iPiD

ipid

Redirecting DNS Traffic in Docker Containers Using Tc-BPF

I'd like to share my experiences using evilginx2 and gophish for red teaming phishing simulations. While there are numerous guides available, I aim to highlight the nuances and practical insights that aren't typically covered in documentation and tutorials. Approaches When setting up a phishing campaign for red team purposes, you have three options: you can clone the page and only collect data
the next level is not only cloning the page but also verifying the captured data against a legitimate page
The last and most sophisticated method involves a man-in-the-middle attack, where your page is a proxy between the victim and the legitimate site. Evilginx2 The third method is done by evilginx2, which, despite its name, does not have nginx built in, but the functionality is the same, except that evilginx2 has built-in filters and functions like inject_js that make the attacker's life more comfortable. Gophish Gophish is a tool that allows you to manage groups and users, dynamically create emails, and send them at will. Integration A few weeks ago, Evilginx got an update 3.3, which introduced integration with Gophish, a framework for phishing campaigns. There have been several such projects in the past, such as gophish[1], but in this text, I will focus on the official evilginx by K. Gretzky. More info about the update with the demo can be found here: https://breakdev.org/evilginx-3-3-go-phish/ Both tools are in Golang, which is a relatively easy-to-understand language. Experience with Evilginx2 Malicious proxy with evilginx has several drawbacks compared to just cloning the page. Firstly, the setup is much more complicated. When you clone a page, you download the necessary files via developer tools and add the password-storing feature via some backend. Evilginx setup is more complicated. Setup needs a configuration file and a phishlet that works as a template for the phishing proxy. Setting up and running evilginx2 in the production version took me over a week compared to just cloning. The advantage is that evilginx scales much better. Once you know how to create them, you can change phishing scenarios at will because adding new phishlet is trivial. I should mention the state of the project in which evilginx is. The documentation is concise and not very useful if you have no experience with evilginx2 already. Some features and behaviors are not documented, and you need to read and debug the source code to find the behavior. The project has special financing where you can pay 400$ for a course of excellent quality, but it replaces the documentation to some extent, which doesn't seem like a good way. Either it's an open-source project with all the parts, or it's not open-source; this way, it's open-code, but you are forced into buying the expensive course. It doesn't help that the project has many open issues and bugs that nobody addresses. If you're serious about phishing, you'll probably have to edit the source code and use your version because the author doesn't put much effort into finding new PRs. For example, the PR request I made to fix the POST of a GET request three weeks[2] ago has still not been merged. The project is plagued by old libraries that are long unused. Of course, I don't want the author to handle everything himself, but sometimes, you have to give up control of the project to benefit the project. And more moderators and maintainers who want to help would certainly be found. But not to be only negative, this project is still the best of its kind. If you learn all its quirks and modify it to your purpose, it will become a tool allowing you to do campaigns of all kinds, with a level of automation that is impossible if you write the tooling yourself. Experience with Gophish Gophish isn't updated very often either, but I haven't encountered any bugs, so it doesn't really bother me. Although gophish has an API, it lacks some functionality that would be useful, so K.Gretzky had to add this API[3] to make the integration with evilginx work, anyway this approach is not sustainable and I think gophish would benefit from an API that would allow event reporting. The Gophish email template community is active, and you don't need to invest much time in a replica of the o365 email because there is a good chance that someone has already created the template. The UI is very good, and many features, like a timeline of events, will be appreciated by clients in the report. Bypassing anti measures If you send emails within a known service such as o365 or Gmail, it is good to first build an instance where you collect crawler IP addresses which you then block on the production instance and domain, thus minimizing the risk of being blacklisted, for example, outlook. Of course, this is the easier part. The harder part is to have an SMPT server with a good reputation that allows you to send phishing emails in bulk, so I do not recommend building your own SMTP server but rather use some email as a service with its own domain that has a good server reputation by default, for example, Gmail business. Summary While evilginx2 offers powerful features and scalability, its complex setup and poor documentation are significant hurdles.
Gophish provides robust campaign management tools but also suffers from limited API functionality.
Both tools require considerable customization and understanding to effectively use in red team operations.
Mastering both tools offers significant rewards. Thank you for reading. Feedback is appreciated! References [1]: https://github.com/fin3ss3g0d/evilgophish [2]: https://github.com/kgretzky/evilginx2/pull/1047 [3]: https://github.com/kgretzky/gophish I'd like to share my experiences using evilginx2 and gophish for red teaming phishing simulations. While there are numerous guides available, I aim to highlight the nuances and practical insights that aren't typically covered in documentation and tutorials. Approaches When setting up a phishing campaign for red team purposes, you have three options: you can clone the page and only collect data the next level is not only cloning the page but also verifying the captured data against a legitimate page The last and most sophisticated method involves a man-in-the-middle attack, where your page is a proxy between the victim and the legitimate site. you can clone the page and only collect data the next level is not only cloning the page but also verifying the captured data against a legitimate page The last and most sophisticated method involves a man-in-the-middle attack, where your page is a proxy between the victim and the legitimate site. Evilginx2 The third method is done by evilginx2 , which, despite its name, does not have nginx built in, but the functionality is the same, except that evilginx2 has built-in filters and functions like inject_js that make the attacker's life more comfortable. evilginx2 evilginx2 nginx evilginx2 inject_js Gophish Gophish is a tool that allows you to manage groups and users, dynamically create emails, and send them at will. Gophish Gophish Integration A few weeks ago, Evilginx got an update 3.3 , which introduced integration with Gophish, a framework for phishing campaigns. There have been several such projects in the past, such as gophish[1], but in this text, I will focus on the official evilginx by K. Gretzky. 3.3 More info about the update with the demo can be found here: https://breakdev.org/evilginx-3-3-go-phish/ https://breakdev.org/evilginx-3-3-go-phish/ Both tools are in Golang, which is a relatively easy-to-understand language. Experience with Evilginx2 Malicious proxy with evilginx has several drawbacks compared to just cloning the page. Firstly, the setup is much more complicated. When you clone a page, you download the necessary files via developer tools and add the password-storing feature via some backend. Evilginx setup is more complicated. Setup needs a configuration file and a phishlet that works as a template for the phishing proxy. Setting up and running evilginx2 in the production version took me over a week compared to just cloning. The advantage is that evilginx scales much better. Once you know how to create them, you can change phishing scenarios at will because adding new phishlet is trivial. I should mention the state of the project in which evilginx is. The documentation is concise and not very useful if you have no experience with evilginx2 already. Some features and behaviors are not documented, and you need to read and debug the source code to find the behavior. The project has special financing where you can pay 400$ for a course of excellent quality, but it replaces the documentation to some extent, which doesn't seem like a good way. Either it's an open-source project with all the parts, or it's not open-source; this way, it's open-code, but you are forced into buying the expensive course. It doesn't help that the project has many open issues and bugs that nobody addresses. If you're serious about phishing, you'll probably have to edit the source code and use your version because the author doesn't put much effort into finding new PRs. For example, the PR request I made to fix the POST of a GET request three weeks[2] ago has still not been merged. The project is plagued by old libraries that are long unused. Of course, I don't want the author to handle everything himself, but sometimes, you have to give up control of the project to benefit the project. And more moderators and maintainers who want to help would certainly be found. But not to be only negative, this project is still the best of its kind. If you learn all its quirks and modify it to your purpose, it will become a tool allowing you to do campaigns of all kinds, with a level of automation that is impossible if you write the tooling yourself. Experience with Gophish Gophish isn't updated very often either, but I haven't encountered any bugs, so it doesn't really bother me. Although gophish has an API, it lacks some functionality that would be useful, so K.Gretzky had to add this API[3] to make the integration with evilginx work, anyway this approach is not sustainable and I think gophish would benefit from an API that would allow event reporting. The Gophish email template community is active, and you don't need to invest much time in a replica of the o365 email because there is a good chance that someone has already created the template. The UI is very good, and many features, like a timeline of events, will be appreciated by clients in the report. Bypassing anti measures If you send emails within a known service such as o365 or Gmail, it is good to first build an instance where you collect crawler IP addresses which you then block on the production instance and domain, thus minimizing the risk of being blacklisted, for example, outlook. Of course, this is the easier part. The harder part is to have an SMPT server with a good reputation that allows you to send phishing emails in bulk, so I do not recommend building your own SMTP server but rather use some email as a service with its own domain that has a good server reputation by default, for example, Gmail business. Summary While evilginx2 offers powerful features and scalability, its complex setup and poor documentation are significant hurdles. Gophish provides robust campaign management tools but also suffers from limited API functionality. Both tools require considerable customization and understanding to effectively use in red team operations. Mastering both tools offers significant rewards. While evilginx2 offers powerful features and scalability, its complex setup and poor documentation are significant hurdles. Gophish provides robust campaign management tools but also suffers from limited API functionality. Both tools require considerable customization and understanding to effectively use in red team operations. Mastering both tools offers significant rewards. Thank you for reading. Feedback is appreciated! References [1]: https://github.com/fin3ss3g0d/evilgophish https://github.com/fin3ss3g0d/evilgophish [2]: https://github.com/kgretzky/evilginx2/pull/1047 https://github.com/kgretzky/evilginx2/pull/1047 [3]: https://github.com/kgretzky/gophish https://github.com/kgretzky/gophish

Red Team Phishing Simulations: Using Evilginx2 and GoPhish

If you've ever struggled with setting up pipelines for extracting, transforming, and loading data (so-called ETL jobs), managing different databases, and scheduling workflows – know that there's an easier way to automate these data engineering tasks. In this article, you'll learn how to build an n8n workflow that processes text, stores data in two databases, and sends messages to Slack. A few months ago, I completed a Data Science bootcamp, where one week was all about data engineering, ETL pipelines, and workflow automation. The project for that week was to create a database of tweets that use the hashtag #OnThisDay, along with their sentiment score, and post tweets in a Slack channel to inform members about historical events that happened on that day. This pipeline had to be done with and included six steps: Docker Compose 1.  Collect tweets with the hashtag #OnThisDay 2.  Store the collected tweets in a database 3.  Extract tweets from the database 4.  Process the tweets (clean the text, analyse sentiment) 5.  Load the cleaned tweets and their sentiment score in a database 6.  Extract and post tweets with positive sentiment in a channel MongoDB Postgres Slack This is a fun project that offers lots of learning opportunities about different topics: APIs, text processing with Natural Language Processing libraries, both relational and non-relational databases, social media and communication apps, as well as workflow orchestration. If you're wondering, like I did, why we had to use two different databases, the answer is simple: for the sake of learning more. Postgres and MongoDB represent not only different database providers, but different kinds of database structures – – and it's useful to be familiar with both. relational (SQL) vs non-relational (NoSQL) Though our use case is just for fun, this pipeline can support most common data engineering tasks (e.g. aggregating data from multiple sources, setting up and managing the data flow across databases, developing and maintaining data pipelines). I was really excited, though also a bit overwhelmed by all the things I had to set up for this project. In total, I spent five days learning the tools, debugging, and building this pipeline with Python (including libraries like , , , and ), Postgres, MongoDB, , and (most frustrating part...). If you're interested to see how I did this, you can check out the project on and read . Tweepy TextBlob VADER SQLAlchemy Docker Airflow GitHub this blog post But in this article, I'll show you an easier way to achieve the same result in as much as an hour – with n8n! Workflow Since I started using n8n, I've been looking for use cases for various data science tasks, starting with my existing projects. When I realised that all the apps and services that I used in my tweets pipeline were available as n8n nodes, I decided to replicate the project as an n8n workflow with nine nodes: 1. to schedule the workflow 2. to collect the tweets 3. to store the tweets 4. to analyse the sentiment of the tweets 5. to extract the sentiment values 6. to store the tweets and their sentiment 7. to filter positive and negative tweets 8. to post tweets into a channel 9. to ignore negative tweets Cron node Twitter node MongoDB Google Cloud Natural Language Set Postgres IF Slack NoOp In this article, I'll show you how to set up this workflow node by node. If this is your first n8n workflow, have a look at the to learn how to set up n8n and how to navigate the Editor UI. It's also helpful to have at least basic knowledge of databases and SQL. quickstart guide Once you have your n8n Editor UI open, there are two ways to follow this tutorial: either copy the workflow from into your Editor UI and deactivate the nodes, so that you can execute and test each node separately, or add the nodes one at a time. here 1. Starting the workflow We will begin with the end in mind: We know that we want this whole workflow to run every day, so first, we need to set up the to trigger our workflow every day at 06:00. Cron node The Cron node makes it very easy to schedule and trigger workflows, compared to setting up , and this saved me so much time and nerves! scheduling and triggers in Airflow 2. Collecting tweets Next, we are going to collect tweets with the hashtag #OnThisDay. To do this, first, you need to create a and register an app. Follow the instructions in the to learn how to set up your Twitter app and get the necessary credentials (Consumer Key and Consumer Secret). Once you have your credentials, copy and paste them into the field of the . Next, set the parameters: Twitter Developer account reference docs Credentials Twitter node - Search - #OnThisDay - 3* *This last step is not mandatory, but I recommend limiting the number of collected tweets at least for testing the workflow, to ensure that you don't reach the query rate limit of the Twitter API and Google Cloud Natural Language. Operation: Search Text: Limit: 3. Inserting tweets into MongoDB Now that we collected some tweets, we need to store them in a database. MongoDB is a non-relational database (NoSQL) that stores data in JSON-like documents. Since our tweets are returned in JSON format, MongoDB is the ideal database to store them in and the allows us to connect to the database. Before configuring the node, you need to create a MongoDB instance, set up a cluster, create a database and a collection within it. MongoDB node 1. 2.  Set up a cluster: 3.  Create a database: 4.  Create a collection: 5.  Create a field: 6.  Allow access to the database: 7.  Connect to the database from your terminal: Create a MongoDB account cloud.mongodb.com > Clusters > Create New Cluster Cluster > Collections > Create Database Cluster > Collections > Database > Create Collection Collection > Insert document > Type the field "text" below "_id" Project > Security > Network Access > IP Access List > Add your IP address. mongo "mongodb+srv://YourClusterName.mongodb.net/<YourDatabaseName>" --username YourUsername If you need more detailed information or other set up options, refer to the . Now that we have a MongoDB collection up and running, we can set up the MongoDB node for our workflow. Set up: MongoDB documentation - mongodb+srv://YourClusterName.mongodb.net/YourDatabaseName - : YourDatabaseName Connection String: Database Next, configure the node parameters to insert the collected tweets into the collection: - : Insert - : YourCollectionName - : text Operation Collection Fields 4. Analysing the sentiment of tweets Here comes my personal favourite part of this workflow: analysing the sentiment of tweets, i.e. the feeling associated with the entire text or entities in the text. For this, we use the , which analyses a text and returns two numerical values: Google Cloud Natural Language node - : Sentiment score between -1.0 (negative sentiment) and 1.0 (positive sentiment). - : A non-negative number in the [0, +inf) range, which represents the absolute magnitude of sentiment regardless of score (positive or negative). score magnitude Both results are returned as documentSentiment in JSON format: { "magnitude": number, "score": number } Before configuring the node, you have to sign up on the to enable the API and get the necessary credentials (Client ID and Client Secret). Follow the instructions in the to set up your account and the node credentials. Google Cloud Platform reference docs Once that's done, add an expression to the parameter by clicking on the gear icon and selecting . Content Current Node > Input Data > text As a side note, here it was interesting to see how differently Google Cloud Natural Language and the VADER and TextBlob libraries evaluated the sentiment of text: 5. Processing sentiment analysis Now that we have sentiment scores for each tweet, we want to insert the text, sentiment score, and magnitude of the tweets into a new Postgres database. Since the magnitude sentiment score and the magnitude are included in the documentSentiment, we need to extract them in order to insert the values in two separate columns in Postgres. For this, we use the , which allows us to set new values based on the data we already have. In the node parameters, set three values: Set node - (number): - (number): - (string): Score Current Node > Input Data > JSON > documentSentiment > score Magnitude Current Node > Input Data > JSON > documentSentiment > score Text Current Node > Input Data > JSON > sentences > [Item: 0] > text > content 6. Inserting tweets values into Postgres Next, we want to insert the newly set data values into a Postgres database. First, you need to , then create a database and a table for tweets. The process is quite similar to the MongoDB setup and you can do this from your terminal: install Postgres 1. Connect to Postgres: 2. Create a database: 3. Go into the created database: 4. Create columns in the database. The columns have to be named like the values defined in the Set node, in order to be matched: psql createdb twitter psql twitter CREATE TABLE tweets (text varchar(280), score numeric(4,3), magnitude numeric(4,3)); Now we can go ahead and configure the Fill in the name of your database, username, and password in the fields, then configure the node parameters: Postgres node. Credential Data - : Insert - : tweets - : text, score, magnitude - : * Operation Table Columns Return Fields After executing the node, you can check if the tweets have been inserted in the table by running in the terminal. SELECT * FROM tweets; 7. Filtering positive and negative tweets Here comes another fun part related to sentiment analysis: filtering negative tweets. For this, we use the which allows us to split the workflow conditionally based on comparison operations. We define positive tweets as those with a sentiment score above 0. To configure the IF node with this condition, configure the parameters: IF node, - Current Node > Input Data > JSON > score - : Larger - 0 Value 1: Operation Value 2: This condition determines the data flow to the following connection: if the sentiment score is greater than 0, the tweet will be sent to Slack, otherwise it will just be kept stored in the database. 8. Sending positive tweets to Slack The way to send tweets from a database to a Slack channel is via a Slackbot, which you have to create from your Slack account. Follow the instructions and in the to learn how to create your Slackbot and get the necessary credentials (Access Token). on Slack reference docs Once you have the Slack node credentials set up, configure the parameters: - Message - Post - <YourSlackChannelName> - 🐦 NEW TWEET with sentiment score and magnitude ⬇️ Resource: Operation: Channel: Text: {{$json["score"]}} {{$json["magnitude"]}} {{$json["text"]}} After executing the node, check your Slack channel for a new tweet: 9. Ignoring negative tweets The last node in this workflow is the , which is used when we don't want to perform any operations. The purpose of this node is to make the workflow easier to read and understand where the data flow stops. Though this node is not necessary for our workflow, I included it to mark visually the false condition and make it clear that the workflow can be extended in this direction. NoOp node Finally, execute the whole workflow and activate it, so that it runs as scheduled. Also, check your MongoDB collection and Postgres database to make sure that the tweets have been inserted properly. Next steps Congrats – you now have an automated workflow that informs you every day about positive historical events that happened on that day! As usual, you can tweak and extend this workflow, for example by keeping track of whether a tweet has been processed already, adding an action for the condition when the IF node is false, or cleaning the text of the collected tweets to check whether it influences the sentiment score. Of course, you can also build other ETL pipelines for various business use cases, such as product feedback at scale, Jira ticket automation based on customer sentiment, or regular database querying for reporting.

How To Build An n8n Workflow To Manage Different Databases and Scheduling Workflows

Cybersecurity threats anytime soon. That means application security (AppSec) must be a key part of every developer’s job – but it isn’t always a breeze to fix code during or after release to production. On top of that, it’s even more of a tricky task when you need to pause your coding efforts and search for resources in order to remediate a flaw. aren’t going away Luckily, with secure coding best practices and training at your fingertips, writing more secure code isn’t a chore. In of this two-part series we examined best practices around parameterizing your queries to avoid SQL injection and encoding data. In this second part, we’re digging into five additional tips to help you code more securely, from leveraging existing frameworks to protecting data. part one Tip 6: Implement access controls. You can dramatically improve protection and resiliency in your applications by building authorization or access controls into your applications in the initial stages of application development. Note that authorization is not the same as authentication. According to , authorization is the “process where requests to access a particular feature or resource should be granted or denied.” When appropriate, authorization should include a multi-tenancy and horizontal (data specific) access control. OWASP Security tips Use a security-centric design, where access is verified first. Consider using a filter or other automated mechanism to ensure that all requests go through an access control check. Consider denying all access for features that haven’t been configured for access control. Code to the principle of least privilege. Allocate the minimum privilege and time span required to perform an action for each user or system component. Separate access control policy and application code, whenever possible. Consider checking if the user has access to a feature in code, as opposed to checking the user's role. Adopt a framework that supports server-side trusted data for driving access control. Key elements of the framework include user identity and log-in state, user entitlements, overall access control policy, the feature and data requested, along with time and geolocation. Examples Consider checking if the user has access to a feature in code, as opposed to checking what role the user is in code. Below is an example of hard-coding role checks. Tip 7: Leverage security frameworks and libraries. You can waste a lot of time — and unintentionally create security flaws — by developing security controls from scratch for every web application you’re working on. To avoid that, take advantage of established security frameworks and, when necessary, respected third-party libraries that provide tested and proven security controls. Security tips Use existing secure framework features rather than using new tools, such as third-party libraries. Because some frameworks have security flaws, build in additional controls or security protections as needed. Use web application security frameworks, including Spring Security, Apache Shiro, Django Security, and Flask security. Regularly check for security flaws and keep frameworks and libraries up to date. Bonus tip The crucial thing to keep in mind about vulnerable open source libraries is that it’s not just important to know when a library contains a flaw, but whether that library is used in such a way that the flaw is easily exploitable. We know that, upon initial scan, of applications have flaws in an open source library. Additionally, data compiled from customer use of Veracode’s solution shows that at least nine times out of 10, developers aren't necessarily using a vulnerable library in a vulnerable way. 70.5 percent Software Composition Analysis By understanding not just the status of the library but whether or not a vulnerable method is being called, organizations can pinpoint their risk and prioritize fixes based on the riskiest uses of libraries. Tip 8: Protect your data. Organizations have a duty to protect sensitive data within applications. To that end, you must encrypt critical data while it’s at rest and in transit. This includes financial transactions, web data, browser data, and information residing in mobile apps. Guidelines like the EU General Data Protection Regulation make data protection a serious issue. compliance Security tips Don’t be tempted to implement your own homegrown libraries. Most modern languages have implemented crypto libraries and modules, but in the event your language did not, consult your security team to find a security-focused, peer-reviewed, and well-maintained library. Don’t neglect the more difficult aspects of applied crypto, such as key management, overall cryptographic architecture design, tiering, and trust issues in complex software. Existing crypto hardware, such as a Hardware Security Module (HSM) solutions, can make your job easier. Avoid using an inadequate key or storing the key along with the encrypted data. Don’t make confidential or sensitive data accessible in memory or allow it to be written into temporary storage locations or log files that an attacker can view. Use transport layer security (TLS) to encrypt data in transit. Examples The security of basic elements largely depends on the underlying random number generator (RNG). An RNG that is suitable for cryptographic usage is called a cryptographically secure pseudo-random number generator (CSPRNG). Don’t use Math.random. It generates random values deterministically, and its output is considered vastly insecure. cryptographic Tip 9: Implement logging and intrusion detection. Logging should be used for more than just debugging and troubleshooting.  Logging and tracking security events and metrics help to enable what’s known as attack-driven defense, which considers the scenarios for real-world attacks against your system. For example, if a server-side validation catches a change to a non-editable field, throw an alert or take some other action to protect your system. Focus on four key areas: application monitoring; business analytics and insight; activity auditing and compliance monitoring; and system intrusion detection and forensics. Security tips Use an extensible logging framework like SLF4J with Logback, or Apache Log4j2, to ensure that all log entries are consistent. Keep various audit and transaction logs separate for both security and auditing purposes. Always log the timestamp and identifying information, like source IP and user ID. Don’t log opt-out data, session IDs, or hash value of passwords, or sensitive or private data including credit card or Social Security numbers. Perform encoding on untrusted data before logging it to protect from log injection and log forging. Log at an optimal level. Too much or too little logging can heighten risk. Examples In mobile applications, developers use logging functionality for debugging, which may lead to sensitive information leakage. These console logs are not only accessible using the Xcode IDE (in iOS platform) or Logcat (in Android platform), but by any third-party application installed on the same device.  For this reason, disable logging functionality in production release. Tip 10: Monitor error and exception handling. Error and exception handling isn’t exciting, but like input validation, it is a crucial element of defensive coding. Mistakes in error and exception handling can cause leakage of information to attackers, who can use it to better understand your platform or design. Even small mistakes in error handling have been found to cause catastrophic failures. Security tips Conduct careful code reviews and use negative testing, including exploratory testing and pen testing, fuzzing, and fault injection, to identify problems in error handling. Manage exceptions in a centralized manner to avoid duplicated try/catch blocks in the code. In addition, verify that all unexpected behaviors are correctly handled inside the application. Confirm that error messages sent to users aren't susceptible to critical data leaks, and that exceptions are logged in a way that delivers enough information for QA, forensics, or incident response teams to understand the problem. Example Returning a stack trace or other internal error details can tell an attacker too much about your environment. Returning different errors in different situations (for example, "invalid user" vs. "invalid password" on authentication errors) can also help attackers find their way in. Give your secure coding knowledge a boost There isn’t a one-size-fits-all solution to writing more secure code. It takes patience, practice, and the know-how that comes from relevant training in the languages you use most and consistent best practices. Veracode – a complimentary version for developers who want to enhance their secure coding skills – relies on hands-on training for greater impact. Practice exploiting real applications in contained environments to learn how threat actors operate, and then patch them to learn how to keep your code secure. Security Labs Community Edition Stay on top of the latest best practices in application security (AppSec) to improve every day. If you missed the first part of this series with more secure coding tips and tricks, . read it here

5 Tips for Integrating Security into Development: Part 2

This is the first article of a series of three about decentralized identity, where we’ll cover the problem, state of the art, and new developments. If this excites you, be sure to subscribe . If you’re in a hurry, there’s a TL;DR at the bottom. Identity is a crucial part of our everyday lives and a pillar among our society. But the definition of “Identity” is somewhat subjective and people have different interpretations of its meaning. Let’s question ourselves: Is it your physical traits like your height, age, fingerprint or DNA? Is it your personality traits like kindness, pro-activity or rudeness? Is it what you have accumulated or achieved throughout your life, such as your experiences, health records or academic degree? Is it what others assigned to you, like your government issued ID or phone number? All of these and many others contribute to your uniqueness and, consequentially, form your identity. This still holds true in the digital world, where everything that you do online also makes you, . you Image from: https://imgur.com/gallery/vM1MCqy Status quo in the digital world Authentication and accounts Most internet-based services require you to identify yourself in order to deliver a personalized experience. This is traditionally done via accounts that you create for each service, which are often based on a username/email and a password. However, people often forget these credentials as they are difficult to memorize. To make things worse, they also have to replicate their basic details in all of these services. The user experience is bad, to say the least, and the management of all these access credentials and basic details can be cumbersome. Image from: https://www.cybersafewarwickshire.com Single Sign-On (SSO) introduced by popular services, such as Google and Facebook, made everything more convenient to users. Conversely, these services use non-interoperable models, regardless of using open-standards such as , meaning developers have to do different integrations to capture as many users as possible. Moreover, it creates a hard dependency on them. What if they ? What if your government decides to you live? What happens when they cease to exist? It’s hard to believe that these giants might shut down one day, but the same could be said for companies that went bankrupt during the . OAuth kick you out ban them in the country DotCom Bubble Permanence Everything you do online, such as buying a book or uploading a photo, is stored in the services you use. Thus, the service is responsible for keeping the content online and accessible to you. Yet, as proven many times in the past, huge sets of data have been lost due to human error. and many of these songs are now lost forever. It is reminiscent of the fire of the , where a massive amount of knowledge was reduced to ashes. MySpace recently admitted losing 12 years’ worth of music Library of Alexandria Furthermore, services have to abide legal authorities who might rule orders to delete content or to completely eclipse them. As an example, the Prime Minister David Cameron of United Kingdom , among other social networking sites during the 2011 England riots, which would have affected access to social content for everyone in the UK. threatened to shut down Twitter Trust model & Security Who’s to say that the data you produce wasn’t tampered with? This is not a concern for most users as they trust the services they use act in good faith and won’t modify users’ data. At the same time, users assume these services are secure, which we know it’s not always true. In fact, we hear about security breaches on mainstream services often, in which huge amounts of data are leaked. What if data wasn’t stolen but modified without anyone noticing it? For example, what consequences would there be if an attacker modified your medical records in a hospital, such as your blood type, a day before you having surgery? Privacy The internet can pose privacy and safety risks. Most services prompt the user to disclose sensitive information which will be stored on their side. In many cases, the security measures employed by these services are poor, resulting in situations like , in which sensitive data was leaked, including credit card information, emails, phone numbers and home addresses. Equifax Are there better ways for services to enhance privacy by improving the way they store sensitive data? Is it even necessary to store this type of data on the service in the first place? Breaking the silos Image from https://review.content-science.com Most of the problems described above are a consequence of the data silos created by centralized services. Thus, we may say they are closed platforms that operate the infrastructure, own the data and decide who has access to it. But arguably, identity in particular should be controlled solely by its owner. It should be built on open standards, with well-defined data models, semantics and interactions. By decentralizing the identity system, we are effectively replacing the tightly-coupled identity solutions each service has, with a more open, flexible and powerful alternative. This unlocks a whole set of experiences and opportunities for everyone. We have reached a pivotal moment in history where technology is making this possible, and people, businesses and other entities are more sensitive than ever on the matter of digital identity, as it has become an integral part of our lives. Decentralized Identifiers “Decentralized Identifiers (DIDs) are a new type of identifier for verifiable, self-sovereign digital identity. DIDs are fully under the control of the DID subject, independent from any centralized registry, identity provider, or certificate authority.”, Decentralized Identifiers (DIDs) In short, are user-generated, self-owned, globally unique identifiers rooted in decentralized systems, such as , and . DIDs resolve to DID Documents which describe how to use that specific DID. Most importantly, it contains a set of cryptographic material and endpoints that can be used to interact with the identity subject. DIDs Bitcoin Ethereum IPFS A DID based on the IPID DID Method , which uses the IPFS distributed storage and network. There are implemented on different distributed ledgers and networks, and each one include the precise methods by which DIDs are resolved and deactivated and DID Documents are written and updated. several DID Methods Verifiable Credentials “Credentials are a part of our daily lives; driver’s licenses are used to assert that we are capable of operating a motor vehicle, university degrees can be used to assert our level of education, and government-issued passports enable us to travel between countries. This specification provides a mechanism to express these sorts of credentials on the Web in a way that is cryptographically secure, privacy respecting, and machine-verifiable.”, Verifiable Credentials Data Model DIDs begin by being “trustless” in the sense that they don’t directly provide meaningful identity attributes. However, trust between DID-identified peers can be built up through the exchange of — credentials about identity attributes that include cryptographic proof. These proofs can be verified by reference to the issuer’s DID and DID Document. Verifiable Credentials The roles and information flows forming the basis for Verifiable Credentials. Image from: https://www.w3.org/TR/verifiable-claims-data-model Adoption and benefits Both of these open standards are becoming notoriously important as they grow in adoption. For example, Microsoft has recently they are a Decentralized Identity solution which uses DIDs and Verifiable Credentials, highlighting the potential importance these standards might have in our future lives. announced building Following the previously mentioned problems of centralized identity and by attaining perception of what the decentralized alternative can bring, a few solutions jump to eye: Universal Single Sign-On by leveraging based on DIDs and Verifiable Credentials. authentication No data-tampering as everything you do can be cryptographically signed and verified by others. Services can interact with endpoints defined in your DID Document to process payments or to send messages (no more emails or credit cards being stored by others 👌). Enables users to manage and store their own data and also empowers them to contribute to the permanence of each other’s data. Services can still contribute to the network, ensuring a baseline quality and responsiveness. The benefits of Decentralized Identity transcend the use-cases of the internet. Let your imagination fly, and imagine how it would be to buy alcohol in a physical store with this system in place: You go into a liquor store while carrying your identity wallet 📱, containing your DID and Verifiable Credentials you have been collecting from issuers. After choosing a bottle of your favorite red wine 🍷, you go to the cashier in order to pay. Because you are 21, but actually look like an 18 year old 👶, the cashier asks for a proof of your age. You establish a secure communication channel between your wallet and theirs, by using NFC, scanning a QR Code or any similar mechanism. The cashier initiates a handshake ceremony 🤝, asking you to disclose your DID and prove control over it via a cryptographic challenge. Using that same channel, the cashier then prompts for a credential, issued by the government’s DID, stating you are 21 or older. After you send it, the cashier checks if the credential is authentic, by verifying if the cryptographic signature matches a public key listed in the government’s DID Document. If the signature is indeed valid, the cashier allows the purchase. Finally, you use the same wallet to pay 💵 for the wine and to automatically fill the VAT number for expenses, which may also be in the form of a credential. There was no human intervention involved, except when facilitating the establishment of the communication channel. Everything else happened behind the scenes. The overall experience was much more friendly and secure than what’s currently being done. Enter Identity Manager and Nomios The concepts presented above aren’t new. In fact, there are a few solutions that you may already use to bring Decentralized Identity to the web, such as , or . uPort Blockstack Jolocom While DID’s, Verifiable Credentials and DID based authentication provide interoperable models for common use-cases, the reality is that existent solutions are closed in their own DID-method ecosystems. On one hand, developers wanting to embrace identities using different DID-methods have to integrate with different SDKs, each one having its own APIs, increasing integration complexity and crippling adoption. Some of the libraries you have to integrate in your applications On the other hand, users are often asked to authenticate using specific DID-methods because the application they are interacting with may be limited by the DID-methods they support. As a consequence, users are required to use multiple wallets to manage different identities they own, which are conceptually the same. Our friend Rick Sanchez has to manage multiple identities to interact with applications 😢. (IDM) is a unified identity wallet specification that aims to support multiple DIDs and multiple DID-methods. While ambitious, this is a win-win for both developers and users. It has a strong focus on user & developer-experience, while providing an easy way to have authentication and signing in applications. The Identity Manager Additionally, we will be helping on interoperability efforts, such as collaborating on the , which enables websites to request identities’ credentials from any wallet as well as to help them to correctly store credentials for future use. Credential Handler API is the first identity wallet to be based on IDM, which uses the reference . Nomios JavaScript IDM implementation The identity page within the Nomios wallet. The prompt users get when authenticating to applications. A walk-through over all the features Nomios currently has, including authentication and signing. Both IDM and Nomios are open-source and being actively worked on. They are in , and open to projects, companies and organizations interested in adopting and helping shape this open standard. alpha stage TL;DR Centralized services create data silos that can be harmful for digital identity. By decentralizing the identity system we may replace current identity systems with a more open, flexible and powerful alternative. This is now possible thanks to technology and social breakthroughs, in which people, businesses and other entities are more sensitive than ever on the matter of digital identity. DIDs, Verifiable Credentials and other standards are becoming notoriously important as they grow in adoption. However, while DIDs, Verifiable Credentials and DID based authentication provide interoperable models for common use-cases, the reality is that current solutions are closed in their own DID-method ecosystems. We are building and which are in line with the concepts of Decentralized Identities but with a focus on interoperability, user experience and developer experience. IDM Nomios In the next article, we will be explaining the reasons that led us to create IDM, do an in-depth analysis on the state of the art, dive into its current features and briefly talk about its roadmap. 👉 For now, head on to and join our mailing list to keep up to date with what we’re building! https://nomios.io/#subscribe 👉 Comment away any questions or feedback you may have and if you liked it, give this article your claps 👏. 👉 You can find me on , , etc. Feel free to reach out! Twitter Github Thanks to Vasco Santos, Marco Oliveira, Gil Domingues, Diogo Silva, Paulo Marcos, and Sara Bianchi

The need for Decentralized Identity

I’d like to think I know Node pretty well. I haven’t written a site that use it for about 3 years now. But I’ve never actually sat down and read the docs. web doesn’t As long-time readers will know, I am on a journey of writing out every interface, prop, method, function, data type, etc related to web development, so that I can fill in the gaps of what I don’t know. The Node docs were my last stop, having finished HTML, DOM, the Web APIs, CSS, SVG, and EcmaScript. This held the most unknown gems for me, so I thought I’d share them in this little listicle. I will present them in descending order of appeal. As I do with my outfits when I meet someone new. The querystring module as a general purpose parser Let’s say you’ve got data from some weirdo database that gives you an array of key/value pairs in the form . Naturally you think this might be nice as a object. So you create a blank object, then you create an array by splitting the string on , loop over it, for each item, split it again on and add the first item in that array as a prop of your object setting the second as the value. name:Sophie;shape:fox;condition:new JavaScript ; : Right? No! You use querystring const weirdoString = `name:Sophie;shape:fox;condition:new`;const result = querystring.parse(weirdoString, `;`, `:`); // result:// {//   name: `Sophie`,//   shape: `fox`,//   condition: `new`,// }; _By default, percent-encoded characters within the query string will be assumed to use UTF-8 encoding. If an alternative…_nodejs.org Query String | Node.js v7.0.0 Documentation V8 Inspector Run node with , it will tell you a URL. Paste that URL into Chrome. Boom, debugging Node in the Chrome DevTools. Happy days. There’s a . --inspect how-to by Paul Irish over here It’s still ‘experimental’, but so is my medication and I’M DOING FINE. _Node.js includes a full-featured out-of-process debugging utility accessible via a simple TCP-based protocol and built…_nodejs.org Debugger | Node.js v7.0.0 Documentation The difference between nextTick and setImmediate As with so many things, remembering the difference between these two is easy if you imagine they had different names. should be . process.nextTick() process.sendThisToTheStartOfTheQueue() should be called . setImmediate() sendThisToTheEndOfTheQueue() (Unrelated: I always thought that in React, should be called and should be called . The fact that they’re the same length is just a bonus.) props stuffThatShouldStayTheSameIfTheUserRefreshes state stuffThatShouldBeForgottenIfTheUserRefreshes _Stability: 3 — Locked The timer module exposes a global API for scheduling functions to be called at some future period…_nodejs.org Node.js v7.0.0 Documentation _A process warning is similar to an error in that it describes exceptional conditions that are being brought to the user…_nodejs.org process | Node.js v7.0.0 Documentation _I am pleased to announce a new stable version of Node. This branch brings significant improvements to many areas, with…_nodejs.org Node v0.10.0 (Stable) Server.listen takes an object I’m a fan of passing a single ‘options’ parameter rather than five different parameters that are unnamed and must be in a particular order. As it turns out, you can do this when setting up a server to listen for requests. require(`http`).createServer().listen({port: 8080,host: `localhost`,}).on(`request`, (req, res) => {res.end(`Hello World!`);}); This is a sneaky one, because it’s not actually listed in the docs for , you will only find it in the documentation (which inherits from). [http.Server](https://nodejs.org/api/http.html#http_class_http_server) [net.Server](https://nodejs.org/api/net.html#net_server_listen_options_callback) http.Server _Stops the server from accepting new connections and keeps existing connections. This function is asynchronous, the…_nodejs.org net | Node.js v7.0.0 Documentation Relative paths The path you pass to the module methods can be relative. It’s relative to . This is probably something that most people already knew, but I always thought it had to be a full path. fs process.cwd() const fs = require(`fs`);const path = require(`path`); // why have I always done this...fs.readFile(path.join(__dirname, `myFile.txt`), (err, data) => {// do something}); // when I could just do this?fs.readFile(`./path/to/myFile.txt`, (err, data) => {// do something}); _birthtime “Birth Time” — Time of file creation. Set once when the file is created. On filesystems where birthtime is…_nodejs.org File System | Node.js v7.0.0 Documentation Path parsing One of the many things I’ve unnecessarily fiddled with regexes for is getting filenames and extensions from paths, when all I needed to do was: myFilePath = `/someDir/someFile.json`;path.parse(myFilePath).base === `someFile.json`; // truepath.parse(myFilePath).name === `someFile`; // truepath.parse(myFilePath).ext === `.json`; // true _Stability: 2 — Stable The path module provides utilities for working with file and directory paths. It can be accessed…_nodejs.org Node.js v7.0.0 Documentation Logging with colors I’m going to pretend I didn’t already know that will print the object with props/values as different colors, making them much easier to read. console.dir(obj, {colors: true}) _The console functions are usually asynchronous unless the destination is a file. Disks are fast and operating systems…_nodejs.org Console | Node.js v7.0.0 Documentation You can tell setInterval() to sit in the corner Let’s say you use to do a database cleanup once a day. By default, Node’s event loop won’t exit while there is a pending. If you want to let Node sleep (I have no idea what the benefits of this are) you can do this. setInterval() setInterval() const dailyCleanup = setInterval(() => {cleanup();}, 1000 * 60 * 60 * 24); dailyCleanup.unref(); Careful though, if you have nothing else pending (e.g. no http server listening), Node will exit. _Stability: 3 — Locked The timer module exposes a global API for scheduling functions to be called at some future period…_nodejs.org Node.js v7.0.0 Documentation Using the signal constants If you enjoy killing, you may have done this before: process.kill(process.pid, `SIGTERM`); Nothing wrong with that. If no bug involving a typo had ever existed in the history of computer programming. But since that second parameter takes a string the equivalent int, you can use the more robust: or process.kill(process.pid, os.constants.signals.SIGTERM); IP address validation There’s a built in IP address validator. I have written out a regex to do exactly this more than once. Stupid David. will return . require(`net`).isIP(`10.0.0.1`) 4 will return . require(`net`).isIP(`cats`) 0 Because cats aren’t an IP address. If you haven’t noticed, I’m going through a phase of using only backticks for strings. It’s growing on me but I’m aware it looks odd so I’m mentioning it and quite frankly wondering what the point of mentioning it is and am now concerned with how I’m going to wrap up this sentence, I shou _Stops the server from accepting new connections and keeps existing connections. This function is asynchronous, the…_nodejs.org net | Node.js v7.0.0 Documentation os.EOL Have you ever hard-coded an end-of-line character? Egad! Just for you, there is (which is on Windows and elsewhere). will ensure your code behaves consistently across operating systems. os.EOL \r\n \n Switching to os.EOL Edit: I didn’t give this enough thought. and have both pointed out in the comments that this can be troublesome. You must assume that any given file could use CRLF( ) or LF ( ) and you simply don’t know. Andrew Meyer Damon Gant \r\n \n If you have an open source project and want to enforce a certain line feed style, there is an that can partially help with this. Doesn’t help if git then messes with it though. eslint rule There is still a use for though. For example when writing out log files that won’t be transported to other OSes. In this case it ensures that the logs files are displayed correctly (e.g. when opened in notepad on a Windows server). os.EOL const fs = require(`fs`); // hard-coded CRLFfs.readFile(`./myFile.txt`, `utf8`, (err, data) => {data.split(`\r\n`).forEach(line => {// do something});}); // based on OSconst os = require(`os`);fs.readFile(`./myFile.txt`, `utf8`, (err, data) => {data.split(os.EOL).forEach(line => {// do something});}); _{ model: ‘Intel(R) Core(TM) i7 CPU 860 @ 2.80GHz’, speed: 2926, times: { user: 252020, nice: 0, sys: 30340, idle…_nodejs.org OS | Node.js v7.0.0 Documentation Status code lookup There is a lookup of common HTTP status codes and their friendly names. is the object of which I speak, where each key is a status code, and the matching value is the human readable description. http.STATUS_CODES So you can do this: someResponse.code === 301; // truerequire(`http`).STATUS_CODES[someResponse.code] === `Moved Permanently`; // true _The HTTP interfaces in Node.js are designed to support many features of the protocol which have been traditionally…_nodejs.org HTTP | Node.js v7.0.0 Documentation Preventing unnecessary crashes I always thought it was a bit ridiculous that the below would actually stop a server: const jsonData = getDataFromSomeApi(); // But oh no, bad data!const data = JSON.parse(jsonData); // Loud crashing noise. To prevent silly things like this from ruining your day, you can put right at the top of your Node app. process.on(`uncaughtException`, console.error); Of course, I’m a sane person so I use and wrap everything in if I’m being paid, but for personal projects… PM2 try...catch Warning, this is , and in a large complex app is probably a bad idea. I’ll let you decide if you want to trust some dude’s blog post or the official docs. not best practice _A process warning is similar to an error in that it describes exceptional conditions that are being brought to the user…_nodejs.org process | Node.js v7.0.0 Documentation Just this once() In addition to , there is a method for all EventEmitters. I’m quite sure I’m the last person on earth to learn this. So … that’s everyone then. on() once() server.once(`request`, (req, res) => res.end(`No more from me.`)); _Much of the Node.js core API is built around an idiomatic asynchronous event-driven architecture in which certain kinds…_nodejs.org Events | Node.js v7.0.0 Documentation Custom console You can create your own console with and pass in your own output streams. new console.Console(standardOut, errorOut) Why? I have no idea. Maybe you want to create a console that outputs to a file, or a socket, or a third thing. _The console functions are usually asynchronous unless the destination is a file. Disks are fast and operating systems…_nodejs.org Console | Node.js v7.0.0 Documentation DNS lookup A little birdy told me that Node . So if you’re hitting a URL again and again you’re wasting valuable milliseconds. In which case you could get the domain yourself with and cache it. Or someone else created earlier. doesn’t cache DNS lookups dns.lookup() here’s one dns.lookup(`www.myApi.com`, 4, (err, address) => {cacheThisForLater(address);}); _2) Functions that connect to an actual DNS server to perform name resolution, and that always use the network to…_nodejs.org DNS | Node.js v7.0.0 Documentation The module is a minefield of OS quirks fs If, like me, your style of writing code is read-the-absolute-minimum-from-the-docs-then-fiddle-till-it-works, then you’re probably going to run into trouble with the module. Node does a great job of ironing out the differences between operating systems, but there’s only so much they can do, and a number of OS differences poke through the ocean of code like the jagged protrusions of a reef. A reef that has a minefield in it. You’re a boat. fs Unfortunately, these differences aren’t all “Window vs The Others”, so we can’t simply invoke the “pffft, no one uses Windows” defence. (I wrote a whole big rant about the anti-Windows sentiment in web development but deleted it because it got so preachy even I was rolling my eyes at myself.) Here is a spattering of things from the module that could bite you in your downstairs area: fs The property of the object returned by will be different on Windows and other operating systems (on Windows they may not match the file mode constants such as ). mode fs.stats() fs.constants.S_IRWXU is only available on macOS. fs.lchmod() Calling with the parameter is only supported on Windows. fs.symlink() type The option that can be passed to works on macOS and Windows only. recursive fs.watch() The callback will only receive a filename on Linux and Windows. fs.watch() Using on a directory with the flag will work on FreeBSD and Windows, but fail on macOS and Linux. fs.open() a+ A parameter passed to will be ignored on Linux when the file is opened in append mode (the kernel will ignore the position and append to the end of the file). position fs.write() (I’m so hip I’m already calling it macOS when OS X has only been in the grave for 49 days.) _birthtime "Birth Time" - Time of file creation. Set once when the file is created. On filesystems where birthtime is…_nodejs.org File System | Node.js v7.0.0 Documentation The net module is twice as fast as http Reading the docs, I learnt that the module is a thing. And that it underpins the module. Which got me thinking, if I wanted to do server-to-server communication (as it turns out, I do) should I just be using the module? net http net Networking folk will find it difficult to believe that I couldn’t intuit the answer, but as a web developer that has fallen ass-first into the server world, I know HTTP and not much else. All this TCP, socket, stream malarkey is a bit like to me. Which is to say, I don’t really get it, but I’m intrigued. Japanese rap To play and compare, I set up a couple of servers (I trust you’re listening to Japanese rap right now) and fired some requests at them. End result, handles ~3,400 requests per second, handles ~5,500 requests per second. [http.Server](https://nodejs.org/api/http.html#http_class_http_server) [net.Server](https://nodejs.org/api/net.html#net_class_net_server) It’s simpler too. This is the code, if you’re interested. If you’re not interested then I’m sorry I’m making you scroll so much. _Stops the server from accepting new connections and keeps existing connections. This function is asynchronous, the…_nodejs.org net | Node.js v7.0.0 Documentation REPL tricks If you’re in the REPL (that is, you’ve typed and hit enter in your terminal) you can type and it will load that file in (for example you might load a file that sets a bunch of constants). node .load someFile.js You can set the environment variable to disable writing the repl history to a file. I also learnt (was reminded at least) that the REPL history is written to , if you’d like a trip down memory lane. NODE_REPL_HISTORY="" ~/.node_repl_history is a variable that holds the result of the last evaluated expression. Mildly handy! _ When the REPL starts, all modules are loaded for you. So, for example, you can just type so see what your architecture is. You don’t need to do . (Edit: OK to be precise, modules are loaded on demand.) os.arch() require(`os`).arch(); _Edit description_nodejs.org Node.js v7.0.0 Documentation Thanks for reading! Enjoy your day and if I don’t see you before, have a great Christmas. is how hackers start their afternoons. We’re a part of the family. We are now and happy to opportunities. Hacker Noon @AMI accepting submissions discuss advertising &sponsorship To learn more, , , or simply, read our about page like/message us on Facebook tweet/DM @HackerNoon. If you enjoyed this story, we recommend reading our and . Until next time, don’t take the realities of the world for granted! latest tech stories trending tech stories

19 things I learnt reading the NodeJSdocs

Scientific American Supplement, No. 711, August 17, 1889, by Various, is part of the HackerNoon Books Series. You can jump to any chapter in this book . IRIDESCENT CRYSTALS here IRIDESCENT CRYSTALS. By Lord Rayleigh. The principal subject of the lecture is the peculiar colored reflection observed in certain specimens of chlorate of potash. Reflection implies a high degree of discontinuity. In some cases, as in decomposed glass, and probably in opals, the discontinuity is due to the interposition of layers of air; but, as was proved by Stokes, in the case of chlorate crystals the discontinuity is that known as twinning. The seat of the color is a very thin layer in the interior of the crystal and parallel to its faces. The following laws were discovered by Stokes: (1) If one of the crystalline plates be turned round in its own plane, without alteration of the angle of incidence, the peculiar reflection vanishes twice in a revolution, viz., when the plane of incidence coincides with the plane of symmetry of the crystal. [Shown.] (2) As the angle of incidence is increased, the reflected light becomes brighter and rises in refrangibility. [Shown.] (3) The colors are not due to absorption, the transmitted light being strictly complementary to the reflected. (4) The colored light is not polarized. It is produced indifferently, whether the incident light be common light or light polarized in any plane, and is seen whether the reflected light be viewed directly or through a Nicol's prism turned in any way. [Shown.] (5) The spectrum of the reflected light is frequently found to consist almost entirely of a comparatively narrow band. When the angle of incidence is increased, the band moves in the direction of increasing refrangibility, and at the same time increases rapidly in width. In many cases the reflection appears to be almost total. Fig. 1 general scheme In order to project these phenomena a crystal is prepared by cementing a smooth face to a strip of glass whose sides are not quite parallel. The white reflection from the anterior face of the glass can then be separated from the real subject of the experiment. A very remarkable feature in the reflected light remains to be noticed. If the angle of incidence be small, and if the incident light be polarized in or perpendicularly to the plane of incidence, the reflected light is polarized in the manner. [Shown.] opposite Similar phenomena, except that the reflection is white, are exhibited by crystals prepared in a manner described by Madan. If the crystal be heated beyond a certain point the peculiar reflection disappears, but returns upon cooling. [Shown.] In all these cases there can be little doubt that the reflection takes place at twin surfaces, the theory of such reflection ( , Sept., 1888) reproducing with remarkable exactness most of the features above described. In order to explain the vigor and purity of the color reflected in certain crystals, it is necessary to suppose that there are a considerable number of twin surfaces disposed at approximate equal intervals. At each angle of incidence there would be a particular wave length for which the phases of the several reflections are in agreement. The selection of light of a particular wave length would thus take place upon the same principle as in diffraction spectra, and might reach a high degree of perfection. Phil. Mag. In illustration of this explanation an acoustical analogue is exhibited. The successive twin planes are imitated by parallel and equidistant disks of muslin (Figs. 1 and 2) stretched upon brass rings and mounted (with the aid of three lazy-tongs arrangements) so that there is but one degree of freedom to move, and that of such a character as to vary the interval between the disks without disturbing their equidistance and parallelism. The source of sound is a bird call, giving a pure tone of high pitch (inaudible), and the percipient is a high-pressure flame issuing from a burner so oriented that the direct waves are without influence upon the flame (see , xxxviii., 208; Proc. Roy. Inst., January, 1888). But the waves reflected from the muslin arrive in the effective direction, and if of sufficient intensity induce flaring. The experiment consists in showing that the action depends upon the distance between the disks. If the distance be such that the waves reflected from the several disks co-operate, the flame flares, but for intermediate adjustments recovers its equilibrium. For full success it is necessary that the reflective power of a single disk be neither too great nor too small. A somewhat open fabric appears suitable. Nature 2 It was shown by Brewster that certain natural specimens of Iceland spar are traversed by thin twin strata. A convergent beam, reflected at a nearly grazing incidence from the twin planes, depicts upon the screen an arc of light, which is interrupted by a dark spot corresponding to the plane of symmetry. [Shown.] A similar experiment may be made with small rhombs in which twin layers have been developed by mechanical force after the manner of Reusch. The light reflected from fiery opals has been shown by Crookes to possess in many cases a high degree of purity, rivaling in this respect the reflection from chlorate of potash. The explanation is to be sought in a periodic stratified structure. But the other features differ widely in the two cases. There is here no semicircular evanescence, as the specimen is rotated in azimuth. On the contrary, the colored light transmitted perpendicularly through a thin plate of opal undergoes no change when the gem is turned round in its own plane. This appears to prove that the alternate states are not related to one another as twin crystals. More probably the alternate strata are of air, as in decomposed glass. The brilliancy of opals is said to be readily affected by atmospheric conditions. Abstract of the Friday evening lecture delivered by Lord Rayleigh, F.R.S., at the Royal Institution, on April 12, 1889. If the reflection were perpendicular, the interval between successive disks would be equal to the half wave-length, or to some multiple of this. About HackerNoon Book Series: We bring you the most important technical, scientific, and insightful public domain books. This book is part of the public domain. Various (2004). Scientific American Supplement, No. 711, August 17, 1889. Urbana, Illinois: Project Gutenberg. Retrieved https://www.gutenberg.org/cache/epub/16972/pg16972-images.html This eBook is for the use of anyone anywhere at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this eBook or online at , located at . www.gutenberg.org https://www.gutenberg.org/policy/license.html

IRIDESCENT CRYSTALS

Apple released its fiscal Q1 2023 financial results on Feb. 2, and it was one of the least impressive quarters for the business in recent memory. For the first time in close to four years, Apple's quarterly revenues declined. The report shows that the company just experienced its largest decline since 2016 and its first decline since 2019. Products revenue was $96.4 billion, down 8% from last year, Mac revenue was $7.7 billion, down 29% year over year, and overall revenue was down more than 5% year over year. This was in part due to the company's failure to match sales from the same quarter last year across the majority of its hardware segments and production setbacks in China that limited its capacity to deliver its flagship iPhones - iPhone 14 Pro and iPhone 14 Pro Max according to Apple’s CEO, Tom Cook statement in the call. Explaining the reasons for the downturn, CEO Tim Cook mentioned three things, A challenging foreign exchange environment Covid-19 related constraints Difficult macroeconomic climate However, the iPad and services, which include products like Apple Music and TV+, iCloud, and AppleCare, were the two areas of the company that did experience growth. Services saw an increase of 6.4% to $20.77 billion, while iPad sales increased by 29.66% to $9.4 billion. Despite the business's overall difficulties in China, CFO Luca Maestri notes that the company nonetheless achieved records for services revenue in Greater China during the December quarter and for all of the Americas, Europe, and the rest of Asia Pacific. “We now have more than 935 million paid subscriptions across the services on our platform, up more than 150 million during the last 12 months alone and nearly four times what we had just five years ago,” CFO Luca Maestri said in the earring call that the holiday shopping season was a period purchases made using one of its service products hit an all-time high “And we continue to increase the reach and improve the quality of our offerings. For instance, Apple Pay is now available to millions of merchants in nearly 70 countries and regions. And we saw a record-breaking number of purchases made using Apple Pay globally during the holiday shopping season.” Cloud services, payment services, music, and the App Store and AppleCare all established quarterly sales records in the company's December quarter. The company also had an all-time high across all geographic segments in its installed base and Lucas mentioned two reasons for this performance, one was that the company encountered substantial supply restrictions during the December quarter the previous year, whereas this year, they had enough supply to meet demand. Secondly, during the quarter, they introduced a new iPad and the iPad Pro with the M2 chip. Apple didn't offer any revenue guidance for the current quarter, which ends in March, according to Lucas, the macroeconomic uncertainty around the world is the reason for the lack of clarity. Although the company provided some information about performance expectations, the revenue trend for the March quarter will be comparable to that of the December quarter, according to Maestri, While services are slated to expand, sales of the Mac and iPad are expected to drop by double digits from the comparable period last year, and sales of the iPhone are anticipated to decline less in the March quarter than in the December quarter. Cook also stated that the company intends to further integrate AI into its product line. In response to a question from Wells Fargo securities analyst Aaron Rakers about the role of AI in the company’s strategy, he said: “It is a major focus of ours. It's incredible in terms of how it can enrich customers' lives…we see an enormous potential in this space to affect virtually everything we do. It's obviously a horizontal technology, not a vertical one. And so it will affect every product in every service that we have.”

Apple's iPad, Services Unit Shines Amid Revenue Decline; AI Integration in Products in the Works

অ্যাপলের আইপ্যাড, সার্ভিসেস ইউনিট রাজস্ব হ্রাসের মধ্যে উজ্জ্বল; কাজের মধ্যে পণ্যগুলিতে এআই ইন্টিগ্রেশন

Apples iPad-Services-Abteilung glänzt trotz Umsatzrückgang; KI-Integration in Produkte in Arbeit

iPad de Apple, la unidad de servicios brilla en medio de la caída de los ingresos; Integración de IA en productos en proceso

L'iPad d'Apple, l'unité de services brille au milieu de la baisse des revenus ; Intégration de l'IA dans les produits en cours

राजस्व में गिरावट के बीच एप्पल का आईपैड, सर्विस यूनिट चमका; वर्क्स में उत्पादों में एआई एकीकरण

Apple の iPad、サービス ユニットは収益が減少する中で輝きを放ちます。進行中の製品への AI 統合

Apple의 iPad, 서비스 부문은 매출 감소 속에서도 빛을 발하고 있습니다. 작업 중인 제품에 AI 통합

iPad da Apple, unidade de serviços brilha em meio ao declínio da receita; Integração de IA em produtos em andamento

Apple'ın Hizmet Birimi iPad'i, Gelirlerdeki Düşüşün Ortasında Parlıyor; Çalışmalardaki Ürünlerde Yapay Zeka Entegrasyonu

IPad của Apple, Đơn vị Dịch vụ tỏa sáng trong bối cảnh doanh thu sụt giảm; Tích hợp AI trong Sản phẩm trong Công trình

Apple 的 iPad、服务部门在收入下降的情况下大放异彩；人工智能在产品中的集成

Do you want to find the saved Wi-Fi password on your iPhone but don't know how? Don't worry, you're not alone. More and more iPhone users are finding themselves in this situation, especially when they're trying to share a Wi-Fi password with their Android user friend because for Apple users you don't need to find Wi-Fi passwords manually. If an Apple user is looking for the password of the same Wi-Fi network you are connected to, you'll be asked to share the Wi-Fi access and if you allow it, the Apple user will be connected to the Wi-Fi automatically. Fortunately, it’s actually quite easy to find the password for a wifi network you’ve already connected to on your iPhone. How to Find WiFi Password on iPhone If you are in the same situation as thousands of people and you want to find out the wifi passwords that your phone has ever connected to any wifi networks. Follow the steps below. Here’s a step by step guide to help you out: Go to the iPhone's Settings Click on "Wi-Fi, it's supposed to be option 2 of the iPhone's settings. Tap on the Wi-Fi network you are currently connected to. A sliding window will appear with the hidden password of WiFi including, IP address, Subnet mask, and more. Tap on the hidden password box to view the wifi password and you'll be asked for the passcode of the iPhone or verify Face ID. To find out the old saved wifi passwords on iPhone follow these steps: Go back to your iPhone's settings. Tap on Wi-Fi. Now click on the "Edit" button, at the top of the right corner. Here you'll be asked for the iPhone's passcode to edit. Once you've entered the passcode, you'll see a list of Wi-Fi networks that the iPhone has been connected to in the past. To view the Wi-Fi password of any Wi-Fi network on the list, click on the "i" icon to the right of the Wi-Fi name. And now you will see the hidden password of the Wi-Fi network; just tap on it to view the password (in this step, you won't be asked for a passcode). How to Find WiFi Password on iPad Finding saved wifi passwords on an iPad is similar to iPhone methods, still if you wonder how?! Then follow the instructions below: On your iPad, open the Settings app and select Wi-Fi. Tap the ‘i’ icon next to the Wi-Fi network you are connected to and want to find the password. Tap on the ‘Password’ field, here you'll be asked for the passcode of the iPad. Once you’ve entered the passcode then your Wi-Fi password will be revealed. To view the saved wifi password on your iPad follow the instructions below: Go to the iPad settings, and select "WiFi" Tap on the "Edit" button top in the right corner. Here you'll see the known wifi networks with the iPad. Tap on the "i" icon to the right of the network name to view the password. And finally, you can see the Wi-Fi network's password by tapping on the Password field. That’s all there is to it! As you can see, it’s actually quite easy to find the saved wifi password on your iPhone and iPad. Just follow the steps outlined above and you’ll be able to find the password for any wifi network your iPhone/iPad has connected to in the past.

How to Find Your Saved WiFi Password on iPhone and iPad

Iridium ore is the final ore in Stardew Valley that players need to fully upgrade their tools, craft farm equipment such as sprinklers, and construct new buildings However, as the most valuable ore in the game, iridium is also exceptionally rare to find. If players want to get their hands on this rare commodity, they’ll have to progress quite far into the game, all the way to the desert and the skull cavern. Also, if you’re a fan of modding, consider checking out our guide on . how to mod Pokemon Scarlet and Violet with PKHex In this guide, I will explain how to get iridium in Stardew Valley and showcase how to unlock the desert and the skull cavern. Table of Contents How to Get Iridium Ore in Stardew Valley The Best Way to Farm Iridium Ore in Stardew Valley How to Unlock the Desert Skull Cavern is the Best Place to Find Iridium Ore How to Get Iridium Ore in Stardew Valley There are many ways to obtain iridium ore, albeit some are significantly more effective than others. , here are all the possible ways of getting iridium ore in Stardew Valley: According to the game’s official wiki - Traveling merchant occasionally sells iridium ore at the price of 300-1,000 per ore. Traveling Cart - Can be gained via Magma and Omni Geodes, which are most common on levels 115-119. The Mines - They sell Omni Geodes, which can be broken for a 5% chance of getting 1-11 iridium ore. Krobus/The Oasis - This is a random event that has a 1% chance of happening every night in the game. A meteorite falls to the farm and can be mined with a gold pickaxe or higher for 6 iridium ore, 6 stones, and 2 geodes. Fallen Meteorite - After reaching population 9, the pond can produce 1-3 iridium ore. Super Cucumber Fish Pond - After getting four candles at Grandpa’s Evaluation, this statue will award 2-8 iridium ore daily. Statue of Perfection - Found in the skull cavern, purple slimes have a small chance of dropping iridium ore. Purple Slimes - Same as above, can drop up to 4 iridium ore. Iridium Bats - Same as above, can drop up to 3 iridium ore. Iridium Crabs - This is the most efficient method. The chance to find iridium increases based on how deep the players get within the Skull Cavern’s floors. Use staircases or bombs to descend quickly for maximum profit. Skull Cavern Mining The Best Way to Farm Iridium Ore in Stardew Valley While there are many methods, the only guaranteed one that is available fairly early is accessing the Skull Cavern. Everything else is based on luck and, even then, awards only small amounts of iridium ore. With the best method settled, let’s examine how to unlock the Desert biome, which is where the Skull Cavern is located. How to Unlock the Desert To unlock the Calico Desert in Stardew Valley, players will need to either or purchase the ‘Bus Repair’ for 40,000 coins from the Joja Community Development Form. complete the Community Center Vault Bundles The Vault Bundles can be unlocked after completing four bundles and cost 42,500 coins to complete. Other than unlocking the bus stop, the Vault Bundles offer the following rewards: Chocolate Cake x3 Quality Fertilizer x30 Lighting Rod x1 Crystalarium x1 Doing either of those will result in unlocking the bus stop just above the player’s farm. Then, players are able to access the bus stop on any day between 10 am and 5 pm. Keep in mind that bus tickets will cost 500 coins each, which includes the return trip. With the desert now unlocked, let’s examine how to unlock and progress through the main attraction of the desert: the Skull Cavern. Skull Cavern is the Best Place to Find Iridium Ore https://www.youtube.com/watch?v=8TW9ZouEuZc?embedable=true For a showcase of how to efficiently move through the Skull Cavern, check this video . by ezlilyy on YouTube One of the best parts of visiting the desert is finally unlocking the Skull Cavern. To unlock it, players will need to acquire the Skull Key first, which is gained after reaching floor 120 in The Mines. The main characteristic of the Skull Cavern is that, unlike The Mines, it doesn’t have a floor limit. Players can go as deep as they can, but this resets every day. So, when first entering the Skull Cavern, players start at floor 1. After exploring it for the whole day and reaching floor 30, they exit to end the day and refill their energy. However, on your next visit to the Skull Cavern, their progress will be reset to floor 1. As for finding iridium ore, the chance of getting iridium rocks increases the further down players get into the cavern. In short, the goal is to get as deep as possible within one day to maximize iridium gains. For this, it is highly recommended to utilize ladders and bombs to progress through the first floors quickly. In addition, luck plays a big role in finding the ladder to the next floor quickly. If you’re looking specifically for iridium, aim to reach at least floor 70 and, ideally, floors 100-150. After 70, there can be around three iridium nodes per floor, while after 100, that number increases to five. Wrapping up To sum up, that’s everything you need to know on how to find iridium in Stardew Valley. Unlock the desert biome, progress through the skull cavern, and start mining stacks of iridium. Also, if you’re looking for a new farming game, consider checking out our . list of all Animal Crossing Games ranked by sales data How much iridium have you managed to gather so far? What are you hoping to craft next with it? Let us know in the comments below.

Stories, News & Mentions about IPID

Ipid’s Stories on HackerNoon