Murphy USA Inc. (NYSE:MUSA – Get Free Report) has earned an average recommendation of “Hold” from the five analysts that are currently covering the firm, Marketbeat reports. One investment analyst has rated the stock with a sell rating, one has issued a hold rating and three have given ...

Murphy USA Inc. (NYSE:MUSA) Receives Consensus Rating of “Hold” from Analysts - Defense World

Blue Trust Inc. grew its stake in shares of Murphy USA Inc. (NYSE:MUSA – Free Report) by 7.3% during the fourth quarter, according to the company in its most recent disclosure with the Securities and Exchange Commission. The fund owned 499 shares of the specialty retailer’s stock after ...

Blue Trust Inc. Buys 34 Shares of Murphy USA Inc. (NYSE:MUSA) - Defense World

Get the most recent info and news about Murphy USA on HackerNoon, where 10k+ technologists publish stories for 4M+ monthly readers.

Murphy USA Inc. engages in the marketing of retail motor fuel products and convenience merchandise. The company operates retail stores under the Murphy USA and Murphy Express brand names. As of December 31, 2019, it operated 1,489 gasoline stores, including 1,161 Murphy USA and 328 Murphy Express stores principally in the Southeast, Southwest, and Midwest United States. The company was founded in 1996 and is headquartered in El Dorado, Arkansas.

Murphy USA

Sound Call Graph Construction for Java Object: Conclusions, Acknowledgment, & References

This paper is available on arxiv under CC 4.0 license. Authors: (1) JOANNA C. S. SANTOS, University of Notre Dame, USA; (2) MEHDI MIRAKHORLI, University of Hawaii at Manoa, USA; (3) ALI SHOKRI, Virginia Tech, USA. Table of Links Introduction Background Seneca: Taint-Based Call Graph Construction for Object Deserialization Evaluation Results Related Work Conclusions, Acknowledgment, and References 6 Related Work This section discusses relevant works related to object deserialization and call graph construction. 6.1 Call graph construction & Taming Challenging Programming Features Call graphs are a core data structure for multiple analyses. Thus, previous works focused on devising algorithms for their construction. Among these works, we have CHA [Dean et al. 1995] and RTA [Bacon and Sweeney 1996], which are two well-known algorithms that over-approximates possible call paths by relying on methods’ signatures. Since these algorithms are overly conservative, multiple works discussed frameworks to make them more precise [Grove and Chambers 2001; Grove et al. 1997; Tip and Palsberg 2000]. Moreover, previous research also focused on creating application-only call graphs, that disregard unnecessary library classes, while keeping on the graph the nodes and edges that are important for the underlying analysis [Ali and Lhoták 2012]. In this paper, we focused on solving the challenge of computing call graphs that are sound concerning object serialization and deserialization. Previous research on static analysis also explored the challenges involving supporting re"ection features [Bodden et al. 2011; Li et al. 2014, 2019; Smaragdakis et al. 2015], dynamic proxies [Fourtounis et al. 2018], enterprise frameworks [Antoniadis et al. 2020] and RMI-based programs [Sharp and Rountev 2006]. These approaches involve making assumptions when performing the analysis, to create analyses that are not overly imprecise. Unlike these prior works, however, we focused on object deserialization that has its own unique challenges, as described in Section 2.3. 6.2 Empirical Studies on Call graphs Multiple characteristics of call graphs (e.g., precision, soundness, performance, and recall) have been widely studied in the past [Ali et al. 2019; Kummita et al. 2021; Murphy et al. 1998; Sui et al. 2020]. Murphy et al. [Murphy et al. 1998] studied multiple call graph construction approaches for C programs, finding discrepancies among the generated call graphs across different approaches. Sui et al. [Sui et al. 2018] focused on the support for dynamic language features, aiming to create a benchmark for dynamic features for Java. There is a line of research that explored call graph’s soundness of Java (or JVM-like) programs [Ali et al. 2019; Reif et al. 2019, 2018]. In particular, recent empirical studies [Reif et al. 2019, 2018] show that although serialization-related features are widely used, they are not well-supported in existing approaches. Thus, we built an approach to enhance existing points-to analysis to support the construction of sound call graphs with respect to serialization-related features. 6.3 Pointer Analysis Many works explored the problem of performing pointer analysis of programs [Bastani et al. 2019; Feng et al. 2015; Heintze and Tardieu 2001; Hind 2001; Kastrinis and Smaragdakis 2013; Lhoták and Hendren 2006; Rountev et al. 2001; Smaragdakis and Kastrinis 2018]. These approaches focus on computing over- or under-approximations to improve one or more aspects of the analysis, such as its soundness, precision, performance, and scalability. Existing pointer analysis approaches make the sets finite such that the problem can be algorithmically solvable. In this paper, however, we focus on aiding points to analysis to soundly handle serialization-related features in a program, which are currently not well-supported because it relies on reflection [Reif et al. 2018]. 6.4 Detecting Untrusted Object Deserialization More recently there were approaches published that aimed at detecting untrusted object deserialization for PHP [Koutroumpouchos et al. 2019; Shahriar and Haddad 2016] and .NET [Shcherbakov and Balliu 2021]. Shcherbakov and Balliu [Shcherbakov and Balliu 2021] described an approach to semi-automatically detect and exploit object injection vulnerabilities .NET applications. It relies on existing publicly available gadgets to perform the detection and exploitation. Koutroumpouchos et al. described ObjectMap [Koutroumpouchos et al. 2019] which is tool that performs black-box analysis of Web applications to pinpoint potential insecure deserialization vulnerabilities. It works by inserting payloads into the parameters of HTTP GET/POST requests and then monitoring the target web application for errors to infer whether the application is vulnerable or not. Recent works [Cao et al. 2023; Haken 2018; Rasheed and Dietrich 2020] focused on deserialization vulnerabilities in Java programs. Rasheed and Dietrich [Rasheed and Dietrich 2020] described a hybrid approach that first performs a static analysis of a Java program to find potential call chains that can lead to sinks, where reflective method calls are made. It then uses the results of the static analysis to perform fuzzing in order to generate malicious objects. Unlike these prior works, we aimed to create an approach that can create sound call graphs with respect to serialization-related features. Our call graph is intended to be used by downstream client analyses, including, but not limited to, vulnerability detection. 6.5 Studies on Serialization and Deserializations In the past few years, there was a spike of vulnerabilities associated with deserialization of objects [Cifuentes et al. 2015]. Thus, existing works also studied vulnerabilities rooted at untrusted deserialization vulnerabilities [Dietrich et al. 2017a; Peles and Hay 2015]. Pele et al. [Peles and Hay 2015] conducted an empirical investigation of deserialization of pointers that lead to vulnerabilities in Android applications and SDKs. Dietrich et al. [Dietrich et al. 2017a] demonstrated how seemingly innocuous objects trigger vulnerabilities when deserialized, leading to denial of service attacks. In this paper, we describe an approach that could help client analyses focused on detecting instances of untrusted object deserialization.

Sound Call Graph Construction for Java Object Deserialization: Related Work

Dedicated to the incomparable Mysterious Galaxy

The 10th anniversary of the as malware is another opportunity to reflect upon computer system defects, human error, process flaws, organizational mistakes, and the best principles and practices for solution in the IT industry. In this blog and my upcoming book, , I will chronicle some important system failures in the past and discuss ideas for improving the future of system quality. As information technology becomes increasingly woven into Life, the quality of hardware and software impacts our commerce, health, infrastructure, military, politics, science, security, and transportation. The Big Idea is that we have no choice but to get better at delivering technology solutions because our lives depend on it. Google search incident that incorrectly classified the entire World Wide Web Bugs: A Short History of Computer System Failure On 31 January 2009, a Google engineer manually updated its search engine’s blacklist of sites classified as malware to include the URL of ; this change meant that . Fortunately, Google’s on-call Site Reliability Engineering (SRE) team quickly identified the problem and fixed it within an hour. Besides affecting organic search results, the system error also impacted Google’s email service, GMail, in which users reported genuine messages routed to spam folders; interestingly, . This essay explores some of the business and technology factors that contributed to the system defect, the incident’s timely resolution, and the wider implications for the Web, search, and malware classification. ‘/’ every organic Google search result for the entire World Wide Web ( ) was incorrectly classified as malware WWW or Web advertised or promoted search results were not affected by the error Source: VisualCapitalist.com According to multiple sources including JumpShot, Netmarketshare.com, and Statista.com, Google has of the market share for web search traffic depending on the country. Google is also the default search engine on most smartphones running the Android operating system; according to Gartner Research and Statista.com, Android holds about 85% market share since 2017. If one also accounts for its sister properties such as Google Image, Maps, and Youtube, then Google holds an impressive market share of web, mobile, and in-app searches. There are some potential threats on the horizon to Google’s dominance in Search; they range from Amazon’s Alexa and Echo devices used to search and buy products to users spending more time on Facebook, and even some users opting out of data sharing entirely through Ad/Cookie blocking browser plugins. In the end though, Google handles , has more than 1.5 billion unique users, and earns about in advertising revenue from search. 60–80% 90% 3.5 billion searches per day $32B annually Malware is software designed to intentionally cause harm to an individual user, a computing device, or a larger network of nodes by attacking the system’s availability, confidentiality, or integrity. There are different types of malware such as computer viruses, worms, spam, Trojan horses, ransomware, spyware, adware, and others. What began out of curiosity and fun when the Internet was an academic computing environment has now turned into malice and profit because malware means big business and serious trouble for corporations, governments, and individuals across the world. According to various computer security reports from McAfee, Center for Strategic and International Studies (CSIS), IBM, the Ponemon Institute, and Symantec, there are several cybercrime statistics one should be concerned about: The of cybercrime was estimated by McAfee and CSIS at in 2018, almost 0.8% of global GDP and up from $500B in 2014. cost $600B Mobile malware attacks have increased by 54% in 2017 according to Symantec, and 3rd party app stores (e.g. not Apple or Google) are the source for of discovered mobile malware. 99.9% Nearly Americans have been affected by according to a 2018 online survey conducted by the Harris Poll and about 140M worldwide (about 2% of all people around the world) according to ENISA in Europe. These identities are used to perpetrate various crimes and frauds of impersonation including credit cards, utilities, banking, loans, and government documents. Since 2014, almost and other PII has been stolen by hackers. 60M identity theft 3 billion internet credentials The largest sources of cyber attacks in 2017 were China (20%), USA (11%), and Russia (6%); however, Iran and North Korea are growing state sponsors of cyberterrorism. Cryptocurrency mining is a huge growth area in cybercrime with detections of cryptojacking on endpoint computers surging according to Symantec as criminal botnets trying to add new machines such as your computer to their resource pool. Tor and Bitcoin have facilitated the growth of the Dark Web and are some of the preferred tools for cybercriminals. 8500% The cost of the average global corporate data breach is almost and the average time to detect and react to a breach is days according to IBM and Ponemon. The costs include funds to help victims with losses, notification expenses, as well as business disruption, customer turnover, revenue forfeiture, and reputation damage. $2M 196 There are over that are detected according to data compiled by AV-Test and McAfee. 300,000 new malware variants, 33,000 phishing attacks, and 80 billion malicious scans every day Microsoft Office file format such as Word, PowerPoint, and Excel are the most prevalent group of malicious file extensions comprising 38% of the total. Google Search Warning for Malware So with great power comes great responsibility. Through the Stopbadware.org initiative since 2006, Google has partnered with the likes of Consumer Reports, Mozilla, Paypal, Verisign, Verizon, and others to prevent, mitigate, and remediate malware websites. Stopbadware receives data from different content and hosting providers, defines criteria for classifying malware sites, maintains a common clearinghouse of URLs blacklisted by community members, aggregates malware statistics, manages the appeal process if a site is blocked by providers, and publishes advisory documents and best practices to reduce the incidence of malware. Although Google supports StopBadware through data sharing, participates in its working groups, and contributes financially to the organization, Google’s Safe Browsing Initiative and Secure Web API’s are separate services that use Google’s own private blacklist curated by both man and machine. This list is periodically updated, and on 31 January, 2009, a Google engineer accidentally added and committed the “/” URL to the blacklist, and Google’s system interpreted this URL to . Twitter was briefly ablaze and abuzz with people reporting the error using the hashtags #googmayharm #googmayhem. The warning message in Google’s organic search results also linked to Stopbadware.org, and the torrent of users clicking the link caused a DDOS on their website. Users could still copy-and-paste links into the URL field and visit the sites manually, but the widespread perception on that Saturday morning was that the Web was experiencing a malware catastrophe. The good news for Google and the Web was that the Google SRE team was on-call, and it was actively monitoring and supporting its cloud services. The SRE team was notified of user complaints, identified the root cause, communicated a response to the global community through its blog and Twitter, reverted the blacklist change, and deployed the updated configuration to its services. Google’s search services like much of its cloud platform are distributed on servers located across the world so the blacklist configuration update was released in a staggered and rolling fashion. The search errors began appearing between 6:27 and 6:40 AM PST when the blacklist was initially changed and then began disappearing between 7:10 and 7:25 AM when that change was reverted. match all Web URLs While this story is about a negative incident involving Google, there are several positive lessons to be learned for IT professionals. matters in a crisis, and investing in a strong support and operations organization for your IT solutions can be the difference when problems inevitably unfold per Murphy’s Law. Often the operations capability is treated as overhead by accounting and IT departments, however Google’s SRE team is first class, a key ingredient in the secret sauce of success for the company as a leading cloud service provider, and they worked fast to identify the root cause, to communicate acknowledgement of the issue as well as ongoing updates, and to resolve the problem. Customer Service automation is a major competitive advantage for IT departments and companies that are willing to invest in their personnel, platforms, and processes. In less than an thirty minutes, Google was able to reliably deploy a production configuration update to its servers distributed across 16 data centers. If you and your organization are new to the DevOps capability, then focus on two things: first on one-touch automation of the deployment pipeline and then second on production environment monitoring. IT processes can execute faster while reducing costs, defects and risks. Business can be more agile which means faster time-to-market as well as higher potential revenue growth and market share. Sure, there are initial and ongoing costs to a DevOps capability in terms of new skills and tools, but on balance the long-term ROI comes from the ability to reliably deliver new features and fixes to customers at a higher frequency and also in terms of productive hours saved in deployments and reacting to production issues. For more information about the multifaceted benefits of DevOps, check out DORA’s State of DevOps research report and read The DevOps Handbook written by Jez Humble and Gene Kim. DevOps is not so simple. The “/” URL is syntactically and semantically valid, but it did not make sense in the specific context of the malware blacklist. It is a configuration data entry error that is obscure and subtle, and while Google surely had automated tests for the core components of the Safe Browsing Services API, they did not test these blacklist configuration changes in a staging environment. Having visited Google’s headquarters in Mountain View for work, I can attest to the cultural importance of QA with written articles published on the walls of cafeterias, hallways, and yes, even the bathrooms about Quality Assurance and best practices for verifying system integrity. The lesson here is one about humility and separation of concerns. It motivates the business need to have distinct teams developing and testing software. The former wants things to work and sometimes believes that truth to a fault, while the latter wants to break things to make things better. Quality Assurance In subsequent articles, I will discuss specific system incidents involving malware that resulted in security breaches as well as strategies and tactics for preventing and reacting to these events. Enjoy the article? Follow me on Medium and Twitter for more updates. References https://googleblog.blogspot.com/2009/01/this-site-may-harm-your-computer-on.html https://www.stopbadware.org/blog/2009/01/31/google-glitch-causes-confusion https://www.theregister.co.uk/2009/01/31/google_malware_snafu/ https://arstechnica.com/information-technology/2009/01/google-broke-the-internet-malware-detector-went-haywire/ https://techcrunch.com/2009/01/31/google-flags-whole-internet-as-malware/ https://www.visualcapitalist.com/this-chart-reveals-googles-true-dominance-over-the-web/ https://www.consumerwatchdog.org/blog/googles-dominance https://www.netmarketshare.com/search-engine-market-share.aspx https://www.av-test.org/en/statistics/malware/ https://www.datacenterknowledge.com/archives/2017/03/16/google-data-center-faq https://www.varonis.com/blog/cybersecurity-statistics/ https://sparktoro.com/blog/new-jumpshot-2018-data-where-searches-happen-on-the-web-google-amazon-facebook-beyond/ https://www.accenture.com/t20170926T072837Z__w__/us-en/_acnmedia/PDF-61/Accenture-2017-CostCyberCrimeStudy.pdf https://www.mcafee.com/enterprise/en-us/assets/reports/restricted/rp-economic-impact-cybercrime.pdf

Blacklisted: When Google Classified the Entire Web as Malware

The level of censorship in Pakistan escalated significantly during the period when authorities successfully banned , formerly known as Twitter. The authorities in Pakistan on February 17, when the rigging of elections throughout the country fueled the citizens to protest. The citizens wanted to take advantage of that opportunity to engage with each other on social media. They turned to increasing the usage of ( virtual private networks) to bypass the ban on social sites on the internet throughout the country. X started to block social media sites VPN An estimated report reveals that the demand for security software in the market has increased by up to 130%. There have been reports of numerous VPN apps suddenly failing, indicating that Pakistan's Censorship is getting more severe. These restrictions indicate citizens' difficulties in Pakistan, including inhibiting freedom of expression in the digital landscape. History of Internet restriction in Pakistan The process of blocking the internet or social media platforms in Pakistan is as old as the country. Citizens were facing these issues not only in this era but also each year in different forms. The PTA banned social platforms such as YouTube, Facebook, and Flicker in 2010. This was done after a competition known as Everyday Draw Muhammad Day. This competition may contain a bit of blasphemous material. In 2012, the Pakistan's most famous site, YouTube. That was a protest against a film released by the United States, "Innocence of Muslims." The process of YouTube restriction continued till 2016. During these years, many steps were taken regarding its usage and ban side by side. However, it was lifted in September 2016, when YouTube was launched as a local version for Pakistan. PTA blocked In 2020, the usage of due to the spreading of immoral content. TikTok in Pakistan was restricted In 2021, the interior ministry ordered the PTA to , Twitter, YouTube, and whatsapp throughout Pakistan. The reason for the temporary blockage of social media platforms should have been explained earlier. Later, that was described as related to security concerns as there was a worse situation due to Tehrik e back anti-France protests. ban Facebook Alarming condition of Pakistan's internet censorship in 2024 Lina Survila, Surfshark virtual private network provider spokeswoman, said 2024 may be a year of internet restrictions in Pakistan due to enhanced Censorship in Pakistan at an alarming level. The country faced digital darkness on five occasions in the first two months of 2024. When a political party, Pakistan's Tehrik-e-Insaf, organized online events that imprisoned former Prime Minister Imran Khan, they faced two strikes on the internet in January regarding all social media platforms. After this, the authorities hit the internet and plugged off all the social platforms, including X, on the day of the election, and the government named it a security concern. Through this blockage, they tried to consolidate the maximum potential vote manipulation. , internet watchdog Netblock, said," That day was a massive black day in democracy in Pakistan." Alp Toker One member of the Pakistan Senate presented a report to ban all famous social platforms such as Facebook, Twitter, YouTube, and Instagram. etc. The citizens faced the shutdown of social media during the country's general election. The proposal states that these social media platforms are affecting the young generation, spreading damaging and malicious content throughout the country against the military millennials. This resolution develops criticism of the violation of the rights of people as citizens have the right to express their views freely. Experts say The threats to ban social media and the internet are still at their peak point in Pakistan. Blockage of X- platform A report against internet monitoring services by states that the senator submitted the proposal when citizens were already in a sensitive stage for blockage of social media platforms. After holding the February 8 elections in Pakistan, there was a great protest against vote manipulation. When Liaqat Ali Chattha, a senior Pakistani bureaucrat, revealed that he was involved in manipulating the vote, this claim was retracted after a few days. NetBlocks The PTI, Pakistan's opposition party, claimed that the general election had been thoroughly manipulated in counting. Party officials announced they would keep up their legal actions and street demonstrations to recover the stolen mandate. At that time, people throughout the country flocked to X or Twitter to express their voices and organize themselves to walk in the streets. Politicians  throughout South Asia kept a great eye on X to keep a view of what was happening in the country. This platform also offers the opportunity to express opposing views and criticize the current political establishment. That was when authorities took the step to ban the X entirely in Pakistan. The government began to block this platform's access without announcing any warnings or explanation. PTI called these tactics desperate tactics, which were developed by the imported government and recommended that citizens use safe VPNs to access all banned social media platforms. Ultimately, citizens have still been trying to overcome these unauthentic restrictions using virtual private networks. Investigation Over Censorship Strategies Advocates of digital rights investigate the censorship strategies of the government of Pakistan for all groups at Islamabad-based-bytes. After a proper examination, they concluded that Twitter's block uses HTTP blocking. Another report or expert opinion believes that an equal collaboration of content delivery networks and authorities could be achieved. The report reads like this: "For Pakistan’s telecommunication authority, it's possible to ban  access to Twitter usage by any method, like IP blockage or deep Packet Inspection rather than to block the content by specific content delivery network providers such as Akamai Technologies, which would be more challenging to control." Although digital platforms are affected by their policies at a harsh level, as in this era, it's impossible to keep citizens away from the social market; digital freedom is not the only victim of continuous internet blockage. Effect of Internet Censorship on Pakistan's Economy The effect of internet censorship on Pakistan's economy cannot be overwhelming. The internet shutdown adversely affects many small and larger scale businesses in Pakistan. A Technologies-driven company reveals that it faced a 36% drawback in sales volume. Another report states that the telecommunication sector suffered almost 2.85 million dollars lost. , an IT sector representative, said they faced 3 million dollars per day till the restrictions were lifted. P@sha Almost 1.3 billion rupees loss has been recorded in Pakistan's economy by the Pakistan Institute of Development Economics due to internet restrictions. A reveals that in 2023, Pakistan ranked third among the most restricted online nations. That cost may seem more significant this year as democratic values are disintegrating daily. study Solution of Internet Censorship in Pakistan VPN services motivate Pakistanis to come if they are on a quest to find a solution to the restrictions. The provider will guide you in getting rid of these internet shutdowns. Final Thoughts Censorship in Pakistan is on the rise, especially online. Limits on social media not only stifle free speech but also affect data access and democracy. During elections, government control raises concerns about citizens' rights. Many people turn to VPNs to bypass these restrictions. Internet shutdowns hurt Pakistan's growth and democracy. Supporting digital rights and using VPNs can help fight censorship in Pakistan. Frequently Asked Questions 1. What Is The Meaning Of Censorship? Censorship means the suppression of someone's voice, involving the ban on the freedom of the public to raise their voice against their issue. 2. Is there any Censorship in Pakistan? Yes, internet censorship is an example of Censorship in Pakistan. This means that some social sites, including X, are banned. This is also done to suppress the voice of citizens on digital platforms. 3. Why is the Internet Banned in Pakistan? The maximum filtering in Pakistan is intermittent. The Pakistan telecommunication authority has blocked the site, which they consider to contain content related to negativity, such as threatening, blasphemous, or anti-religious content. 4. What To Do If There Is Censorship On The Internet In Pakistan? If there's internet censorship in Pakistan, you can use a Virtual Private Network (VPN) to bypass restrictions and access blocked content. Additionally, you can advocate for digital rights and raise awareness about censorship issues. 5. Did Pakistan ban VPNs? VPNs are not banned in Pakistan, but their usage is highly restricted. The PTA allows some approved VPNs to be served.

Internet Censorship in Pakistan in 2024

Project estimation is a critical aspect of successful project management. Accurate estimation ensures that projects are completed on time, within budget, and with the desired quality. However, project estimation can be a complex and challenging process, often leading to deviations from the initial estimates that entail budget creep. In this comprehensive guide, I'll explore effective strategies for mastering project estimation. We'll delve into why projects frequently take longer than estimated and how to address this issue for both project teams and business owners. A staggering 91.5% of projects go over budget, over schedule, or both Project overruns are a common phenomenon across various industries. Let's explore some illuminating examples of how large-scale projects went off the tracks: The book titled "How Big Things Get Done: The Surprising Factors That Determine the Fate of Every Project, from Home Renovations to Space Exploration and Everything In Between" by Bent Flyvbjerg and Dan Gardner highlights a common trend in project management. It emphasizes that the majority of projects tend to deviate from their original plans. In particular, nuclear power construction and IT projects are notorious for their propensity to encounter disastrous and highly expensive setbacks. These examples represent just a few instances within the broader category of megaprojects, which the authors, Bent Flyvbjerg and Dan Gardner, define as projects with costs exceeding US$1 billion. Megaprojects, regardless of their nature, often experience significant budget overruns and delays, making them a cause for concern for business leaders, politicians, and organizations. Bent Flyvbjerg has compiled an extensive database on this topic, encompassing more than 16,000 projects spanning over 20 fields across 136 countries, with records dating back to 1910. These projects range from Olympic games to nuclear power plants, including complex endeavors like NASA's James Webb Space Telescope, which exceeded its budget by 450%. Shockingly, the research reveals that a staggering 91.5% of projects face either budget overruns, delays, or both. Moreover, less than 1% of projects manage to adhere to their original timelines and budgets while delivering the promised benefits. On average, projects experience a cost overrun of 62%. The distribution of these megaproject overruns exhibits a heavy tail, signifying the presence of catastrophic risks. To illustrate further, the authors point out that 18% of IT projects encounter cost overruns exceeding 50% in real terms, with an average overrun of 447%. These examples underscore the complexity of project estimation and the frequent occurrence of projects exceeding their initial estimates. However, it's crucial to understand that accurate estimation is attainable with the right approach, and by accurate, I mean an estimate with minimum possible deviation. The Two Sides of Project Estimation Project estimation is a delicate balancing act, requiring collaboration and understanding between the development team and the client or business owner. While the previous sections discussed the challenges faced by development teams and strategies for accurate estimation, it's equally crucial to consider the client's perspective. From the client/business owner's point of view, there are compelling reasons to add a buffer to the project estimate. Let's explore why this is essential and highlight scenarios where the initial project scope can be exceeded. The Client's Dilemma: Why Buffer Matters Clients and business owners have their own set of concerns when it comes to project estimation. They seek to achieve their objectives within a specified budget and timeframe, but they also understand that changes and uncertainties are inherent in any project. Here's why adding a buffer to the project estimate is vital from the client's viewpoint: 1. Evolving Design Requirements: Studies in project management have shown that design iterations are a common occurrence in project development. A client may have a vision for the project, but it often takes several iterations before the design aligns perfectly with their expectations. These design changes, while necessary for a successful project, can impact the project's timeline and budget. 2. Comprehensive Product Testing: Thorough testing is a fundamental part of project development to ensure the final product meets quality standards. However, extensive testing can reveal issues that were not initially anticipated. Addressing these issues may require additional time and resources, potentially extending the project's duration. 3. User Testing and Feedback: Incorporating real user feedback is essential for creating a user-friendly and effective product. Pilot groups and user testing often reveal usability challenges, logic gaps, or areas for improvement that were not evident during the initial planning stages. Adjustments based on user feedback can result in scope changes and project extensions. 4. Regulatory Compliance: For projects in regulated industries such as healthcare or finance, adhering to compliance standards is non-negotiable. Navigating regulatory requirements can introduce complexities and additional tasks that were not initially factored into the project plan. Strategies for Effective Project Estimation In this section, we delve into strategies for effective project estimation. We won't be covering the well-known practices that I am sure are already applied in your approach, such as proper preparation before committing to a project, working in areas of expertise or acquiring that expertise, breaking down work into smaller chunks (the Lego principle), using sprint methodologies and etc... Instead, I'll provide you with insights that go beyond the surface, offering practical approaches drawn from real-life experiences to help you tackle project estimation from a more detailed and low-level perspective, ultimately securing better results. At , we employ a dual-point estimation approach for our estimations. This practice is founded on two key pillars: optimistic and realistic estimates. These serve as powerful tools for effectively navigating the uncertainties and risks inherent in the estimation process. Uinno Below are detailed descriptions and examples of how we interpret and apply both optimistic and realistic scenarios: Optimistic Estimate (O) This is the "sunshine and rainbows" scenario. It's when all the stars align, the coffee tastes just right, and the Individual Contributor (IC) — that's you — is bouncing off the walls with an energy that puts the Energizer Bunny to shame. Here's a real-life scenario. You're tasked with implementing authentication functionality with the Awesome Auth Provider, and you've never worked with it before. Under our rosy optimistic scenario, the Awesome Auth Provider's manual looks like it's been crafted by angels — updated, user-friendly, and reads like your favorite novel. You might even get an easy-peasy development playground and a bunch of examples to play with. On this day, the birds are singing, you're fresh from a restful sleep, and you're so upbeat you feel like you can finish it without breaking a sweat. So you estimate this task to be finished within a single business day (8 hours). Realistic Estimate (R) This is the “Murphy’s Law” scenario where everything that can go wrong, does go wrong. Coffee's bitter, traffic's a nightmare, and you feel like you’ve been run over by a bus. Take the same task — implementing authentication functionality with the Awesome Auth Provider. In our not-so-sunny Realistic scenario, the Awesome Auth Provider's manual looks like it was written by a toddler — confusing, outdated, and features a dreaded XML API that could make grown developers weep. You've had a mere four hours of sleep, and there's a strong suspicion you're coming down with something. The thought of coding for more than two hours feels like a Herculean task, and you need a 15-20-minute siesta after each session. Well, life’s not all sunshine and unicorns, right? In this case, you feel like two business days of work (16 hours) is probably a better and more realistic guess. Balancing out the estimate. What it takes to deliver work really A common pitfall in estimations is the tendency to consider only the pure development time, without taking into account that additional factors will inevitably influence the actual feature delivery timeframe. In essence, to generate a more accurate and realistic estimation, it's necessary to expand the initial timeline to accommodate for these influencing variables. The act of coding is merely one piece of a larger puzzle that needs to be addressed when formulating an estimation. Let's see what are the other important parts you need to consider: Communication (С) Communication forms an integral part of every project, whether it be with the Project Manager, teammates, or other stakeholders. The number of individuals involved in the project or feature development typically correlates with the amount of communication required. It's a complex task to accurately anticipate the time required for communication, as it can vary considerably based on factors such as the project's pace, the meeting schedule, and the overall complexity of the project. Thus, it's crucial to take this into account when formulating an estimation. But as a starting point, keep in mind that at least an hour of your day is spent on some sort of daily meeting, retro or communication with your teammates. Testing (T) Regardless of its apparent simplicity, each piece of work needs to be rigorously tested before it's deployed in either a production or development environment. Even in the absence of a dedicated Quality Assurance Engineer, Individual Contributors are still required to ensure compliance with the acceptance criteria. This additional process significantly contributes to the overall estimation. It's essential to remember this critical step while formulating time estimations, as it ultimately guarantees the delivery of a high-quality, functional product. Deployment (D) A task isn't considered successfully completed in isolation, nor is it merely a piece of code on a local machine or git repository. Just as a well-crafted piece of machinery is of little use if left unassembled, so too does a task reach its full potential only when it's been deployed to the appropriate environment or at the very least, integrated with the main body of the application code. Remember, in the world of software development, a task should be considered done only when it becomes a functioning part of the greater system. Amendments (A) It's important to remember that the phases of testing and deployment can often be akin to opening Pandora's box of bugs. Therefore, the time allocation for bug fixing is an essential factor that should be incorporated into the general estimation. Environment (E) Despite our best efforts, none of us are machines capable of working an uninterrupted eight-hour shift without catering to life's necessities. Be it a much-needed coffee break, a trip to the restroom, or a quick chat with a colleague, these moments are a reality of the workday. Especially when a task is projected to take around eight hours or more, these "real-life" interruptions need to be factored into the overall estimation. Key Takeaways for Mastering Project Estimation Project estimation is a multifaceted endeavor that plays a pivotal role in the success of any project. Given that a staggering 91.5% of projects go over budget or schedule, mastering this skill is non-negotiable. Here's a concise step-by-step guide to enhance your project estimation skills: 1. Acknowledge the Complexity Understand that project estimation is not just about development time. It involves various other factors like design iterations, testing, user feedback, and regulatory compliance. 2. Employ Dual-Point Estimation Use both optimistic (O) and realistic (R) scenarios to navigate uncertainties. The optimistic estimate is your best-case scenario, while the realistic one prepares you for potential setbacks. 3. Factor in Additional Variables Don't just consider pure development time. Account for: [CADDET] Communication ( C) Amendments (ex Fixes) (A) Deployment (D) Development (D) Environment (ex Life) (E) Testing (T) 4. Add a Buffer Especially from the client's perspective, adding a buffer is crucial to accommodate evolving design requirements, comprehensive product testing, user feedback, and regulatory compliance. 5. Continual Learning and Adaptation Use past projects as a learning experience to refine future estimates. Keep track of where your estimates were accurate and where they fell short to continually improve your estimation skills. By incorporating these steps into your project estimation process, you'll be better equipped to deliver projects on time and within budget, thereby increasing your success rate significantly. Conclusion Project overruns are a reality, but they are not insurmountable. Accurate project estimation is attainable by adopting a comprehensive approach that considers both optimistic and realistic scenarios and accounts for influencing factors. Understanding the challenges of project estimation and learning from past experiences can lead to improved project planning and efficiency. It is also a collaborative approach. A collaborative approach is essential to address these challenges and maintain a positive working relationship between the development team and the client/business owner. Clients should be encouraged to include a reasonable buffer in their project budget and timeline to accommodate potential scope changes and unforeseen challenges. At the same time, development teams must strive for accurate estimation and transparent communication to minimize surprises.

A Comprehensive Guide to Effective Project Estimation

Hey Hackers, Unless you haven’t been living under a rock, you’ve probably kept up with the Barbenheimer, Musk, and Blue Bird disputes. Let's dive into it! \ The Barbenheimer Showdown Oppenheimer, centered on the development of the first atomic bomb, starring Cillian Murphy and directed by Christopher Nolan, and Barbie, the colorful coming-of-age story exploring the iconic doll's identity, have exceeded expectations, becoming this year's best-selling movies. In the premiere weekend alone, Greta Gerwig’s blockbuster, , scored worldwide, making it the biggest debut ever for a film directed by a woman. Could this signal a shift in public interest away from remakes and sequels? Share your thoughts . Barbie US$377m here Concomitantly, , with workers now demanding better conditions and protesting against a future controlled by AI. strikes have been bursting all over Hollywood Could the success of Barbenheimer provide further support for human artists? Moreover, Hollywood's momentum against AI raises questions: How much can AI impact the movie industry and the careers of its workers? Could viewers be on the verge of seeing their data sold for the creative profit of streaming services and Hollywood? Tell us what you think about it . here Bye Bye Birdy In other news, Elon Musk rebranded , killing off the blue bird logo. As ditches its iconic branding, its open-source rival . According to a new post from Mastodon founder and CEO Eugen Rochko, the number of monthly active users for his Twitter alternative has been steadily climbing over the past couple of months to have now reached 2.1 million. If these numbers indicate something, it’s that Mastodon's growth often seems to be tied to Twitter's moves — or rather, its missteps. Twitter as X Twitter Mastodon is seeing usage numbers soar How do you think Twitter's rebranding will impact the social network? Are Musk and Zuckerberg slowly leading each other into oblivion with their decisions, or are their missteps just a consequence of managing massive platforms with millions of users? Share your insights . here Have you tried your hand at the and writing contests? If not, there’s still time to submit a story and qualify to win from a $9000 total prize pool. #unity #web-development Enter the Unity Game Development Writing Contest by with Tatum Games our custom template here. Enter the Web Development Writing Contest by with IONOS our custom template here. The Weekly Writing Tip Picking the topic of your next story can be challenging. You may think about , but has many subjects to write about: , , , etc. The options are endless. When in doubt, check out - if it exists on the website, it’s probably a good topic to discuss. For more information, check out our . tech technology AI JAVA open-source HackerNoon tags help section Moreover, pay attention to the length of your story. Helpful content is what search engines are giving more space to. To improve the quality of our content, we set strict limits on minimum word count - ; moving forward, we will auto-reject pieces under 500 words. 500 words Although that is our minimum, we only want to publish pieces of 800 words or more. If you’re going to write something under 800 words, it better be the best 799 words we’ve read all week. If it isn’t, we will reject it and ask you to write more to add value to the piece. If you need help staying on track, . consider applying to our blogging fellowship Check all our editorial guidelines . here That’s all, folks! Have a productive day, and we’re looking forward to reading your next story.\ Cheers, The HackerNoon Editorial Team

Barbenheimer and X: A Week of Successes and Potential Failures

In this blog post, we will be covering how you can combine and leverage the open-source streaming solution, , with , to improve the quality of your streaming flows. Buckle up! bytewax ydata-profiling Stream processing enables real-time analysis of data in-flight and before storage and can be or . stateful stateless is used for recommendations, pattern detection, or complex event processing, where the history of what has happened is required for the processing (windows, joining by a key, etc.). Stateful stream processing real-time is used for transformation that doesn’t require knowledge of other data points in the stream like masking an email or converting a type. Stateless stream processing inline Overall, data streams are widely used in the industry and can be found applied to use cases such as , , or . fraud detection patient monitoring event predictive maintenance One Crucial Aspect That All Data Streams Must Consider Is the Quality of the Data Unlike traditional models where data quality is usually assessed during the creation of the data warehouse or dashboard solution, . streaming data requires continuous monitoring It is essential to maintain data quality throughout the entire process, from collection to feeding downstream applications. After all, the cost of bad data quality can be high for organizations: “The cost of bad data is an astonishing 15% to 25% of revenue for most companies. (…) Two-thirds of these costs can be eliminated by getting in front on data quality.” — Thomas C. Redman, author of “Getting in Front on Data Quality” Throughout this article, we will show you how you can combine with to profile and improve the quality of your streaming flows! bytewa ydata-profiling Stream Processing for Data Professionals With Bytewax is an OSS stream processing framework designed specifically for Python developers. Bytewax It allows users to with capabilities similar to Flink, Spark, and Kafka Streams while providing a friendly and familiar interface and build streaming data pipelines and real-time applications 100% compatibility with the Python ecosystem. Using built-in or existing Python libraries, (Kafka, RedPanda, WebSocket, etc.) and out to various downstream systems (Kafka, parquet files, data lakes, etc.). connectors you can connect to real-time and streaming data sources write transformed data For the transformations, Bytewax with , , and methods and comes with familiar features such as recovery and scalability. facilitates stateful and stateless transformations map windowing aggregation Bytewax and is p . facilitates a Python-first and data-centric experience to data streams urposely built for data engineers and data scientists It allows users to and create customizations necessary to meet their needs without having to learn and maintain JVM-based streaming platforms like Spark or Flink. build streaming data pipelines and real-time applications Bytewax is well suited for many use cases, namely, , , , and more. Embedding Pipelines For Generative AI Handling Missing Values in Data Streams Using Language Models in a Streaming Context to Understand Financial Markets For use case inspiration and more information like documentation, tutorials, and guides, feel free to check . the bytewax website Why Data Profiling for Data Streams? and refers to the step of : its structure, behavior, and quality. Data Profiling is key to a successful start of any machine learning task thoroughly understanding our data In a nutshell, involves analyzing aspects related to the data’s format and basic descriptors (e.g., number of samples, number/types of features, duplicate values), its (such as the presence of missing data or imbalanced features), and other complicating factors that may arise during data collection or processing (e.g., erroneous values or inconsistent features). data profiling intrinsic characteristics , where circumstances might change fast and may require immediate action (e.g., healthcare monitoring, stock values, air quality policies). Ensuring high data quality standards is crucial for all domains and organizations, but is especially relevant for domains operating with domains outputting continuous data For many domains, data profiling is used from an exploratory data analysis lens, considering historical data stored in databases. On the contrary, for data streams, , where data needs to be checked at different time frames or stages of the process. data profiling becomes essential for validation and quality control continuously along the stream By embedding an , we can on the current state of our data and be alerted for any potentially critical issues — whether they are related to (e.g., corrupted values or changing formats), or to (e.g., data drifts, deviation from business rules and outcomes). automated profiling into our data flows immediately get feedback data consistency and integrity events happening in short periods of time In real-world domains — — automated profiling might save us from multiple brain puzzles and systems needing to be taken out of production! where you just know Murphy’s law is bound to strike and “everything can definitely go wrong” In what concerns data profiling, has consistently been a , either for or data. And no wonder why — ydata-profiling crowd favorite tabular time-series it’s one line of code for an extensive set of analysis and insights. Complex and time-draining operations are done under the hood: ydata-profiling and depending on the feature types (either numeric or categorical), it that are shown in the profiling report. automatically detects the feature types comprised in the data, adjusts the summary statistics and visualizations Fostering a , the package also , focusing on their pairwise and , and provides a thorough , from or values to and features. data-centric analysis highlights the existing relationships between features interactions correlations evaluation of data quality alerts duplicate constant skewed imbalanced It’s really a — with minimal effort. 360º view of the quality of our data Putting It All Together: bytewax and ydata-profiling Before starting the project, we need to first set our Python dependencies and configure our data source. First, let’s install the and packages ( bytewax ydata-profiling You might want to use a virtual environment for this — if you need some extra guidance!) check these instructions pip install bytewax==0.16.2 ydata-profiling==4.3.1 Then, we’ll upload the (License — CC0: Public Domain), which contains several measurements of from different IoT devices: Environmental Sensor Telemetry Dataset temperature, humidity, carbon monoxide liquid petroleum gas, smoke, light, and motion wget https://raw.githubusercontent.com/bytewax/air-quality-sensor/main/data/iot_telemetry_data_1000 , and the input would look like what we expect in a streaming platform . In this article, and create a dataflow using bytewax. In a production environment, these measurements would be continuously generated by each device such as Kafka to simulate the context we would find with streaming data, we will read the data from the CSV file one line at a time (As a quick side note, a dataflow is essentially a data pipeline that can be described as a directed acyclic graph — DAG) First, let’s make some : necessary imports from datetime import datetime, timedelta, timezone

from bytewax.dataflow import Dataflow
from bytewax.connectors.stdio import StdOutput
from bytewax.connectors.files import CSVInput
from bytewax.testing import run_main Then, we define our dataflow object. Afterward, we will use a stateless map method where we pass in a function to convert the string to a DateTime object and restructure the data to the format (device_id, data). The map method will make the change to each data point in a stateless way. The reason we have modified the shape of our data is so that we can easily group the data in the next steps to profile data for each device separately rather than for all of the devices simultaneously. flow = Dataflow()
flow.input("simulated_stream", CSVInput("/content/iot_telemetry_data_1000"))

# parse timestamp
def parse_time(reading_data):
    reading_data["ts"] = datetime.fromtimestamp(float(reading_data["ts"]), timezone.utc)
    return reading_data

flow.map(parse_time)


# remap format to tuple (device_id, reading_data)
flow.map(lambda reading_data: (reading_data['device'], reading_data)) Now, we will take advantage of the stateful capabilities of to gather data for each device over the duration of time that we have defined. expects a snapshot of the data over time, which makes the window operator the perfect method to use to do this. bytewax ydata-profiling In , we are able to produce summarizing statistics for a dataframe that is specified for a particular context. For instance, in our example, we can produce snapshots of data referring to each IoT device or to particular time frames: ydata-profiling from bytewax.window import EventClockConfig, TumblingWindow

# This is the accumulator function, and outputs a list of readings
def acc_values(acc, reading):
    acc.append(reading)
    return acc


# This function instructs the event clock on how to retrieve the
# event's datetime from the input.
def get_time(reading):
    return reading["ts"]

  
# Configure the `fold_window` operator to use the event time.
cc = EventClockConfig(get_time, wait_for_system_duration=timedelta(seconds=30))

# And a tumbling window
align_to = datetime(2020, 1, 1, tzinfo=timezone.utc)
wc = TumblingWindow(align_to=align_to, length=timedelta(hours=1))

flow.fold_window("running_average", cc, wc, list, acc_values)

flow.inspect(print) After the snapshots are defined, leveraging is as simple as calling the for each of the dataframes we would like to analyze: ydata-profiling ProfileReport import pandas as pd
from ydata_profiling import ProfileReport

def profile(device_id__readings):
    print(device_id__readings)
    device_id, readings = device_id__readings
    start_time = readings[0]['ts'].replace(minute=0, second=0, microsecond=0).strftime('%Y-%m-%d %H:%M:%S')
    df = pd.DataFrame(readings)
    profile = ProfileReport(
        df,
        tsmode=True,
        sortby="ts",
        title=f"Sensor Readings - device: {device_id}"
    )

    profile.to_file(f"Ts_Profile_{device_id}-{start_time}.html")
    return f"device {device_id} profiled at hour {start_time}"


flow.map(profile) In this example, we are writing the images out to local files as part of a function in a map method. These could be reported out via a messaging tool or we could save them to some remote storage in the future. Once the profile is complete, the dataflow expects some output so we can use the built-in to print the device that was profiled and the time it was profiled at that was passed out of the profile function in the map step: StdOutput flow.output("out", StdOutput()) There are multiple ways to execute Bytewax dataflows. In this example, we use the same local machine, but Bytewax can also run on multiple Python processes, across multiple hosts, in a , using a , and . Docker container Kubernetes cluster more In this article, we’ll continue with a local setup, but we encourage you to check our helper tool which manages Kubernetes dataflow deployments once your pipeline is ready to transition to production. waxctl Assuming we are in the same directory as the file with the dataflow definition, we can run it using: python -m bytewax.run ydata-profiling-streaming:flow We can then use the profiling reports to validate the data quality, check for changes in schemas or data formats, and . compare the data characteristics between different devices or time windows In fact, we can leverage the that highlights the differences between two data profiles in a straightforward manner, making it easier for us to detect important patterns that need to be investigated or issues that have to be addressed: comparison report functionality snapshot_a_report = ProfileReport(df_a, title="Snapshot A")
snapshot_b_report = ProfileReport(df_b, title="Snapshot B")

comparison_report =snapshot_a_report(snapshot_b_report)
comparison_report.to_file("comparison_report.html") Ready to Explore Your Own Data Streams? Validating data streams is crucial to identify issues in data quality in a continuous manner and compare the state of data across distinct periods of time. For organizations in , , , and — all working with continuous streams of data — a , from quality assessment to data privacy. healthcare energy manufacturing entertainment utomated profiling is key to establishing data governance best practices This requires the analysis of snapshots of data which, as showcased in this article, can be achieved in a seamless way by combining and . bytewax ydata-profiling takes care of all the processes necessary to handle and structure data streams into snapshots, which can then be summarized and compared with through a comprehensive report of data characteristics. Bytewax ydata-profiling Being able to appropriately process and profile incoming data opens up a plethora of use cases across different domains, from the to the highlighting and mitigation of additional issues that derive from real-world activities, such as (e.g., fraud or intrusion/threats detection), , and other events that deviate from the expectations (e.g., data drifts or misalignment with business rules). correction of errors in data schemas and formats anomaly detection equipment malfunction Now, you’re all set to start exploring your data streams! Let us know what other use cases you find, and as always, feel free to drop us a line in the comments, or find us at the for further questions and suggestions! Data-Centric AI Community See you there! Acknowledgments ) and Oli Makhasoeva (Developer Relations @ ) -- developing . This article was written by Fabiana Clemente (Co-founder & CDO @ ) and Miriam Santos (Developer Relations @ ) -- developing -- and Zander Matheson (CEO & Founder @ YData YData ydata-profiling Bytewax Byetwax bytewax You may find additional information about the OSS packages in the respective documentations: & . ydata-profiling docs bytewax docs Also published here

MURPHY USA

murphyusa.com

1K-5K employees

Since 1996

COMPANY RANKING

MURPHY USA

EVERGREEN INDEX #6855

Representing this company? Click here to claim and customize this page!

Murphy USA WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

MURPHY USA

murphyusa.com

1K-5K employees

Since 1996

COMPANY RANKING

MURPHY USA

EVERGREEN INDEX #6855

RELATED COMPANIESRANK

STORIES ABOUT MURPHY USA

Representing this company? Click here to claim and customize this page!

Murphy USA WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!