Then, this sensory data is translated into millions of electrical pulses. While reading these electrical pulses, our brain starts building our reality, using its senses as fact-checkers, and quickly adjusting to new data. Based on this process, we “see” things that are not there (snakes in the grass), or we don’t see things that are there (e.g., the gorilla suit experiment, presented in this ). 2-minute video The world we think is “out there” is, in fact, a reconstruction of reality inside our skulls. This hallucinated world of our neural models is not built with tremendous accuracy. No, the brain is not interested in truth technicalities. The brain is interested in our survival. As the brain tries to build a narrative from all the inputs, memories, behaviors, or events around us, it creates a voice. We all hear that voice, the narrator’s voice. You can listen to it now, reading this text to you, commenting, connecting ideas, creating assertions. This voice is a superb storyteller that seeks explanations to sell and tell a neural world model. The narrator’s voice is not to be trusted This inner monologue builds deceptive narratives that lead to a sense of cohesion, a sense of certainty that looks real and feels real, yet it is not real. The narrator’s voice . Constantly. Professor Lisa Bortolotti explains, when we confabulate, “we tell a story that is fictional while believing that is a true story.” confabulates In other words, by confabulation, the brain constructs a fictitious representation of past events, believing them to be accurate, all the while with no intention to deceive. Because this is what this inner monologue does, sometimes it makes a story instead of admitting that our input data doesn’t make any sense. None of us is immune to confabulation. Not only that the brain confabulates, but as Carol Tavris and Elliot Aronson say in their book, : Mistakes Were Made (But Not by Me) our brain distorts our memories “The most important memory distortions by far are the ones that serve to justify and explain our own lives. We spend years telling our story, shaping it into a life narrative that is complete with heroes and villains, an account of how we came to be the way we are.” This tendency towards neural model-making and world-building makes us model builders or world builders. Sometimes, we become model warriors and model defenders. As Bruce Wexler says in his , “we ignore, forget, or attempt to actively discredit information that is inconsistent” with our models. Brain and Culture book Whenever we find out a new piece of information, we tend to judge it. If it is consistent with our world model, we are inclined to accept it. If it is inconsistent, then we are tempted to refuse it. The rational thing to do whenever we come across something new would be to try to understand. However, most of the time we blindly sort new facts into yes or no categories. No wonder we create our echo chambers, surrounding ourselves with news and views that reinforce what we already know and believe. Identifying our flaws and changing who we are is a profound experience. By strengthening echo chamber facts, the brain tries to reduce the threat of change, the stress, and the unpleasantness of different opinions and models. In his book , social psychologist Dan Gilbert considers that Ingrid Bergman’s character in the movie Casablanca, when put into choosing between rejoining her husband or staying in Morrocco, would have found reasons to justify and be happy with either choice. Stumbling on Happiness The skillful narrator would create a coherent tale for Ingrid Bergman’s character to tell her who she is and why she is doing what she is doing. Thus, Mistakes Were Made (But Not by Me) by , The brain is designed with blind spots, optical and psychological, and one of its cleverest tricks is to confer on its owner the comforting delusion that he or she does not have any. - Carol Tavris Elliot Aronson Does that mean I cannot trust myself, my ideas, assumptions, desires, judgments, and plans? It does look that way, doesn’t it? So maybe let’s frame the limitations of our storytelling brain like this. Because I know the story I construct can be wrong, I shouldn’t rush to a conclusion. I realize that my perceptions of others are merely guesses and not facts. I know that the narrator’s voice tries to improve my survival chances by bringing order into the chaos of input information that is always ongoing. However, through sly biases, this narrator’s voice will create half a truth and half a lie that has the potential to hurt me. Using layers of deception and smoke, the narrator can shape our virtues to become flaws and our flaws virtues. Sometimes it builds reassuring narratives of self that try to explain why bad things happened or why we did terrible things. The narrator makes us the hero in the story of our life. And sometimes it crushes us with destructive narratives, burying us into “Why am I saying the unexpected?”, “Why am I doing the unthinkable?”, “When will I ever learn?”. The narrator makes us the villain in the story of our life. The mentor. The tormentor. Subsequently, Carol Tavris and Elliot Aronson remark: “Our greatest hope of self-correction lies in making sure we are not operating in a hall of mirrors, in which all we see are distorted reflections of our own desires and convictions. and yank us back to reality if we veer too far off. This is especially important for people in positions of power. “ We need a few trusted naysayers in our lives, critics who are willing to puncture our protective bubble of self-justifications The narrator’s voice weaves a spider’s web where I consider thoughts to be facts leading me to identify with my thoughts strongly. Because of all these limitations and biases of our brain, Professor Nicholas Epley writes in his book: Mindwise “No psychologist asks people to explain the causes of their own thoughts and behaviour anymore unless they’re interested in storytelling.” If you take a piece of information from this article, remember this: My narrator’s voice will spin a good-enough story to explain any thought or behavior of mine. Thus, I am not my thoughts. I am more than my behaviors. I can separate my thoughts and behaviors from my identity. I can separate what I did from who I am and who I want to be. Eventually, this is the way that allows us to live with the behavior we now regret. Previously published at https://www.roxanamurariu.com/how-neuroscience-can-deconstruct-our-inner-monologue/

How Neuroscience Deconstructs Our Internal Monologue: Confabulation and Cognitive Biases

Bug bounty programs have been around for over two decades now, but it's only a couple of years since organizations started adopting this on a large scale. The concept of crowd sourcing talent and test security to assess the flaws kicked off well. Initially, what started by tech giants is widespread, resulting in state of the art security applications and implications. The leap is proving to be far more valuable, contributing to a safer playing field as well as leaving more room for improvements. The unexpected turn of events most certainly gave birth to a new branch of employment with most of the players being freelancers. Those who started earlier are now established but what about those wannabe bounty hunters? How should they become one? The bug bounty program is kind of reverse engineering (not exactly), so to find what might be a flaw, one must learn. Once mastered, you'd be able to do much more than finding vulnerabilities: you would develop cool security apps or do lots of hunting on your own and write a research paper. Start with reading The best way to learn is to read. Every single person who succeeded as coder or hacker knows how big of a difference reading makes. Read other established bounty hunters, books you can take reference from or stories how someone got a breakthrough. Reading will not only make you think of new ways; it will also prepare you for similar encounters. Some of the books to read: "Breaking into Information Security: Learning the Ropes 101" - Author: Andy Gill “Crytpo 101” - Author: Lauren Van Houtven “Learn Python the Hard way” - Author: Zed A. Shaw “Ethical Hacking and Penetration Testing Guide” - Author: Rafay Baloch “OWASP Testing Guide V4,” Bounty hunter Jason Haddix strongly recommends this to people starting their journey in testing field. Basics to Get Started With There's so much to know that even if you tried learning all, you couldn't do it. -- Start with OS, Linux is easy and complicated at the same time and since you can't google every command line when you're stuck. It's better you learn the basics like how to load software application on Linux. You're going to need a lot of software over time, and unlike Windows, you cannot just click and install. -- Next is the web app development part. One has to be familiar with both aspects - client-side coding and server-side coding - of the app development. Meaning, you'd have to try your hand at coding languages such as HTML, CSS, AJAX, JavaScript (Client-side) and Python, PHP, Ruby on Rails and other (Server-side). -- Networking basics to learn how to connect servers and clients, emails for example, how to find devices on a network (IP addresses) and the network's building blocks, for instance, switches, cables, hubs, etc. See, Listen and Observe While you're learning all the basics, it's an excellent time to see what established bounty hunters do. Listen to their podcast, vlog, and stream where they talk about methodologies and tricks. Observe what all the bounty hunters have in common and what sets them apart from rest and each other. Successful professionals have a knack to do things out of the ordinary, approach errors differently or develop solutions no else has ever thought of before. Keeping a sharp eye and an active mind pays off well. They see loose ends that no else saw or pen testers missed, which could have been exploited if noticed by black hat hackers. Some best bug hunters to follow: Jasson Haddix Rafay Baloch Roy Castillo Shubham Shah Practice like You’re on Defcon 1 All that learning and listening isn’t going to be fruitful if you don’t practice. There’s a reason why legends are legends: they practiced tirelessly, stayed up late, and slept little. They perfected their skills in making apps before heading into breaking it. Join forums, discussion sites, and ask questions. Participate in forum debates as you’ll always get to learn something new. Watch tutorial videos and practice that, if an idea comes to your mind, execute it. Explore and examine POC (Proof of Concepts) by other hackers. Immerse yourself into bug hunting tutorials and recreate it to see your progress. If possible, approach one of the famous white hackers and ask for a tip. Most of the hackers are polite and never hesitate to impart expert advice with genuine knowledge seeker. Use all the gained expertise and test it on vulnerable apps. These apps are deliberately developed with flaws for hackers to practice. Some of the vulnerable apps are: DVWA (Damn Vulnerable Web App) Metasploitable 2&3 Hack Me Vulnhub Web Security Dojo Battle Plan At this point, you know all but not good enough to compete in a Bug Bounty Program. If you tried hunting for small companies, you might get lucky once or twice, and that’s about it. To prove your mettle on big companies like Microsoft, Facebook, CREDITS, Tesla, Google, U.S. Department of Defense, to name a few, it takes more than sheer luck. -- Instead, join platforms for further insights. Explore hot topics like -- How to approach a bug bounty when you’re new. -- What complete vulnerability report looks like and how to create one. Writing PoCs (Proof of Concepts) and -- Finally reporting a bug. Try Googling methodologies for bug bounty and read and listen, it will help clear doubts. Some platforms to join: HackerOne Github Intigriti BugCrowd Antihack Carving Success One Bug at a Time After you enter the competition, it is time to exhibit what you learned. Remember, you probably have a tough start, the flaws you discover may give you pennies, but that shouldn’t down your morale. People earning fortune started where you’re at the moment. Learn from your mistakes, develop your ethical ways, and keep on practicing because each bug you find improves your skill and take you to another level. Conclusion Bug bounty hunters are one of the most sought after experts in the market today. With the rising dependency of businesses on apps and networks, the demand for white hat hackers and pen testers have risen ten folds, too. This leaves ample space for new entrants to earn more than daily bread. Becoming a bug bounty hunter sure is hard, the rewards, however, outweighs the struggle.

Becoming a Bounty Hunter - Carving Success One Bug at a Time

Amazon, Google, and Microsoft are all on board and moving ahead with new partnerships. Two of the major cloud players in the world have entered the blockchain space. Both Amazon Web Services (AWS) and have recently announced partnerships to deliver distributed digital ledger technology to the cloud and to grant developers access to their suites of cloud tools. Google Cloud Back in May, AWS teamed up with Kaleido, a new start-up born out of leading blockchain incubator . The company is aiming to give AWS customers an “easy button” to get into the same technology that underpins cryptocurrencies and d-apps, or decentralized applications. ConsenSys “They can focus on their scenario and they don’t have to become PhDs is cryptography, we give them a simple platform to build their company on blockchain,” said , one of the founders of Kaleido, commenting on new opportunities for developers. Steve Cerveny Talking about AWS, Cerveny said that the cloud giant have “been looking for partners to help get blockchain into their customers’ hands.” He added: “They’re putting it in the marketplace will accelerate what their customers are going to do with it.” “This is a heavy duty, full stack way of getting the company into blockchain solutions,” said , founder of and ConsenSys. “Three years ago we were getting calls from companies trying to spell blockchain and trying to order one in a color because their boss told them they should get a blockchain. At this point there are tens of thousands of companies around the world that have real sophistication around this.” Joseph Lubin ethereum Google Cloud has also recently embraced blockchain fully with two important partnerships. Ahead of the Google Cloud Next ’18 conference, the company partnered with , to see the startup’s blockchain platform and developer tools made available on the Google Cloud Platform, and with Ethereum enterprise blockchain startup , to have their rapid-deployment blockchain-as-a-service solution platform for enterprises, called STRATO, made available on the Google Cloud. Digital Asset BlockApps “We’re partnering with Google Cloud to provide developers with a full stack solution so they can unleash the potential for web-paced innovation in blockchain,” said Digital Asset CEO . “This will reduce the technical barriers to DLT application development by delivering our advanced distributed ledger platform and modeling language to Google Cloud.” Blythe Masters Similarly, Google commented that “customers can now explore ways they might use DLT frameworks on [Google Cloud Platform] with launch partners including Digital Asset and BlockApps, and try open-source integrations for Fabric and Ethereum later this year in our GCP Marketplace.” Hyperledger Back in June, at the GeekWire Cloud Tech Summit, Mark Russinovich, CTO at Microsoft , was adamant about blockchain as a key ingridient for the future of the cloud. He said that “2018 is the year we are starting to see a wide variety of applications of blockchain, moving the technology from a romanticized cure-all to a real tool,” as reported by GeekWire. Build Azure “Every single company we talk to is looking at how they can apply blockchain to various areas,” Russinovich said. For example, Microsoft, through its Xbox division, is teaming up with EY to publishers and others to simplify calculating royalties. Russinovich said the service, which began testing in February and is expected to roll out to key partners later this year, gives everyone immediate insight into royalty and contract information, down to the minute. offer a blockchain service for game developers, “This is a case where we want publishers to be able to see the royalties they are owed in real time, and blockchain gives them that ability,” Russinovich said. “Before, it was different processes, different systems. It would be 30, 60 days, before they could see what they are owed. Here they can see it in real time.”

Blockchain and the Cloud

When , 2 months ago, it catched some attention and curiosity from my close circle of friends and professionnal connexions, but not much more. I started eelo.io At this time I entered into a double consideration: 1- though I was certain I would do this project at least for me, in a “hacker mode” and as a side project, I was unsure that it would be interesting for a significant number of people. In short: I didn’t know yet about the “market” it would be addressing. 2- I started to finance the project on my personal money, and, fortunately or unfortunately, I don’t have deep pockets like Elon Musk or Richard Branson. So I needed to find some more money to be more confortable on that project and support at least one developer for the next 6 to 12 months. Starting with AdWords A friend suggested me to evaluate the that “market” eelo was addressing, by trying some AdWords (yes, some Adwords). I did. I tried various keywords and observed carefully the suggestions that were driving people to my two different landing pages: one was focusing on the privacy-oriented mobile OS, and the other on privacy-oriented web-services. Surprisingly, transformations rates were excellent for certain keywords, and several dozen people started to register about the project. Of course, AdWords are expensive and are certainly not the most efficient way to get some real exposure. And it’s Google :-( Deciding for a crowdfunding campaign Over the past few years, I met a few startups who did some crowdfunding campaign, with mixed results. One of the biggest error I heard from these experiences was to start a crowdfunding campaign in a “religious mode”, e.g, think that you will put everything online and then a miracle will happen. The truth indeed is that many crowdfunding campaigns don’t work at all. I started to discuss the opportunity to do a crowdfunding campaign with an entrepreneur friend who already organized some campaigns. We agreed that eelo would probably be a good candidate to do a (small) campaign. This is a lot of work Probably that doing a crowdfunding campaign is easy if you get accompanied by crowdfunding experts who can bring the good package for you (and will cost you an arm). But in my case, we have been only two people to work on it, with very limited means. Even off-voices have been home-made. The most difficult part at the begining, is to ask yourself the good questions: what is your project: the pain point, how you want to address it, … how you would tell the story in a few words what your audience is how you are going to communicate about the project define a financial target Then you set some milestones and a reverse-agenda. And then it’s not going better: time is passing whatever you do or don’t do. You have to define everything in the details, and worse: you have to do a project video! My partner on the campaign have excellent skills for this, but eventually, I got to talk to the camera, and this was really outside my confort zone :) And it starts… Kickstarter needs a few days to approve the campaign. In my case, it took only one day. And then, you have to push the “launch” button. eelo on Kickstarter, 29 hours before the end of the campaign Pushing the launch button has absolutely no real effect: the campaign is public, but you can probably wait some days before someone finds your project and decide to back it. At this point, you have to get some attention So it’s time to get in touch with news sites, with journalists, to tell about your story (actually, I started to contact some of them before the campaign started). You have to post the news to forums, accept aggressive comments, answer questions. And eventually, you see some first contributions! The key point here is that Do not expect the plateform to do it in your place! you really have to bring invididuals to your crowdfunding campaign. In my case, it accelerated quite fast at the begining. But then I was unsure I would reach the intitial target, and it’s been quite stressful. Eelo.io contributions history. The evolution is mostly driven by new press articles about the project. A crowdfunding campaign is much more than “raising” money What I learned with the eelo crowdfunding campaign, is that . the biggest benefit of the crowdfunding campaign is not the money Of course, the money is mandatory to fuel eelo’s early developments. But the biggest benefits are: I had to define better the eelo project at the begining I know that eelo is addressing a real and growing concern / pain point (user data privacy) I know that eelo is potentially addressing a global market (the incoming traffic is from most countries in the world) I know better than earlier who are eelo supporters, and what they expect eelo have more than 3000 supporters if I count people who registered on the website so far, who will help a lot to get more exposure I have a growing list of press contacts that I use later when I have significant news about eelo I’m becoming a crowdfunding expert ;) More seriously: my skills have improved a lot on this! Entrepreneurs, go for crowdfunding! So I can only recommend to any entrepreneur to start a crowdfunding campaign, if this can fit with a potential market or particular context. You should do this even before incorporating, before entering entrepreneurship ecosystems and entrepreneur contests, before raising money in exchange of equity. Probably it’s more difficult for B2B than for B2C. But it will force you to do what every entrepreneur should do first: find and know your market, this will define your product better. — Gaël Duval (Twitter: ) @gael_duval PS This article was originally posted to my personal website

Stories, News & Mentions about INVIGRID

Invigrid’s Stories on HackerNoon