Our signature is inducing action through emotion

Nowadays

nowadays

The Noonification: Even Supermarkets Are Tracking Your Data Nowadays (8/14/2023)

Even Supermarkets Are Tracking Your Data Nowadays

এমনকি সুপারমার্কেটগুলি আজকাল আপনার ডেটা ট্র্যাক করছে

Sogar Supermärkte verfolgen heutzutage Ihre Daten

Incluso los supermercados están rastreando sus datos hoy en día

Même les supermarchés suivent vos données de nos jours

आजकल सुपरमार्केट भी आपके डेटा को ट्रैक कर रहे हैं

最近ではスーパーマーケットでさえあなたのデータを追跡しています

요즘에는 슈퍼마켓에서도 데이터를 추적하고 있습니다.

Até os supermercados estão rastreando seus dados hoje em dia

Günümüzde Süpermarketler Bile Verilerinizi Takip Ediyor

Ngay cả các siêu thị cũng đang theo dõi dữ liệu của bạn ngày nay

如今，甚至超市也在跟踪您的数据

The message (you literally only need this information from this article): stop wasting your time on blindly consuming s elf help materials. Learn things that matter. Find the time, and do them. Don’t waste your time reading how not to waste time. Self-help, motivation, at some point, we all need it, especially for programmers. When we are doing something new and exciting, such as waking up early, we are all into it, for the first days. But soon after, all the excitement goes away. So, a little motivation and long term view can help, right? But do we need it that much? Are we helping ourselves by others’ capitalization on it? Let’s take something practical. You know, some things are really hard for me. Resolving IT issues with my laptop is hard, waking up early is hard, and to mind my own business is hard too. There are also really hard things for me, the ones my subconscious tries to seriously avoid. One of those things is exercising. Exercising is damn hard — especially running. Nonetheless, sometimes you have to ignore the urges to stay warm at home and just go, or should I say, ignore the urges of staying warm at bed and go to the living room. As running, and cardio in general, is quite challenging, focus on the moment is really difficult: your thoughts get randomized and lost, and no matter what you do to focus the breathing, your mind just goes somewhere else. I eventually started listening to audiobooks, to help me with my focus issue. «Focusing on somebody’s voice helped to further enjoy the run, and enjoy the physical effort, somehow». That’s what I thought. The audiobook was about self-help. It was not the first audiobook on self-motivation I was . consuming “If you want to learn more about X, get our app on Y”. Suddently, I started to get uncomfortable. Why is the person that said she was there all for helping trying to sell me things I do not need? The author resumed, but from that moment on I just hear «Bla bla bla”, as Dracula says in Hotel Transilvania. That’s where you start to notice something’s wrong. Self-motivation materials are positive: they bring good vibes, a little push to try harder — and some even propose some actionable items you can use in your life., for example, tips about how to behave, how to have relationships, how to have a relationship, how not to have a relationship, how to invest. Everything is perfect and very shinny. Until it isn’t. Until the author’s focus is shifted from trying to help you to try helping himself. Invariably, you get unloaded with unnecessary information. It’s really easy to market yourself if you surprise people with your: “Enlightened” you: formed by your personality development, accomplishments, incredible routines… “Dark” side: formed by your addictions, bad choices, personality issues, and so on. Of course that if someone reveals their defects, it’s because they already have moved on. “Today I will write about how I can’t forgive a person no matter how hard I try” — said no glamorous guru ever. He also said “Today I feel what am I teaching is not completely honest”. Surely, some authors may remain genuine all the time, but I would doubt it. Ultimately, it seems to me that it is easy to “wear a mask”. It’s somehow like in happens at LinkedIn: how many people can you see with the labels “Entrepreneur”, “Speaker”, or “Expert”, although they started no successful company, just talked once at school or have a shallow understanding of what they claim they are experts at, respectively? From all the self-help books I read, their messages could be resumed to a few points: 1) If we moderately direct our energy to help others we feel well. 2) We can always improve a certain area of our lives (at the expense of something else). 3) Do this and that to get what you want (or what I would like you to want). The third point actually comes in different flavors: advising people as if preaching, or suggesting actions based on (supposed) past experience. If I could sum up all those materials, that’s what I would take. Why? . Because what matters, is actually what are you doing Less talk, more action. Although self-help is not necessarily hypocritical, one could argue that it tends to be. At the same time, I’m not saying that we shouldn’t follow others — but we must think for ourselves. We need to understand what is a good life for us: not necessarily what others sell as a good life. Who can tell what my happiness is? Do I really need money, to travel, and to build schools anywhere far away from my home to be happy? Or donating to a cause I believe is good enough? It depends. From the perspective of critical thinking, unbiased, self-help books can be quite enriching. I remember reading , in which the author defends that you should actively fight for your goals, and think for yourself. If I could summarize it I would say “business opportunities are there, so you should go for them, and invest in your education”. Self-help is dangerously biased. Rich Dad, Poor Dad Is this bad advice? Hardly. You need to fight for yourself and stand a position because no else will do it for you. Although the book states a positive message, it gives the feeling that you do not need formal education, as in universities. While it is true that you don’t need to go to university to do whatever you want, you are giving away unique opportunities to leverage your potential. Think about it: the world is created and idealized not only by philosophers, art people, and business people but also by scientists, who make technological, sociological and economic progress go further. In social countries, like Portugal, for around 5 years and 5000€ (a master-level course), you can position yourself to be an expert in a given area. An expert that could have counted with the support of experts, entrepreneurs, researchers, professors, and the school community. No wonder that most successful people in the tech and business world have a college degree. Of course, you need to know how to get the most out of college, but that’s a conversation for another day. Besides, it is reasonable to understand why that book doesn’t stand for college education: the author built up his success without it and without the inherent debt. But not everyone is that author. Nobody is author, except the author. As you are not the author, the author’s experience may not apply. Do you get what I’m trying to convey here? Please, consider the following situation: *clears throat* X is true. Think about how sad will you be if that’s not true. Furthermore, I propose you to consume all my materials in order to be happy and have all the success I think you deserve, although I do not know you. And, by the way, you may need to download the apps, give part of your money to coaches, pay monthly subscriptions, and join a community of followers who practice rituals and love our mission for extra 42% productivity. Fancy guru: Buuuut… I wake up at 10, and my life goes really well. I don’t work 12 hours per day, and… You: *Fancy guru interrupts* : you are doing it wrong. You need to embrace pain because it is necessary. You can only develop yourself and grow through pain. You can only reach your potential if you work a lot! When I was your age I worked 16 hours per day, non-stop. I suffered a lot but eventually, I turned myself into a millionaire. Fancy guru : I do not think a normal human should sacrifice so much just to be a little more successful. I would be trading my personal relationships and health for money or a few more publications. It is not worth it. You : If you think like that, you will never be rich! I think you should be surrounded by entrepreneurs that are optimistic, and full of energy. Come on, join our club! Fancy guru Writers, speakers, and also people who want to persuade others often use several logical fallacies: on the previous speech we can see are also used. However, just because some people deliver information via fallacies, it does not necessarily mean that it is untrue. Nonetheless, it is generally a good idea to take everything we are said with a grain or two of salt. After all, many motivational folks are business people selling a product. appeal to emotion appeal to authority, appeal to ignorance, hasty generalization, circular argument, and slippery slope, but others such as the bandwagon appeal, straw man, and equivocation And it could go on and on. Invariably, you are always wrong, you know nothing about life, and you can’t get better without help. Except that… it is not necessarily like that. Nobody knows your life better than yourself. There is no need to insert yourself in shady Ponzi schemes to get to know people that can help you. There is no need for you to sell someone else’s bad products for you to succeed. you can do it without being exploited, and without thinking that it’s fine to do the same to others. , at least in the long run, or at least it stops helping. In a previous article of mine, with a fairly click-baity name, “ ”, I stated the only one tip you need (spoiler: when you know what you should do, just start doing it). Consuming too much self-help materials probably does not help you 1337 tips for productivity You can bet on technology, or you can bet on philosophy. Once you find what drives you, invest energy on it. make sure that what you learn will help you shape society in a good way. While knowing how to trade stocks barely helps someone else than you, people who build platforms with 0% commission will help themselves and others. At least that. Make those banks sweat and obligate themselves to serve the customer better. This is my call to action: stop wasting your time on consuming self help materials. Learn things that matter. Find the time, and do them. Don’t waste your time reading how not to waste time. My thoughts: If I had to sum up my points to people that have no time to read: Self-help materials are good for consulting from time to time, as long as they are actively bringing positive change into your life. Self-help materials are very subjective. Take everything that is being told to you with caution. I would advise you not follow anyone blindly. Self-help communities might help, as long as there are no shady businesses, Ponzi schemes, or the need for recurrently waste time on them. Many quality self-help materials are cheap or even free, and many times were written by people with no intention of making money out of desperate people. Disclaimer: this is a revisited article. Previously published at https://hackernoon.com/my-perspective-about-the-motivational-market-mz3436k3

Just Do it: How Much Motivation Do We Need Nowadays?

Code Book for Annotation of Diverse Cross-Document Coreference: Annotation Tool

This paper is available on arxiv under CC 4.0 license.
Authors:
(1) Jakob Vogel, M.A. Digital Humanities, Institute for Digital Humanities, Faculty of Philosophy, Georg August University of G¨ottingen. Table of Links Abstract and Intro
Diverse cross-document coreference and media bias analysis
Annotation tool
Annotation guidelines
Conclusion and future work
Acknowledgements
Bibliographical References Abstract This paper presents a scheme for annotating coreference across news articles, extending beyond traditional identity relations by also considering near-identity and bridging relations. It includes a precise description of how to set up Inception, a respective annotation tool, how to annotate entities in news articles, connect them with diverse coreferential relations, and link them across documents to Wikidata’s global knowledge graph. This multi-layered annotation approach is discussed in the context of the problem of media bias. Our main contribution lies in providing a methodology for creating a diverse cross-document coreference corpus which can be applied to the analysis of media bias by word-choice and labelling. Keywords: coreference resolution, diverse coreference annotation, entity annotation, entity linking, media bias analysis, natural language processing 1. Introduction Coreference is the phenomenon of several expressions in a text all referring to the same person, object, or other entity or event as their referent. Thus, in a narrow sense, analyzing a document with regards to coreference means detecting relations of identity between phrases. The following example (1) illustrates such an identity relation, where coreferential expressions are printed in italics: (1) “Joe Biden arrived in Berlin yesterday, but the president did not come alone.” In (1), the noun phrase “Joe Biden” introduces a new entity while “the president” relates back to that introducing phrase. Within this relation, the introducing phrase “Joe Biden” is called the antecedent while the back-relating phrase “the president” is called an anaphor. Both expressions are coreferential in the way that they refer to the same non-textual entity, namely to the actual ‘realworld’ Joe Biden or at least to a corresponding mental concept. We can think of an antecedent and its anaphora as forming a cluster of mentions that as a whole represents its extra-textual referent within a textual document, as shown in Figure 1. As a task of natural language processing (NLP), coreference resolution has become quite efficient in detecting identity relations between phrases. However, reflecting on how we use language to refer to something, we are forced to realize that coreference in a broader sense is actually far more complex. We can address an entity or event by using a variety of expressions that are in fact not strictly identical to each other. Consider the following examples: (2) “President Biden was clearly not satisfied with today’s outcome. As the White House stated this afternoon, efforts will be made to . . . ” (3) “Even if the young Erdogan used to be pro-Western, Turkey’s president nowadays often acts against Western interests.” (4) “The AfD is circulating a photo of Angela Merkel with a Hijab, although Merkel never wore Muslim clothes.” In these given examples, the highlighted mentions mean ‘almost’ the same, but not completely. In (2), we are aware by world-knowledge that ”the White House” is often used as a substitute expression for the current US president, although the former is a place which in strict terms cannot be identical to the president, who is a person. In (3), on the other hand, both mentions refer to the ’real-world’ person Erdogan, but at different time steps. Finally, in (4), a mention representing the person Merkel is juxtaposed with a mention representing a picture of Merkel. While these two mentions could refer to separate entities, the juxtaposition indicates a connection between both where the attributes of the first mention do influence the perception of the second mention. Hence, we would miss essential semantic connections if we chose not to mark them as coreferential. Having said that, the simple classification of two mentions into coreferential (identical) or noncoreferential (non-identical) does not seem to suffice the complexity of common text data. Instead, we need to allow for diverse coreference clusters that include finer-grained relations lying between identity and non-identity. We need to allow for near-identity relations to mark two mentions that are partially, but not totally, identical (Recasens et al., 2010). In news coverage, identity and near-identity references are extensively used to report on persons, organizations, and other entities of public interest. It is our goal to build up a corpus that contains annotated examples of such diverse forms of coreference. While diverse coreference occurs in all sorts of news media, we focus on digital print media, only. Furthermore, although in practice both entities and events can act as referent, we ignore references to events for now, as their annotation would go beyond the limits of our present scheme.[1] The ordinary business of journalism is to write about current political affairs and other happenings of public interest. These happenings are normally reported by several newspapers at the same time. All of these news articles are considered documents that contain references to the same entities and together form a discourse about them. To include the whole picture of such intradiscursive references, we want our corpus to link document-level clusters with corresponding clusters of other documents of the same discourse. Hence, our corpus is to depict cross-document coreference data. On a discourse level, corresponding clusters form discourse entities that themselves can be linked to their non-textual referents by some knowledge graph identifier. For this project, we use Wikidata’s Uniform Resource Identifiers (URIs) for entity linking. By doing so, world knowledge is included into the data. This allows for drawing connections even between different discourse entities that refer to a common referent, yet at a different time step or rather in the context of a different happening. Figure 2 illustrates the multiple layers of this annotation model. In building a corpus for diverse cross-document coreference in news articles, we hope to provide a valuable resource for the evaluation of automated coreference resolution tasks. The contribution of this paper mainly lies in providing an answer to the question of how to create such a corpus. How can diverse coreference relations be annotated in a cross-document setup? We believe our scheme as we present it here tackles this problem efficiently, extensively, and unambiguously. Additionally, we would like to use the data resulting from our own annotations for further research in the area of media bias. Even if it plays no direct part in the outlined scheme, a lot of our choices how to annotate references were made because of this requirement to make the data usable for later media bias analysis. Eventually, we hope to contribute to the wider research question of how to identify media bias by word choice and labelling based on the usage of diverse coreference relations in news articles. The following section 2 will further elaborate on this connection between diverse coreference and the problem of media bias analysis. Despite its only subtle impact on our practical annotation instructions, that section means to highlight the theoretical background and motivation behind our project. The sections thereafter will then deal with the actual annotation process. Section 3 will guide coders through the setup and controls of Inception, our selected annotation software. Finally, section 4 will define annotation instructions in three passes while also outlining our typology of diverse coreference. The data we use for our own annotations consists of the text bodies of articles that report on the same happenings. All articles are in English and were published by one of the following US-American newspapers: HuffPost (categorized as ”Left” by AllSides (2023) or ”Skews Left” by Ad Fontes Media (2023), abbreviated in our data as ”LL”), The New York Times (categorized as ”Lean Left” by AllSides or ”Skews Left” by Ad Fontes Media, abbreviated as ”L”), USA Today (categorized as ”Lean Left” or ”Middle or Balanced Bias”, abbreviated as ”M”), Fox News (categorized as ”Right” or ”Skews Right”, abbreviated as ”R”), Breitbart News Network (categoized as ”Right” or ”Strong Right”, abbreviated as ”RR”).[2] [1] Though at a later point, this scheme could be extended to also include the annotation of events (Linguistic Data Consortium, 2005; O’Gorman et al., 2016). [2] Looking at the political orientation of these newspapers, the data is unbalanced with an underrepresentation of politically centered media. However, at the current state of this project, the imbalance is unlikely to influence our analysis which does not yet target political orientation or media bias itself. Therefore, we will ignore this issue for now. This paper is available on arxiv under CC 4.0 license. Authors: (1) Jakob Vogel, M.A. Digital Humanities, Institute for Digital Humanities, Faculty of Philosophy, Georg August University of G¨ottingen. This paper is available on arxiv under CC 4.0 license. Authors: Authors: (1) Jakob Vogel, M.A. Digital Humanities, Institute for Digital Humanities, Faculty of Philosophy, Georg August University of G¨ottingen. Table of Links Abstract and Intro Diverse cross-document coreference and media bias analysis Annotation tool Annotation guidelines Conclusion and future work Acknowledgements Bibliographical References Abstract and Intro Abstract and Intro Diverse cross-document coreference and media bias analysis Diverse cross-document coreference and media bias analysis Annotation tool Annotation tool Annotation guidelines Annotation guidelines Conclusion and future work Conclusion and future work Acknowledgements Acknowledgements Bibliographical References Bibliographical References Abstract This paper presents a scheme for annotating coreference across news articles, extending beyond traditional identity relations by also considering near-identity and bridging relations. It includes a precise description of how to set up Inception, a respective annotation tool, how to annotate entities in news articles, connect them with diverse coreferential relations, and link them across documents to Wikidata’s global knowledge graph. This multi-layered annotation approach is discussed in the context of the problem of media bias. Our main contribution lies in providing a methodology for creating a diverse cross-document coreference corpus which can be applied to the analysis of media bias by word-choice and labelling. Keywords : coreference resolution, diverse coreference annotation, entity annotation, entity linking, media bias analysis, natural language processing Keywords 1. Introduction Coreference is the phenomenon of several expressions in a text all referring to the same person, object, or other entity or event as their referent. Thus, in a narrow sense, analyzing a document with regards to coreference means detecting relations of identity between phrases. The following example (1) illustrates such an identity relation, where coreferential expressions are printed in italics: (1) “Joe Biden arrived in Berlin yesterday, but the president did not come alone.” In (1), the noun phrase “Joe Biden” introduces a new entity while “the president” relates back to that introducing phrase. Within this relation, the introducing phrase “Joe Biden” is called the antecedent while the back-relating phrase “the president” is called an anaphor. Both expressions are coreferential in the way that they refer to the same non-textual entity, namely to the actual ‘realworld’ Joe Biden or at least to a corresponding mental concept. We can think of an antecedent and its anaphora as forming a cluster of mentions that as a whole represents its extra-textual referent within a textual document, as shown in Figure 1. As a task of natural language processing (NLP), coreference resolution has become quite efficient in detecting identity relations between phrases. However, reflecting on how we use language to refer to something, we are forced to realize that coreference in a broader sense is actually far more complex. We can address an entity or event by using a variety of expressions that are in fact not strictly identical to each other. Consider the following examples: (2) “ President Biden was clearly not satisfied with today’s outcome. As the White House stated this afternoon, efforts will be made to . . . ” President Biden the White House (3) “Even if the young Erdogan used to be pro-Western, Turkey’s president nowadays often acts against Western interests.” the young Erdogan Turkey’s president (4) “The AfD is circulating a photo of Angela Merkel with a Hijab , although Merkel never wore Muslim clothes.” a photo of Angela Merkel with a Hijab In these given examples, the highlighted mentions mean ‘almost’ the same, but not completely. In (2), we are aware by world-knowledge that ” the White House ” is often used as a substitute expression for the current US president, although the former is a place which in strict terms cannot be identical to the president, who is a person. In (3), on the other hand, both mentions refer to the ’real-world’ person Erdogan, but at different time steps. Finally, in (4), a mention representing the person Merkel is juxtaposed with a mention representing a picture of Merkel. While these two mentions could refer to separate entities, the juxtaposition indicates a connection between both where the attributes of the first mention do influence the perception of the second mention. Hence, we would miss essential semantic connections if we chose not to mark them as coreferential. Having said that, the simple classification of two mentions into coreferential (identical) or noncoreferential (non-identical) does not seem to suffice the complexity of common text data. Instead, we need to allow for diverse coreference clusters that include finer-grained relations lying between identity and non-identity. We need to allow for near-identity relations to mark two mentions that are partially, but not totally, identical (Recasens et al., 2010). the White House diverse coreference near-identity In news coverage, identity and near-identity references are extensively used to report on persons, organizations, and other entities of public interest. It is our goal to build up a corpus that contains annotated examples of such diverse forms of coreference. While diverse coreference occurs in all sorts of news media, we focus on digital print media, only. Furthermore, although in practice both entities and events can act as referent, we ignore references to events for now, as their annotation would go beyond the limits of our present scheme.[1] The ordinary business of journalism is to write about current political affairs and other happenings of public interest. These happenings are normally reported by several newspapers at the same time. All of these news articles are considered documents that contain references to the same entities and together form a discourse about them. To include the whole picture of such intradiscursive references, we want our corpus to link document-level clusters with corresponding clusters of other documents of the same discourse. Hence, our corpus is to depict cross-document coreference data. On a discourse level, corresponding clusters form discourse entities that themselves can be linked to their non-textual referents by some knowledge graph identifier. For this project, we use Wikidata’s Uniform Resource Identifiers (URIs) for entity linking. By doing so, world knowledge is included into the data. This allows for drawing connections even between different discourse entities that refer to a common referent, yet at a different time step or rather in the context of a different happening. Figure 2 illustrates the multiple layers of this annotation model. In building a corpus for diverse cross-document coreference in news articles, we hope to provide a valuable resource for the evaluation of automated coreference resolution tasks. The contribution of this paper mainly lies in providing an answer to the question of how to create such a corpus. How can diverse coreference relations be annotated in a cross-document setup? We believe our scheme as we present it here tackles this problem efficiently, extensively, and unambiguously. Additionally, we would like to use the data resulting from our own annotations for further research in the area of media bias. Even if it plays no direct part in the outlined scheme, a lot of our choices how to annotate references were made because of this requirement to make the data usable for later media bias analysis. Eventually, we hope to contribute to the wider research question of how to identify media bias by word choice and labelling based on the usage of diverse coreference relations in news articles. The following section 2 will further elaborate on this connection between diverse coreference and the problem of media bias analysis. Despite its only subtle impact on our practical annotation instructions, that section means to highlight the theoretical background and motivation behind our project. The sections thereafter will then deal with the actual annotation process. Section 3 will guide coders through the setup and controls of Inception, our selected annotation software. Finally, section 4 will define annotation instructions in three passes while also outlining our typology of diverse coreference. The data we use for our own annotations consists of the text bodies of articles that report on the same happenings. All articles are in English and were published by one of the following US-American newspapers: HuffPost (categorized as ”Left” by AllSides (2023) or ”Skews Left” by Ad Fontes Media (2023), abbreviated in our data as ”LL”), The New York Times (categorized as ”Lean Left” by AllSides or ”Skews Left” by Ad Fontes Media, abbreviated as ”L”), USA Today (categorized as ”Lean Left” or ”Middle or Balanced Bias”, abbreviated as ”M”), Fox News (categorized as ”Right” or ”Skews Right”, abbreviated as ”R”), Breitbart News Network (categoized as ”Right” or ”Strong Right”, abbreviated as ”RR”).[2] [1] Though at a later point, this scheme could be extended to also include the annotation of events (Linguistic Data Consortium, 2005; O’Gorman et al., 2016). [2] Looking at the political orientation of these newspapers, the data is unbalanced with an underrepresentation of politically centered media. However, at the current state of this project, the imbalance is unlikely to influence our analysis which does not yet target political orientation or media bias itself. Therefore, we will ignore this issue for now.

Code Book for Annotation of Diverse Cross-Document Coreference: Abstract and Intro

Getting Started With Linux: Your Gateway to the Open-Source Realm

This article is a collection of tips and experiences that might help you, or to which you might relate as a fellow generalist. Quick introduction — skippable I’ve been struggling with being a generalist most of my adult life. During my deepest identity and career crisis, I decided to talk to a psychologist. During our 2nd session he says, “Adam, you are most likely what we call a ‘multipotentiality’.” I go, “What? Does that mean I am like… smart or something?” “Not necessarily,” he replies, “it’s more about curiosity. People like you are more common nowadays. You should embrace it." It was the first time I became conscious of this fact. Before it was like “There is too many things. I am lost. I don’t know what to pursue. I want to pursue all at the same time.”, and it suddenly flipped to “Oh, this is who I am. This is how it’s supposed to be. I hate labeling things but,.. this label helps.” How to tell if you are a generalist? You focus on the bigger picture
You like learning
You are drawn to things you don’t know
As soon as you learn something, you consider it obvious, as if not even worth mentioning
You experience burnout quite often
You struggle with defining yourself If you managed to identify yourself, congratulations! I guess.. :/ It’s not something you can opt out of. Your head is just wired weird, unfortunately. Here are a few things you will probably need to live with: Prepare to sacrifice time Imagine mining gold. Imagine you knew exactly where the gold is. Now despite the fact that you know this, since you are a generalist, you will start digging in 27 other directions. Why? Well, exploration! Right? Something might be there, we never know. Going straight for the gold sounds too easy and boring. After excavating 27 tunnels that lead absolutely nowhere, you, naturally, start digging the 28th tunnel. You eventually end up burnout and decide to pick up the gold. That’s what I mean when I say prepare for a time sacrifice. As a generalist you need to get ready for this. It might take you longer to reach your goals, because your natural curiosity will often lead you astray. Maybe the 29th tunnel would hide something extraordinary? The urge to creativity As a generalist, you might often feel the urge to do things differently. Doing things the same as before feels mundane. But reinventing the wheel comes with a cost. Wheel is too powerful. Tested by centuries of time. Even vehicles that fly need wheels. Yet you might feel like trying and reimagining it. Here is my advice —just know when. Just know when you can afford to be innovative, and when it’s a death sentence (wheel). Anytime you feel the urge, just ask yourself “Is this a good time, or should I just force myself to do it as everyone expects me to?”. Trust me, you will get better at answering this question over time. Potential employers don’t trust you After I finished studying design, I was looking for a job either as a UX/UI designer or a frontend developer. I ended up working as a B2B marketing expert. Yeah.. Even though I can code — just launched an app — and have been practicing UX/UI design for more than 8 years, employers generally don’t trust me when they see all these skills in my CV. This is something us generalists simply have to reckon with. I recommend making multiple CVs — one for each of your skills. Also, we will have a much harder time building a strong portfolio in multiple areas, compared to a specialist, who is laser focused on a single skill. Again, it will just take more time for us.. Thrive on chaos Trying to get your life perfectly sorted out might be great for most people. Not for most generalists. But don’t worry about it. Or try not to. Continue exploring. I know it’s hard with all the looks and pressure from your family and peers who try hard to follow linear trajectories. Startups. Your perfect environment? Startups are companies that are just starting out. While their resources might not be scarce, they need to spend them wisely. If they can hire a lawyer and a data scientist in one person (I met this guy!), they will gladly do it, while a serious law firm might be like “What?!”. Also, there are not as many rules at a startup. The company is new, responsibilities are not strictly divided, rigorous processes are not yet in place. As a generalist, you probably enjoy wearing multiple hats, and startups reward you for wearing them! Don’t be afraid As a generalist, fear is your greatest enemy. People fear the unknown, but the unknown and the generalist are the very best friends. Don’t be afraid to accept tasks or jump into things you have zero experience with. This is where your adaptability shines. Jump in, adapt, figure out. You will likely have a much easier time doing this than other people would. Being broke If you are broke, the natural tendency is to find a job. With too many skills, this might prove surprisingly difficult. If you struggle, use your creativity. Try to come up with a business idea. Chances are your ideas will be above average. Use your wide range of skills to offer a unique service. I know this advice is not much. You will probably have to find the job eventually. Just know that thinking outside the box is okay even when it comes to money. Get ready to burn out I don’t know. I still struggle with this one. I guess just get ready for it. You juggle 10 balls cause you have to. Juggling 3 doesn’t quite stimulate you, you will end up bored and you will procrastinate. Too much = burnout, too little = boredom and procrastination. If anyone has tips on how to find a balance here, please let me know. To sum it up: Your strengths: Extremely adaptable


Quickly acquire new skills


Eat challenges Your weaknesses: Huge time sacrifice


Identity struggles


Burnout Key takeaways: Don’t resist, embrace
Prepare for the long run
Know when to be innovative
Don’t fear the challenge
Try balance burnout and boredom This article is a collection of tips and experiences that might help you, or to which you might relate as a fellow generalist. Quick introduction — skippable I’ve been struggling with being a generalist most of my adult life. During my deepest identity and career crisis, I decided to talk to a psychologist. During our 2nd session he says, “Adam, you are most likely what we call a ‘multipotentiality’.” I go, “What? Does that mean I am like… smart or something?” “Not necessarily,” he replies, “it’s more about curiosity. People like you are more common nowadays. You should embrace it." It was the first time I became conscious of this fact. Before it was like “There is too many things. I am lost. I don’t know what to pursue. I want to pursue all at the same time.”, and it suddenly flipped to “Oh, this is who I am. This is how it’s supposed to be. I hate labeling things but,.. this label helps.” How to tell if you are a generalist? How to tell if you are a generalist? You focus on the bigger picture You like learning You are drawn to things you don’t know As soon as you learn something, you consider it obvious, as if not even worth mentioning You experience burnout quite often You struggle with defining yourself You focus on the bigger picture You like learning You are drawn to things you don’t know As soon as you learn something, you consider it obvious, as if not even worth mentioning You experience burnout quite often You struggle with defining yourself If you managed to identify yourself, congratulations! I guess.. :/ It’s not something you can opt out of. Your head is just wired weird, unfortunately. Here are a few things you will probably need to live with: Prepare to sacrifice time Imagine mining gold. Imagine you knew exactly where the gold is. Now despite the fact that you know this, since you are a generalist, you will start digging in 27 other directions. Why? Well, exploration! Right? Something might be there, we never know. Going straight for the gold sounds too easy and boring. After excavating 27 tunnels that lead absolutely nowhere, you, naturally, start digging the 28th tunnel. You eventually end up burnout and decide to pick up the gold. That’s what I mean when I say prepare for a time sacrifice. As a generalist you need to get ready for this. It might take you longer to reach your goals, because your natural curiosity will often lead you astray. Maybe the 29th tunnel would hide something extraordinary? The urge to creativity As a generalist, you might often feel the urge to do things differently. Doing things the same as before feels mundane. But reinventing the wheel comes with a cost. Wheel is too powerful. Tested by centuries of time. Even vehicles that fly need wheels. Yet you might feel like trying and reimagining it. Here is my advice — just know when . Just know when you can afford to be innovative, and when it’s a death sentence (wheel). Anytime you feel the urge, just ask yourself “Is this a good time, or should I just force myself to do it as everyone expects me to?”. Trust me, you will get better at answering this question over time. just know when Potential employers don’t trust you After I finished studying design, I was looking for a job either as a UX/UI designer or a frontend developer. I ended up working as a B2B marketing expert. Yeah.. Even though I can code — just launched an app — and have been practicing UX/UI design for more than 8 years, employers generally don’t trust me when they see all these skills in my CV. This is something us generalists simply have to reckon with. app app I recommend making multiple CVs — one for each of your skills. Also, we will have a much harder time building a strong portfolio in multiple areas, compared to a specialist, who is laser focused on a single skill. Again, it will just take more time for us.. Thrive on chaos Trying to get your life perfectly sorted out might be great for most people. Not for most generalists. But don’t worry about it. Or try not to. Continue exploring. I know it’s hard with all the looks and pressure from your family and peers who try hard to follow linear trajectories. Startups. Your perfect environment? Startups are companies that are just starting out. While their resources might not be scarce, they need to spend them wisely. If they can hire a lawyer and a data scientist in one person (I met this guy!), they will gladly do it, while a serious law firm might be like “What?!”. Also, there are not as many rules at a startup. The company is new, responsibilities are not strictly divided, rigorous processes are not yet in place. As a generalist, you probably enjoy wearing multiple hats, and startups reward you for wearing them! Don’t be afraid As a generalist, fear is your greatest enemy . People fear the unknown, but the unknown and the generalist are the very best friends. Don’t be afraid to accept tasks or jump into things you have zero experience with. This is where your adaptability shines. Jump in, adapt, figure out. You will likely have a much easier time doing this than other people would. fear is your greatest enemy Being broke If you are broke, the natural tendency is to find a job. With too many skills, this might prove surprisingly difficult. If you struggle, use your creativity. Try to come up with a business idea. Chances are your ideas will be above average. Use your wide range of skills to offer a unique service. I know this advice is not much. You will probably have to find the job eventually. Just know that thinking outside the box is okay even when it comes to money. Get ready to burn out I don’t know. I still struggle with this one. I guess just get ready for it. You juggle 10 balls cause you have to. Juggling 3 doesn’t quite stimulate you, you will end up bored and you will procrastinate. Too much = burnout, too little = boredom and procrastination. If anyone has tips on how to find a balance here, please let me know. To sum it up: To sum it up: Your strengths: Your strengths: Extremely adaptable Quickly acquire new skills Eat challenges Extremely adaptable Extremely adaptable Quickly acquire new skills Quickly acquire new skills Eat challenges Eat challenges Your weaknesses: Your weaknesses: Huge time sacrifice Identity struggles Burnout Huge time sacrifice Huge time sacrifice Identity struggles Identity struggles Burnout Burnout Key takeaways: Key takeaways: Don’t resist, embrace Prepare for the long run Know when to be innovative Don’t fear the challenge Try balance burnout and boredom Don’t resist, embrace Prepare for the long run Know when to be innovative Don’t fear the challenge Try balance burnout and boredom

How To Survive as a Generalist

Supernormal Stimuli: Are We Amusing Ourselves to Death?

অতিপ্রাকৃতিক উদ্দীপনা: আমরা কি মৃত্যুর জন্য মজা করছি?

Übernatürliche Reize: Amüsieren wir uns zu Tode?

Estímulos sobrenaturales: ¿nos estamos divirtiendo hasta la muerte?

Stimuli supranormaux : sommes-nous en train de nous amuser à mourir ?

अलौकिक उत्तेजनाएँ: क्या हम अपने आप को मौत तक मनोरंजन कर रहे हैं?

超常刺激：私たちは死ぬほど楽しんでいるのか？

초자연적 자극: 우리는 죽을 때까지 즐겁게 지내고 있나요?

Estímulos supranormais: estamos nos divertindo até a morte?

Сверхъестественные стимулы: развлекаемся ли мы до смерти?

Olağanüstü Uyarıcılar: Kendimizi Ölesiye Eğlendiriyor muyuz?

Kích thích siêu thường: Chúng ta có đang vui vẻ đến chết không?

超常刺激：我们是不是正在自娱自乐？

Once at Last.fm we had an integer overflow in an identify field. I can’t recall where exactly. But I do remember that the inconvenience of having a bunch of Hadoop jobs disrupted while we rushed to update the relevant type couldn’t spoil the collective pride for having more than 2 billion of whatever needed so many ids. Being frugal with identifiers is seldom a good idea, but for me the worst identifier-related headaches came from IDs that had semantic value. At Tuenti (once the largest social network in Spain) there was a concept similar to Facebook pages. Pages had types and subtypes. A page type might have been “group”, which had subtypes “business” or “community”. Another type could be “place” with subtypes like “store” or “landmark”. Page identifiers were strings composed by concatenating numeric identifiers of the type, subtype, and then an increment field in a DB. If you visited https://tuenti.com/p/3_2_6691 you’d instantly know the meaning. It was a “place” (3) of type “store” (2), and the store ID was 6691. Page IDs decomposed in this way would be useful for multiple purposes. Choosing a type-specific implementation of controllers to compose the relevant page, routing to a database shard, that kind of thing. At some point Product wanted to change the classification of pages. To their frustration, this became problematic because the entire taxonomy was encrusted across the code all the way from URLs to databases. Another example are New Relic entities. Entities are an abstraction that broadly represents anything that can send telemetry to New Relic. A host, a Kubernetes cluster, an application, a JVM or a network router can be entities. Of course those are all things you want to identify, so entities have Global Unique IDentifier, or GUID. Every single telemetry datapoint is stamped with the GUID of the entity that produced it, so they act as the keystone of the New Relic platform. Features like Service maps, distributed tracing, entity relationships, and many others are built upon them. Entity GUIDs have meaning. An example of a GUID is 1|APM|APPLICATION|23 where 1 is the account, APM is the domain, APPLICATION is the unique type within that domain, and 23 is a unique identifier within the domain and type. That application might be running in a host 1|INFRA|HOST|12. If we wanted to store that relation, we’d have an entry in some database saying: "1|INFRA|HOST|12" RUNS "1|APM|APPLICATION|23". Like at Tuenti, these semantics come handy. If you’re processing millions of telemetry datapoints per second, it’s useful to tell the type of reporting entity on the fly by decomposing the GUID, rather than perform an expensive lookup to an external service. Account IDs can be used to route data to cells (this talk from Andrew Bloomgarden explains how NR used this pattern to scale). Domains like INFRA or APM corresponded to the original product verticals at New Relic. Years later Product decided (with good criteria) that they created unnecessary fragmentation on the user experience. Types change, get renamed or merged with others. Sometimes (more often than it seems) entities had to migrate from one account to another. In all these cases you would be altering the identifier of many entities. It was painful but possible to work around many of these problems. But replacing GUIDs with semantic-free identifiers was straight impossible. By virtue of being present in thousands of URLs, NRQL queries, etc. GUIDs had become a public API that thousands of customers relied upon. A technical solution to replace identifiers would have been a major project, but doable. What wasn’t possible was to run a find/replace across the private documentation and workflows of your entire customer base. If you look closely, the world is full of semantic identifiers. Sometimes they are hard to avoid, but almost always a pain in the neck. Because they embed a specific model of the world. But models become obsolete faster than we’d like. Addresses make notable examples. The “complex and idiosyncratic” Japanese address system reflects the organic growth of its urban areas. In British postal codes the final part can designate anything from a street to a flat depending on the amount of mail received by the premises. When I was a kid, license plates would give up the province where the owner lived causing an array of nuisances. They were alleviated with the adoption of European standards. But partly. The root problem being that, like the Domain Name System identifiers (“Galo’s website”) remain tied to administrative authorities (“.net”), which can change regulations, or even disappear. Nowadays I find most semantic identifiers in resource management. For some reason, when infrastructure teams define access rules to the resources of a particular service, they prefer to create a group named after the team that owns that service, something like “owner-team-access-list”. Identifiers tied to the org chart don’t like it when the service moves to another team, or owner-team is reorged away. Once at Last.fm we had an integer overflow in an identify field. I can’t recall where exactly. But I do remember that the inconvenience of having a bunch of Hadoop jobs disrupted while we rushed to update the relevant type couldn’t spoil the collective pride for having more than 2 billion of whatever needed so many ids. Last.fm Being frugal with identifiers is seldom a good idea, but for me the worst identifier-related headaches came from IDs that had semantic value. At Tuenti (once the largest social network in Spain) there was a concept similar to Facebook pages. Pages had types and subtypes. A page type might have been “group”, which had subtypes “business” or “community”. Another type could be “place” with subtypes like “store” or “landmark”. Tuenti Page identifiers were strings composed by concatenating numeric identifiers of the type, subtype, and then an increment field in a DB. If you visited https://tuenti.com/p/3_2_6691 you’d instantly know the meaning. It was a “place” (3) of type “store” (2), and the store ID was 6691. Page IDs decomposed in this way would be useful for multiple purposes. Choosing a type-specific implementation of controllers to compose the relevant page, routing to a database shard, that kind of thing. https://tuenti.com/p/3_2_6691 At some point Product wanted to change the classification of pages. To their frustration, this became problematic because the entire taxonomy was encrusted across the code all the way from URLs to databases. Another example are New Relic entities . Entities are an abstraction that broadly represents anything that can send telemetry to New Relic. A host, a Kubernetes cluster, an application, a JVM or a network router can be entities. Of course those are all things you want to identify, so entities have Global Unique IDentifier, or GUID. Every single telemetry datapoint is stamped with the GUID of the entity that produced it, so they act as the keystone of the New Relic platform. Features like Service maps, distributed tracing, entity relationships, and many others are built upon them. New Relic entities Entity GUIDs have meaning . An example of a GUID is 1|APM|APPLICATION|23 where 1 is the account, APM is the domain, APPLICATION is the unique type within that domain, and 23 is a unique identifier within the domain and type. That application might be running in a host 1|INFRA|HOST|12 . If we wanted to store that relation, we’d have an entry in some database saying: Entity GUIDs have meaning 1|APM|APPLICATION|23 APM APPLICATION 23 1|INFRA|HOST|12 "1|INFRA|HOST|12" RUNS "1|APM|APPLICATION|23" . "1|INFRA|HOST|12" RUNS "1|APM|APPLICATION|23" Like at Tuenti, these semantics come handy. If you’re processing millions of telemetry datapoints per second, it’s useful to tell the type of reporting entity on the fly by decomposing the GUID, rather than perform an expensive lookup to an external service. Account IDs can be used to route data to cells ( this talk from Andrew Bloomgarden explains how NR used this pattern to scale). this talk from Andrew Bloomgarden Domains like INFRA or APM corresponded to the original product verticals at New Relic. Years later Product decided (with good criteria) that they created unnecessary fragmentation on the user experience. Types change, get renamed or merged with others. Sometimes (more often than it seems) entities had to migrate from one account to another. In all these cases you would be altering the identifier of many entities. INFRA APM It was painful but possible to work around many of these problems. But replacing GUIDs with semantic-free identifiers was straight impossible. By virtue of being present in thousands of URLs, NRQL queries, etc. GUIDs had become a public API that thousands of customers relied upon. A technical solution to replace identifiers would have been a major project, but doable. What wasn’t possible was to run a find/replace across the private documentation and workflows of your entire customer base. If you look closely, the world is full of semantic identifiers. Sometimes they are hard to avoid, but almost always a pain in the neck. Because they embed a specific model of the world. But models become obsolete faster than we’d like. Addresses make notable examples. The “complex and idiosyncratic” Japanese address system reflects the organic growth of its urban areas. In British postal codes the final part can designate anything from a street to a flat depending on the amount of mail received by the premises. Japanese address system British postal codes When I was a kid, license plates would give up the province where the owner lived causing an array of nuisances . They were alleviated with the adoption of European standards . But partly. The root problem being that, like the Domain Name System identifiers (“Galo’s website”) remain tied to administrative authorities (“.net”), which can change regulations, or even disappear. array of nuisances European standards Domain Name System Nowadays I find most semantic identifiers in resource management. For some reason, when infrastructure teams define access rules to the resources of a particular service, they prefer to create a group named after the team that owns that service, something like “owner-team-access-list”. Identifiers tied to the org chart don’t like it when the service moves to another team, or owner-team is reorged away.

Identifiers are better off without meaning

Authors:
(1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de);
(2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de);
(3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de);
(4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Table of Links Abstract and 1 Introduction 2 Background 3 Design and Implementation of Licma and 3.1 Design 3.2 Implementation 4 Methodology and 4.1 Searching and Downloading Python Apps 4.2 Comparison with Previous Studies 5 Evaluation and 5.1 GitHub Python Projects 5.2 MicroPython 6 Comparison with previous studies 7 Threats to Validity 8 Related Work 9 Conclusion, Acknowledgments, and References ABSTRACT Background: Previous studies have shown that up to 99.59 % of the Java apps using crypto APIs misuse the API at least once. However, these studies have been conducted on Java and C, while empirical studies for other languages are missing. For example, a controlled user study with crypto tasks in Python has shown that 68.5 % of the professional developers write a secure solution for a crypto task. Aims: To understand if this observation holds for real-world code, we conducted a study of crypto misuses in Python. Method: We developed a static analysis tool that covers common misuses of 5 different Python crypto APIs. With this analysis, we analyzed 895 popular Python projects from GitHub and 51 MicroPython projects for embedded devices. Further, we compared our results with the findings of previous studies. Results: Our analysis reveals that 52.26 % of the Python projects have at least one misuse. Further, some Python crypto libraries’ API design helps developers from misusing crypto functions, which were much more common in studies conducted with Java and C code. Conclusion: We conclude that we can see a positive impact of the good API design on crypto misuses for Python applications. Further, our analysis of MicroPython projects reveals the importance of hybrid analyses. 1 INTRODUCTION Cryptography, hereafter crypto, is widely used nowadays to protect our data and ensure confidentiality. For example, without crypto, we would not be able to securely use online banking or do online shopping. Unfortunately, previous research results show that crypto is often used in an insecure way [3, 4, 7, 9, 11]. One such problem is the choice of an insecure parameter, like an insecure block mode, for crypto primitives like encryption. Many static analysis tools exist to identify these misuses such as CryptoREX [13], CryptoLint [4], CogniCryptSAST [8], and Cryptoguard [12]. While these tools and the respective in-the-wild studies concentrate on Java and C, user studies suggest that the existing Python APIs reduce the number of crypto misuses. Acar et al. [2] conducted an experiment with 307 GitHub users which had to solve 3 crypto-related development tasks. They observed that 68.5 % of the professional developers wrote a secure solution in Python for the given task. Within a controlled experiment with 256 Python developers that tried to solve simple crypto tasks, Acar et al. [1] identified that a simple API design, like the Python library cryptography, supports developers in writing secure code. However, no empirical in-the-wild study has yet confirmed that crypto misuses in Python occur less frequently than in Java or C. To empirically evaluate crypto misuses in Python, we introduce LICMA, a multi-language analysis framework with support for 5 different Python crypto APIs and Java’s JCA API. We provide 5 different rules [4] for all Python APIs and 6 different rules [4] for JCA to detect the most common crypto misuses. With LICMA, we analyzed 895 popular Python apps from GitHub and 51 MicroPython projects to gain insights into misuses in Python. We identified that 52.26 % of the Python GitHub apps with crypto usages have at least one misuse causing 1,501 misuses. In total, only 7 % of the misuses are within the application code itself, while the remaining misuses are introduced by dependencies. Further, our study of MicroPython projects reveals that developers in the embedded domain tend to use crypto via C code. Thus, revealing the importance of hybrid static analyses, which can track program information, e.g., a call graph, across multiple languages [5, 10]. To further improve our understanding whether Python APIs are less prone to crypto misuses, we make the following contributions: • A novel, multi-language analysis tool to detect crypto misuses in Python and Java. For Python we cover crypto misuses for 5 common Python crypto APIs and for Java the standard API JCA. • An empirical study of crypto misuses in the 895 most popular Python applications on GitHub revealing 1,501 misuses. • A comparison of our findings in Python applications with previous studies about crypto misuses in-the-wild for Android Apps and firmware images in C. We observed that most Python applications are more secure and the distribution between the concrete types of misuses differ a lot. • An empirical study of crypto misuses in MicroPython projects which reveals the importance of hybrid static analyses. • A replication package including both data sets used for our study, the results of our analysis, and the code of LICMA[1]. This paper is available on arxiv under CC BY 4.0 DEED license. [1] dx.doi.org/10.6084/m9.figshare.16499085 Authors: (1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de); (2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de); (3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de); (4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Authors: Authors: (1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de); (2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de); (3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de); (4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2 Background 2 Background 3 Design and Implementation of Licma and 3.1 Design 3 Design and Implementation of Licma and 3.1 Design 3.2 Implementation 3.2 Implementation 4 Methodology and 4.1 Searching and Downloading Python Apps 4 Methodology and 4.1 Searching and Downloading Python Apps 4.2 Comparison with Previous Studies 4.2 Comparison with Previous Studies 5 Evaluation and 5.1 GitHub Python Projects 5 Evaluation and 5.1 GitHub Python Projects 5.2 MicroPython 5.2 MicroPython 6 Comparison with previous studies 6 Comparison with previous studies 7 Threats to Validity 7 Threats to Validity 8 Related Work 8 Related Work 9 Conclusion, Acknowledgments, and References 9 Conclusion, Acknowledgments, and References ABSTRACT Background : Previous studies have shown that up to 99.59 % of the Java apps using crypto APIs misuse the API at least once. However, these studies have been conducted on Java and C, while empirical studies for other languages are missing. For example, a controlled user study with crypto tasks in Python has shown that 68.5 % of the professional developers write a secure solution for a crypto task. Background Aims : To understand if this observation holds for real-world code, we conducted a study of crypto misuses in Python. Aims Method : We developed a static analysis tool that covers common misuses of 5 different Python crypto APIs. With this analysis, we analyzed 895 popular Python projects from GitHub and 51 MicroPython projects for embedded devices. Further, we compared our results with the findings of previous studies. Method Results : Our analysis reveals that 52.26 % of the Python projects have at least one misuse. Further, some Python crypto libraries’ API design helps developers from misusing crypto functions, which were much more common in studies conducted with Java and C code. Conclusion : We conclude that we can see a positive impact of the good API design on crypto misuses for Python applications. Further, our analysis of MicroPython projects reveals the importance of hybrid analyses. Results Conclusion 1 INTRODUCTION Cryptography, hereafter crypto, is widely used nowadays to protect our data and ensure confidentiality. For example, without crypto, we would not be able to securely use online banking or do online shopping. Unfortunately, previous research results show that crypto is often used in an insecure way [3, 4, 7, 9, 11]. One such problem is the choice of an insecure parameter, like an insecure block mode, for crypto primitives like encryption. Many static analysis tools exist to identify these misuses such as CryptoREX [13], CryptoLint [4], CogniCryptSAST [8], and Cryptoguard [12]. CryptoREX CryptoLint CogniCryptSAST Cryptoguard While these tools and the respective in-the-wild studies concentrate on Java and C, user studies suggest that the existing Python APIs reduce the number of crypto misuses. Acar et al. [2] conducted an experiment with 307 GitHub users which had to solve 3 crypto-related development tasks. They observed that 68.5 % of the professional developers wrote a secure solution in Python for the given task. Within a controlled experiment with 256 Python developers that tried to solve simple crypto tasks, Acar et al. [1] identified that a simple API design, like the Python library cryptography , supports developers in writing secure code. However, no empirical in-the-wild study has yet confirmed that crypto misuses in Python occur less frequently than in Java or C. cryptography To empirically evaluate crypto misuses in Python, we introduce LICMA , a multi-language analysis framework with support for 5 different Python crypto APIs and Java’s JCA API. We provide 5 different rules [4] for all Python APIs and 6 different rules [4] for JCA to detect the most common crypto misuses. With LICMA, we analyzed 895 popular Python apps from GitHub and 51 MicroPython projects to gain insights into misuses in Python. We identified that 52.26 % of the Python GitHub apps with crypto usages have at least one misuse causing 1,501 misuses. In total, only 7 % of the misuses are within the application code itself, while the remaining misuses are introduced by dependencies. Further, our study of MicroPython projects reveals that developers in the embedded domain tend to use crypto via C code. Thus, revealing the importance of hybrid static analyses, which can track program information, e.g., a call graph, across multiple languages [5, 10]. LICMA To further improve our understanding whether Python APIs are less prone to crypto misuses, we make the following contributions: • A novel, multi-language analysis tool to detect crypto misuses in Python and Java. For Python we cover crypto misuses for 5 common Python crypto APIs and for Java the standard API JCA. • An empirical study of crypto misuses in the 895 most popular Python applications on GitHub revealing 1,501 misuses. • A comparison of our findings in Python applications with previous studies about crypto misuses in-the-wild for Android Apps and firmware images in C. We observed that most Python applications are more secure and the distribution between the concrete types of misuses differ a lot. • An empirical study of crypto misuses in MicroPython projects which reveals the importance of hybrid static analyses. • A replication package including both data sets used for our study, the results of our analysis, and the code of LICMA[1]. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv [1] dx.doi.org/10.6084/m9.figshare.16499085

Common Misuses of Python Crypto APIs in the Wild

ওয়াইল্ডে পাইথন ক্রিপ্টো এপিআই-এর সাধারণ অপব্যবহার

Häufige Fehlanwendungen von Python Crypto APIs in der Praxis

Usos indebidos comunes de las API criptográficas de Python en la naturaleza

Utilisations abusives courantes des API Python Crypto dans la nature

पायथन क्रिप्टो एपीआई का सामान्य दुरुपयोग

Python 暗号 API の一般的な誤用例

실제 Python 암호화 API의 일반적인 오용

Usos indevidos comuns de APIs de criptografia Python na natureza

Распространенные злоупотребления API-интерфейсами Python Crypto в дикой природе

Python Kripto API'lerinin Doğadaki Yaygın Yanlış Kullanımları

Những trường hợp lạm dụng API tiền điện tử Python phổ biến

常见的 Python 加密 API 误用

The good news of the , the European authority for anti-money laundering and countering terrorist financing, in Frankfurt, signals an expected change in the financial industry. is ready to collaborate with its members to ensure the financial crime fight has the means to be successful. establishment of AMLA The EU While this is just the start of more monitoring, AMLA will be operational in 2025, one thing is clear: customer mindsets are shifting towards a greater emphasis on technology and data management in financial crime prevention, according to , CEO of a Swedish regtech company. Gabriella Bussien Trapets, Bussien highlighted the importance of leveraging knowledge providers and in-house development, as well as stressing the need for banks to stay ahead through innovation and technology-driven solutions. Additionally, Bussien discussed the importance of educating customers about Know Your Customer (KYC) processes to avoid misunderstandings and mistrust. The AMLA driving factor The importance of the creation of AMLA is symptomatic of a specific moment.  Why has the EU decided to establish it now? What factors have led to this decision, and why wasn’t it created 10 or 20 years ago? Understanding the timing and rationale behind AMLA’s creation is crucial in grasping its significance in the fight against financial crime. For Bussien, the question arises as to why such measures haven’t been taken earlier. “However, when coordinating actions across multiple countries, there are inherent challenges in fostering willingness to collaborate. It seems that the recognition of the absolute necessity for such collaboration has matured over time. As the global landscape evolves, there’s a growing understanding that addressing financial crime requires a united, collaborative approach,” she said. She stresses the fact that within the EU, for instance, it’s increasingly apparent that ignoring these issues is no longer feasible. Thus, there’s a shift towards acknowledging the need for a comprehensive, collective response. “While debates may persist, it’s encouraging to see a realization emerging that significant action is warranted from both EU institutions and member states to address financial crime from a holistic perspective,” she added. It’s easy to think that this will be a pivotal moment for combating financial crime in Europe, but is it? What is clear is that this EU decision will establish a greater level of consistency and overarching supervision power, creating a more unified approach. From this perspective, added Bussien, it’s about ensuring stability and equality across the board within the EU financial system. This move towards centralized oversight aims to prevent fragmentation and promote a cohesive strategy in combating financial crime. The new financial rap From a customer perspective, there’s a renewed heightened awareness regarding financial institutions and their susceptibility to financial crimes, particularly in newer generations, who are accustomed to stringent KYC protocols and thorough background checks before becoming customers. For Trapets’ CEO, there’s a shift in expectations, akin to the emphasis on sustainability in business dealings. “Customers are increasingly discerning about where their money is invested, conducting extensive research before choosing a financial institution. This trend, observed especially among newer generations, signifies a departure from the past, where switching banks was less common due to digital barriers,” commented Bussien. The ease of digital banking has facilitated this shift, allowing customers to be more flexible in their choices. As a result, there’s a growing emphasis on informed decision-making and conscientious banking practices among consumers, particularly among younger generations. But, as Bussien said, regarding false positives and their impact on customer bank switching, it’s a complex issue. Reports, such as those in the , highlight instances of false positives leading to account closures by banks. “While these closures may occur due to system protocols rather than any illegal activity on the customer’s part, it still can lead to dissatisfaction, especially if one relies heavily on digital banking,” Bussien commented. “It’s crucial for banks to have robust KYC processes in place to minimize false positives and ensure knowledgeable staff capable of making informed decisions.” New York Times It seems clear that customers must understand that KYC questionnaires are linked to behavior analysis monitored by banks. Any inconsistencies between stated intentions and actual actions can prompt alerts. However, for Bussien, it’s equally important for banks to handle these situations delicately. Instead of immediately closing accounts, there should be thorough investigation processes in place to maintain customer satisfaction while upholding regulatory standards. Trust and credibility in the banking system It is debatable if recent news regarding alleged involvement in facilitating transactions for Iranian foreign entities can have significant repercussions on brand reputation and losing trust and credibility among customers and the broader community. “Generally speaking, loyalty to banks has evolved. Previously, people tended to remain loyal to the bank they initially chose, but this sentiment has shifted across generations. Nowadays, loyalty to a single bank is less common, indicating a broader trend of stretched loyalty,” mentioned Bussien. Lloyds Bank and Santander’s Regarding brand reputation, particularly in the financial sector, it’s unclear how much impact allegations of money laundering or similar issues have on customer churn. “While such scandals undoubtedly affect a bank’s image, customer behavior might be more influenced by their personal experiences. For instance, if a bank consistently fails to address fraudulent activities affecting customers, this may prompt individuals to switch banks, regardless of the institution’s involvement in larger-scale misconduct like money laundering,” added the Trapets CEO. In essence, according to the specialist, the triggers for changing banks might differ based on personal experiences with fraud prevention and customer service, as opposed to perceptions of the bank’s involvement in illicit activities. The role of tech in combating financial crime How to weigh the importance of technology in the banking industry’s efforts to combat financial crime? While some banks opt to develop solutions internally, it’s essential to recognize whether technology is truly their forte. Often, partnering with specialized technology providers proves more beneficial, as these entities possess the expertise and agility necessary for continuous innovation and compliance with regulations. Bussien makes it clear: “It’s a matter of weighing the bank’s internal capabilities against the advantages of leveraging external knowledge and resources. In most cases, banks may find it impractical and inefficient to handle such endeavors internally, given the complexities involved. Relying on technology providers ensures ongoing development and maintenance of robust systems tailored to evolving regulatory requirements.” It’s unmistakable that banks must prioritize the structuring and management of their data. Effective technology implementation hinges on having organized, accessible data sets. Without a structured approach to data management, even the most advanced technology solutions may falter. Therefore, alongside technological investments, banks must focus on refining their data infrastructure to maximize the effectiveness of anti-financial crime measures. All of this combined can foster the renewed importance of financial crime prevention in Europe.

The EU's New Anti-Money Laundering Authority and its Crime Prevention Focus

The words "venture" and "venture capital investment" are heard more and more often nowadays, but many beginner investors experience fear of uncertainty and doubt when choosing this method of financing. In order to better understand this topic, I asked Aleksandr Belov, co-founder and CEO of the Prosto VC club*.* First of all, it is important to understand that angel investors are very eager to reach out to the top startups investments in which can multiply your invested money many times over. But for a regular angel investor, this is virtually impossible. Especially remotely, it is impossible to reach the best venture deals that take place, for example, in Silicon Valley - there are thousands of funds there, claiming your place in the startup. Therefore, the only working business model for getting into such deals is the model of community and co-investment with those who already know how to get into such deals. Why do people go into venture capital? And what is it, anyway? Venture means nothing less than investment. It’s neither philanthropy, nor sponsorship of startups and not just the financing of some technologies. In abstract terms, venture is a field of financial engineering. Simply speaking, it is one of the ways to multiply your own capital. Not to save, but to multiply, because venture capital is a high-risk tool, so it is much less suitable for saving than classical banking and stock exchange options, which means that people come to venture capital to earn money. It is important for both beginner investors and startups to understand this - a venture capitalist is the same as an entrepreneur who is looking for a way to make a super profit, but in a more passive way. That is, if a start-up founder's contribution consists of 90% of his time and 10% of his personal funds, an investor, on the contrary, wants to devote 10% of his time, but is ready to compensate 90% of his "involvement" with money. This is what the investor's partnership with the startup is based on. In Kiyosaki's Cash Flow Quadrant, this type of employment is called "Investor". It turns out that those who aim at this part of the quadrant go into venture capital. They can be former entrepreneurs, top managers, celebrities who have the initial capital to make the first steps towards this role. Venture is, obviously, not quick, you have to wait several years for your share in the startup to grow in monetary terms. And during these years you have to build a whole portfolio of projects, i.e. invest in other startups to reduce the risk of losses and increase the chances that several portfolio projects will shoot up and bring super profits - 10, 100, in rare cases 1000 times more than you invested in them. This is why people come to venture capital when there is no longer a goal of making money "here and now". Why do they go into venture capital - from a purely practical point of view, to be able to earn much more than with any other tool. In real estate the average income yield is 8-10% per annum, the average annual yield of the US stock market is 15%,the investments into metals in some cases can reach 20%. In venture capital it is historically 30-40%. But it is important to realize that not every startup will show such profitability, and the portfolio as a whole - you should be prepared that out of 10 startups 5 will pass away, a few more will bring nothing, and only 1-2 will show such growth that the earnings from them will cover the losses from all the others. To sum it up - people go into venture capital with the aim to improve their standard of living; to satisfy their own motivation to provide for the future, for their tom orrow better due to strategically higher profitability than can be obtained in classical financial instruments. Is venture capital complicated, is it knowledge available only to a few? After talking to the founders of the Venture Club, I can say that, in fact, no - this opinion about venture capital is not accurate - it comes from ignorance, from the lack of completeness of information. Like when you first go to the gym and you think that losing weight and gaining muscle is some kind of rocket science. Or like when we all thought that about math in first grade. But as you dive in, the subject gets easier. Venturing is an extension of entrepreneurial or management experience. Decision making is very similar, the same questions about market, team, strategy are relevant as in any other non-venture project. Of course, there are nuances - for example, in venture capital you have to be a little more immersed in technological trends; you have to do market analytics a little differently. But there is already a lot of information on how to do this. The main rule of thumb is that if you start today, in six months you will have a good understanding of venture capital and an idea of what kind of portfolio you want to have. If you don't start - you will be six months off your own startup earning schedule. Do venture capitalists need large amounts of capital? It's no secret that previously an investor's check to a startup was several tens or hundreds of thousands of dollars. Even 5 years ago, the minimum check was $25,000-30,000. But the industry is evolving. The business model of syndicates and venture clubs has emerged - where several investors can throw together smaller checks, and eventually score one substantial one. There are already deals where the minimum check is $10,000, and there are even deals where the minimum check is $5,000. But at the same time, all club members together can raise up to $500,000, which is even more than the checks of many funds at the early stage of a startup's development. In this case, the investor has no commitments, they independently decide whether to join the deal and in what amount. To do this, the club provides all the information required to make the decision. In addition, there are online platforms where you can invest as little as $1,000 in your favorite startup according to the same principle. All this makes it possible, even with a relatively small amount of capital allocated for high-risk venture investments, to assemble a balanced portfolio of projects in different industries, in different markets and with different levels of risk. Moreover, Aleksandr told me that even those club members who have large venture budgets should not be in a hurry to put $100,000 into each project. From the point of view of statistics and mathematical expectations, it is better to distribute these $100,000 into a dozen of projects. Strategically, this will give a better return on the entire portfolio. And if you see that some startup is rapidly taking off, you will have the opportunity to put a bigger check into the startup at the next round, thus greatly reducing risks by investing substantial checks only in the most successful projects in your portfolio. So, small initial checks are a boon for the investor, it is his option to "take a place" in a promising project without risking all his capital at once. So if you are ready to allocate $5,000-10,000 several times a year to your favorite startups, join venture clubs - they give you the opportunity to get a small check into interesting and often exclusive deals that are simply impossible to discover without a club. The words "venture" and "venture capital investment" are heard more and more often nowadays, but many beginner investors experience fear of uncertainty and doubt when choosing this method of financing. The words "venture" and "venture capital investment" are heard more and more often nowadays, but many beginner investors experience fear of uncertainty and doubt when choosing this method of financing. In order to better understand this topic, I asked Aleksandr Belov, co-founder and CEO of the Prosto VC club *.* In order to better understand this topic, I asked Aleksandr Belov, co-founder and CEO of the Aleksandr Belov, co-founder and CEO of the Prosto VC club Prosto VC club First of all, it is important to understand that angel investors are very eager to reach out to the top startups investments in which can multiply your invested money many times over. But for a regular angel investor, this is virtually impossible. Especially remotely, it is impossible to reach the best venture deals that take place, for example, in Silicon Valley - there are thousands of funds there, claiming your place in the startup. Therefore, the only working business model for getting into such deals is the model of community and co-investment with those who already know how to get into such deals. Why do people go into venture capital? And what is it, anyway? Why do people go into venture capital? And what is it, anyway? Venture means nothing less than investment. It’s neither philanthropy, nor sponsorship of startups and not just the financing of some technologies. In abstract terms, venture is a field of financial engineering. Simply speaking, it is one of the ways to multiply your own capital. Not to save, but to multiply, because venture capital is a high-risk tool, so it is much less suitable for saving than classical banking and stock exchange options, which means that people come to venture capital to earn money. It is important for both beginner investors and startups to understand this - a venture capitalist is the same as an entrepreneur who is looking for a way to make a super profit, but in a more passive way. That is, if a start-up founder's contribution consists of 90% of his time and 10% of his personal funds, an investor, on the contrary, wants to devote 10% of his time, but is ready to compensate 90% of his "involvement" with money. This is what the investor's partnership with the startup is based on. In Kiyosaki's Cash Flow Quadrant , this type of employment is called "Investor". It turns out that those who aim at this part of the quadrant go into venture capital. They can be former entrepreneurs, top managers, celebrities who have the initial capital to make the first steps towards this role. Cash Flow Quadrant Venture is, obviously, not quick, you have to wait several years for your share in the startup to grow in monetary terms. And during these years you have to build a whole portfolio of projects, i.e. invest in other startups to reduce the risk of losses and increase the chances that several portfolio projects will shoot up and bring super profits - 10, 100, in rare cases 1000 times more than you invested in them. This is why people come to venture capital when there is no longer a goal of making money "here and now". Why do they go into venture capital - from a purely practical point of view, to be able to earn much more than with any other tool. In real estate the average income yield is 8-10% per annum, the average annual yield of the US stock market is 15%,the investments into metals in some cases can reach 20%. In venture capital it is historically 30-40%. But it is important to realize that not every startup will show such profitability, and the portfolio as a whole - you should be prepared that out of 10 startups 5 will pass away, a few more will bring nothing, and only 1-2 will show such growth that the earnings from them will cover the losses from all the others. Why do they go into venture capital Why do they go into venture capital To sum it up - people go into venture capital with the aim to improve their standard of living; to satisfy their own motivation to provide for the future, for their tom orrow better due to strategically higher profitability than can be obtained in classical financial instruments. Is venture capital complicated, is it knowledge available only to a few? Is venture capital complicated, is it knowledge available only to a few? After talking to the founders of the Venture Club, I can say that, in fact, no - this opinion about venture capital is not accurate - it comes from ignorance, from the lack of completeness of information. Like when you first go to the gym and you think that losing weight and gaining muscle is some kind of rocket science. Or like when we all thought that about math in first grade. But as you dive in, the subject gets easier. Venturing is an extension of entrepreneurial or management experience. Decision making is very similar, the same questions about market, team, strategy are relevant as in any other non-venture project. Of course, there are nuances - for example, in venture capital you have to be a little more immersed in technological trends; you have to do market analytics a little differently. But there is already a lot of information on how to do this. The main rule of thumb is that if you start today, in six months you will have a good understanding of venture capital and an idea of what kind of portfolio you want to have. If you don't start - you will be six months off your own startup earning schedule. Do venture capitalists need large amounts of capital? Do venture capitalists need large amounts of capital? It's no secret that previously an investor's check to a startup was several tens or hundreds of thousands of dollars. Even 5 years ago, the minimum check was $25,000-30,000. But the industry is evolving. The business model of syndicates and venture clubs has emerged - where several investors can throw together smaller checks, and eventually score one substantial one. There are already deals where the minimum check is $10,000, and there are even deals where the minimum check is $5,000. But at the same time, all club members together can raise up to $500,000, which is even more than the checks of many funds at the early stage of a startup's development. In this case, the investor has no commitments, they independently decide whether to join the deal and in what amount. To do this, the club provides all the information required to make the decision. In addition, there are online platforms where you can invest as little as $1,000 in your favorite startup according to the same principle. All this makes it possible, even with a relatively small amount of capital allocated for high-risk venture investments, to assemble a balanced portfolio of projects in different industries, in different markets and with different levels of risk. Moreover, Aleksandr told me that even those club members who have large venture budgets should not be in a hurry to put $100,000 into each project. From the point of view of statistics and mathematical expectations, it is better to distribute these $100,000 into a dozen of projects. Strategically, this will give a better return on the entire portfolio. And if you see that some startup is rapidly taking off, you will have the opportunity to put a bigger check into the startup at the next round, thus greatly reducing risks by investing substantial checks only in the most successful projects in your portfolio. So, small initial checks are a boon for the investor, it is his option to "take a place" in a promising project without risking all his capital at once. So if you are ready to allocate $5,000-10,000 several times a year to your favorite startups, join venture clubs - they give you the opportunity to get a small check into interesting and often exclusive deals that are simply impossible to discover without a club.

Breaking into Venture Capital: Overcoming Obstacles and Embracing Potential 

For years, web developers of all experience levels have relied on __caniuse.com __to understand the support of a given feature. Reviewing caniuse.com is helpful in determining backward compatibility or which of the modern browsers supports cutting-edge improvements to web specifications. In 2023, Google introduced Baseline to the web community. This tool is not just another addition to the developer's toolkit but a crucial aid in determining the safety of features and APIs for use in production-grade web applications. It’s a platform for interoperability, a much-needed resource to help engineers produce more consistent and efficient experiences, and a testament to Google's commitment to improving web best practices. Why Google Baseline? Browsers are constantly evolving, and vendors release updates monthly. With more individuals contributing and working on specifications than ever before and a far more transparent dialogue between the main browser vendors (Safari, Firefox, Chrome, Edge), it's become increasingly difficult to track which new features are stable across the landscape. However, with the introduction of Baseline, this struggle is significantly alleviated. Considering the above, as new features are released into browser engines, engineers often need more time to ramp up, refactor, or strategically plan the introduction of new features into their code bases. More importantly, as Google is often one of the platforms that push front-end technology forward, it has admittedly accepted that it is partly to blame here. It’s one of the reasons the Chrome team came up with web.dev and developer.chrome.com, as Chrome is often the first browser to land cutting-edge technologies. The introduction of Baseline has also led to further documentation and conferences focused on interoperability. New features mean documentation, and Google has made strides to ensure MDN has the relevant documentation for newer technologies as they land in Chrome. Closing the Vendor Gap From Google's perspective, engineers have one significant struggle: the behaviour and consistency of features across vendors and browser engines. It’s a pain point for all engineers in the field, requiring complex planning and solutions often to overcome a particular browser engine's lack of support. The solution here (for the last two years) was Interop 2022 and Interop 2023 - a conference and community that helps bridge the gap between browsers to provide a more consistent and performant web. What is Baseline? Baseline serves as the universal flag of acceptance across browser vendors. It helps engineers determine what is fully stable across the landscape and across browser vendors for the most recent two versions of each browser. This feature stability assurance is a game-changer in web development, providing a reliable benchmark for engineers to base their decisions on. How Does Baseline Work? You can access Google Baseline on MDN, web.dev and caniuse.com. Baseline also plans to provide a way to see what has become stable across all browser vendors through a year-on-year approach. For instance, you can read the following article to see what got added to Baseline in 2023: Baseline 2023 As engineering teams, we must keep up with these changes and avoid getting stuck in old solutions for common problems. Importantly, Baseline has two labels: Newly available: the feature is finally interoperable.
Widely available: 30 months have passed since the interoperable date. Baseline considers the major browser vendors to be: Safari (macOS and iOS)
Firefox (Desktop + Android)
Chrome (Desktop + Android)
Edge (Desktop) Google Baseline’s Effect on Engineering Teams One of the most significant benefits of Google Baseline for engineering teams is the removal of guesswork and research required to implement new features. For instance, a Frontend Engineer may want to leverage CSS Grid's new sub-grid feature. With Baseline, they can quickly and confidently determine its support across major browsers, saving time and effort. Sub-grid helps engineers define a grid within a grid to have more refined control over layouts. Heading to caniuse.com tells us there’s a global usage percentage of 87.42%—pretty decent, but we still need to ascertain which browser vendors support / don’t support / partially support the feature. CanIUse now displays a Baseline badge that tells us that this feature is “Newly available across major browsers.” Likewise, if you review the documentation for the sub-grid on MDN, you’ll see a similar banner: Finally, if you review the sub-grid article on web.dev, you’ll see this feature got added to Baseline in 2023: A Word on Evergreen Browsers In my opinion, we do not talk enough about this topic. For most modern users, the days of manually updating browsers are gone. Chrome, Firefox, and Edge auto-update automatically. Safari is an outlier in this case. Safari requires a manual update when a new release is sent out from Apple or when OS X is upgraded annually. Regardless, more users than ever use the latest version of browsers. Although we should ensure the features we build degrade gracefully, this is less of a fundamental consideration nowadays and more of a luxury assumption. Useful Links Google Baseline
Google Baseline Introduction
Baseline 2023
Interop 2022 / Interop 2023 For years, web developers of all experience levels have relied on __ caniuse.com __to understand the support of a given feature. Reviewing caniuse.com is helpful in determining backward compatibility or which of the modern browsers supports cutting-edge improvements to web specifications. caniuse.com In 2023, Google introduced Baseline to the web community. This tool is not just another addition to the developer's toolkit but a crucial aid in determining the safety of features and APIs for use in production-grade web applications. It’s a platform for interoperability, a much-needed resource to help engineers produce more consistent and efficient experiences, and a testament to Google's commitment to improving web best practices. Baseline Baseline Why Google Baseline? Browsers are constantly evolving, and vendors release updates monthly. With more individuals contributing and working on specifications than ever before and a far more transparent dialogue between the main browser vendors (Safari, Firefox, Chrome, Edge), it's become increasingly difficult to track which new features are stable across the landscape. However, with the introduction of Baseline, this struggle is significantly alleviated. Considering the above, as new features are released into browser engines, engineers often need more time to ramp up, refactor, or strategically plan the introduction of new features into their code bases. More importantly, as Google is often one of the platforms that push front-end technology forward, it has admittedly accepted that it is partly to blame here. It’s one of the reasons the Chrome team came up with web.dev and developer.chrome.com , as Chrome is often the first browser to land cutting-edge technologies. The introduction of Baseline has also led to further documentation and conferences focused on interoperability. web.dev web.dev developer.chrome.com developer.chrome.com New features mean documentation, and Google has made strides to ensure MDN has the relevant documentation for newer technologies as they land in Chrome. Closing the Vendor Gap From Google's perspective, engineers have one significant struggle: the behaviour and consistency of features across vendors and browser engines . It’s a pain point for all engineers in the field, requiring complex planning and solutions often to overcome a particular browser engine's lack of support. the behaviour and consistency of features across vendors and browser engines The solution here (for the last two years) was Interop 2022 and Interop 2023 - a conference and community that helps bridge the gap between browsers to provide a more consistent and performant web. Interop 2022 Interop 2022 Interop 2023 Interop 2023 What is Baseline? Baseline serves as the universal flag of acceptance across browser vendors. It helps engineers determine what is fully stable across the landscape and across browser vendors for the most recent two versions of each browser. This feature stability assurance is a game-changer in web development, providing a reliable benchmark for engineers to base their decisions on. How Does Baseline Work? You can access Google Baseline on MDN , web.dev and caniuse.com . MDN MDN web.dev web.dev caniuse.com caniuse.com Baseline also plans to provide a way to see what has become stable across all browser vendors through a year-on-year approach. For instance, you can read the following article to see what got added to Baseline in 2023: Baseline 2023 Baseline 2023 Baseline 2023 As engineering teams, we must keep up with these changes and avoid getting stuck in old solutions for common problems. Importantly, Baseline has two labels: Newly available: the feature is finally interoperable. Widely available: 30 months have passed since the interoperable date. Newly available: the feature is finally interoperable. Widely available: 30 months have passed since the interoperable date. Baseline considers the major browser vendors to be: Safari (macOS and iOS) Firefox (Desktop + Android) Chrome (Desktop + Android) Edge (Desktop) Safari (macOS and iOS) Safari Safari Firefox (Desktop + Android) Firefox Firefox Chrome (Desktop + Android) Chrome Chrome Edge (Desktop) Edge Edge Google Baseline’s Effect on Engineering Teams One of the most significant benefits of Google Baseline for engineering teams is the removal of guesswork and research required to implement new features. For instance, a Frontend Engineer may want to leverage CSS Grid's new sub-grid feature. With Baseline, they can quickly and confidently determine its support across major browsers, saving time and effort. sub-grid sub-grid Sub-grid helps engineers define a grid within a grid to have more refined control over layouts. Heading to caniuse.com tells us there’s a global usage percentage of 87.42%—pretty decent, but we still need to ascertain which browser vendors support / don’t support / partially support the feature. caniuse.com caniuse.com CanIUse now displays a Baseline badge that tells us that this feature is “ Newly available across major browsers. ” CanIUse CanIUse Newly available across major browsers. Likewise, if you review the documentation for the sub-grid on MDN, you’ll see a similar banner: Finally, if you review the sub-grid article on web.dev , you’ll see this feature got added to Baseline in 2023 : web.dev web.dev Baseline in 2023 Baseline in 2023 A Word on Evergreen Browsers In my opinion, we do not talk enough about this topic. For most modern users, the days of manually updating browsers are gone. Chrome, Firefox, and Edge auto-update automatically. Safari is an outlier in this case. Safari requires a manual update when a new release is sent out from Apple or when OS X is upgraded annually. Regardless, more users than ever use the latest version of browsers. Although we should ensure the features we build degrade gracefully, this is less of a fundamental consideration nowadays and more of a luxury assumption. Useful Links Google Baseline Google Baseline Introduction Baseline 2023 Interop 2022 / Interop 2023 Google Baseline Google Baseline Google Baseline Google Baseline Introduction Google Baseline Introduction Google Baseline Introduction Baseline 2023 Baseline 2023 Baseline 2023 Interop 2022 / Interop 2023 Interop 2022 Interop 2022 Interop 2023 Interop 2023

What Is Google Baseline?: A Quick Look at Its Impact on Browser Compatibility and Interoperability

UUID for authentication There is hardly a person nowadays who never clicked that "Recover password" button in deep frustration. Even if it does seem the password was without a doubt correct, the next step of recovering it mostly goes smoothly with visiting a link from an email and entering the new password (let's not fool anyone; it is hardly new as you have just typed it three times already in step 1 before pressing the obnoxious button). The logic behind email links, however, is something to take great scrutiny about as leaving its generation insecure opens a flood of vulnerabilities regarding unauthorized access to user accounts. Unfortunately, here is one example of a UUID-based recovery URL structure many probably encountered, which does not nevertheless follow security guidelines: https://.../recover/d17ff6da-f5bf-11ee-9ce2-35a784c01695 If such a link is used, it generally means that anyone can get your password, and it is as simple as that. This article aims to dive deep into UUID generation methods and select insecure approaches to their application. What is UUID UUID is a 128-bit label commonly used in generating pseudo-random identifiers with two valuable attributes: it is complex enough and unique enough. Mostly, those are key requirements for ID leaving the backend and being shown to the user explicitly in the frontend or generally sent over API with the ability to be observed. It makes one hard to guess or brute-force in comparison to id = 123 (complexity) and prevents collisions when the generated id is duplicated to previously used, e.g., a random number from 0 to 1000 (uniqueness). The "enough" parts actually come from, firstly, some versions of Universally Unique IDentifier, leaving it open for minor possibilities for duplications, which is, however, easily mitigated by additional comparison logic and does not pose a threat due to hardly controlled conditions for its occurrence. And secondly, the take on complexity of various UUID versions is described in the article, in general it is assumed to be quite good except for further corner cases. Implementations in backend Primary keys in database tables appear to rely on the same principles of being complex and unique as UUID does. With the wide adoption of built-in methods for its generation in many programming languages and database management systems, UUID often comes as the first choice to identify data entries stored and as a field to join tables in general and subtables split by normalization. Sending user IDs that come from a database over API in response to certain actions is also common practice for making a process of unifying data flows simpler without extra temporary ID generation and linking them to ones in production data storage. In terms of password reset examples, the architecture more likely includes a table responsible for such an operation that inserts rows of data with generated UUID every time a user clicks the button. It initiates the recovery process by sending an email to the address associated with the user by their user_id and checking which user to reset the password for based on the identifier they have once the reset link is opened. There are, however, security guidelines for such identifiers visible to users, and certain implementations of UUID meet them with varying degrees of success. Outdated versions Version 1 of UUID generation splits its 128 bits into using a 48-bit MAC address of the device generating identifier, a 60-bit timestamp, 14-bit stored for incrementing value, and 6 for versioning. Uniqueness guarantee is thus transferred from rules in code logic to hardware manufacturers who are supposed to assign values for every new machine in production correctly. Leaving only 60+14 bits to represent useful changeable payload deteriorates the integrity of the identifier, especially with such transparent logic behind it. Let's take a look at a sequence of consequently generated number of UUID v1: from uuid import uuid1

for _ in range(8):

    print(uuid1()) d17ff6da-f5bf-11ee-9ce2-35a784c01695
d17ff6db-f5bf-11ee-9ce2-35a784c01695
d17ff6dc-f5bf-11ee-9ce2-35a784c01695
d17ff6dd-f5bf-11ee-9ce2-35a784c01695
d17ff6de-f5bf-11ee-9ce2-35a784c01695
d17ff6df-f5bf-11ee-9ce2-35a784c01695
d17ff6e0-f5bf-11ee-9ce2-35a784c01695
d17ff6e1-f5bf-11ee-9ce2-35a784c01695 As can be seen, the "-f5bf-11ee-9ce2-35a784c01695" part stays the same all the time. The changeable part is simply a 16-bit hexadecimal representation of sequence 3514824410 - 3514824417. It is a superficial example as production values are usually generated with more significant gaps in time in between, so the timestamp-related part is also changed. 60-bit timestamp part also means that a more significant part of the identifier is visually changed over a larger sample of IDs. The core point stays the same: UUIDv1 is easily guessed, however random-looking it initially appears. Take just the first and last values from the given list of 8 ids. As identifiers are generated strictly, consequently, it is clear there are only 6 IDs generated between the given two (by subtracting hexadecimal changeable parts), and their values can also be definitively found. Extrapolation of such logic is the underlying part behind the so-called Sandwich attack aiming to brute-force UUID from knowing these two border values. Attack flow is straightforward: the user generates UUID A before the target UUID generation occurs and UUID B right after. Assuming the same device with a static 48-bit MAC part is responsible for all three generations, it sets a user with a sequence of potential IDs between A and B, where the target UUID is located. Depending on the time proximity between generated IDs to target, the range can be in volumes accessible to brute-force approach: check every possible UUID to find existing ones among empty. In API requests with the password recovery endpoint described previously, it translates to sending hundreds or thousands of requests with consequent UUIDs until a response stating the existing URL is found. With password reset, it leads to a setup where the user can generate recovery links on two accounts they control as closely as possible to press the recovery button on the target account they have no access to but only knows email/login. Letters to controlled accounts with recovery UUIDs A and B are then known, and the target link to recover the password for the target account can be brute-forced without having access to the actual reset email. Vulnerability originates from the concept of relying solely on UUIDv1 for user authentication. By sending a recovery link that grants access to resetting passwords, it is thus assumed that by following the link, a user is authenticated as the one who was supposed to receive the link. This is the part where the authentication rule fails due to UUIDv1 being exposed to straightforward brute force in the same way as if someone`s door could be opened by knowing what the keys of both their neighbor doors look like. Cryptographically insecure functions The first version of UUID is mainly considered legacy partly because generation logic only uses a smaller portion of identifier size as a randomized value. Other versions, like v4, try to solve this issue by keeping as little space as possible for versioning and leaving up to 122 bits to be random payload. In general, it brings total possible variations to a whooping , which for now is considered to satisfy the "enough" part regarding identifier uniqueness requirement and thus fulfill security standards. Opening for brute-force vulnerability might appear if generation implementation somehow significantly diminishes the bits left for the random part. But with no production tools or libraries, should that be the case? 2^122 Let's indulge in cryptography a bit and take a close look at JavaScript's common implementation of UUID generation. Here is function relying on module for pseudo-random number generation: randomUUID() math.random Math.floor(Math.random()*0x10); And the random function itself, for short it is just the part of interest for the topic in this article: hi = 36969 * (hi & 0xFFFF) + (hi >> 16);

lo = 18273 * (lo & 0xFFFF) + (lo >> 16);

return ((hi << 16) + (lo & 0xFFFF)) / Math.pow(2, 32); Pseudo-random generation requires seed value as a base to perform mathematical operations on top of it to produce sequences of random enough numbers. Such functions are solely based on it, meaning that if they are reinitialized with the same seed as before, the output sequence is going to match. The seed value in the JavaScript function in question comprises variables hi and lo, each a 32-bit unsigned integer (0 through 4294967295 decimal). A combination of both is needed for cryptographic purposes, making it close to impossible to definitively reverse the two initial values by knowing their multiple, as it relies on the complexity of integer factorization with large numbers. Two 32-bit integers together bring possible cases for guessing hi and lo variables behind the initialized function producing UUIDs. If hi and lo values are somehow known, it takes no effort to duplicate the generation function and know all the values it produces and will produce in the future due to seed value exposure. However, 64 bits in security standards can be considered intolerant to brute-force in a measurable time period for it to make sense. As always, the issue comes from specific implementation. takes various 16 bits from each of hi and lo into 32-bit results; however, on top of it shifts the value once again due to operation, and the only meaningful part all of a sudden now comes exclusively from hi. It does not affect generation in any way but causes cryptography approaches to fall apart as it only leaves possible combinations for the entire generation function seed (there is no need to brute-force both hi and lo as lo can be set to any value and does not influence the output). 2^64 Math.random() randomUUID() .floor() 2^32 Brute-force flow consists of acquiring a single ID and testing possible high values that could have generated it. With some optimization and average laptop hardware, it can take just a couple of minutes and does not require sending lots of requests to the server as in the Sandwich attack but rather performs all operations offline. The result of such an approach causes replication of the generation function state used in the backend to get all created and future reset links in the password recovery example. Steps to prevent vulnerability from emerging are straightforward and shout out for the use of cryptographically secure functions, e.g. . crypto.randomUUID() Takeaways UUID is a great concept and makes the lives of data engineers a lot easier in many application areas. However, it should never be used in relation to authentication, as in this article, flaws in certain cases of its generation techniques are brought to light. It obviously does not translate to the idea of all UUIDs being insecure. The basic approach, though, is to persuade people not to use them for security at all, which is more efficient and, well, secure than setting complex limits in documentation on which to use or how not to generate them for such purpose.

Never Rely on UUID for Authentication: Generation Vulnerabilities and Best Practices

প্রমাণীকরণের জন্য কখনই UUID-এর উপর নির্ভর করবেন না: প্রজন্মের দুর্বলতা এবং সর্বোত্তম অনুশীলন

Verlassen Sie sich bei der Authentifizierung niemals auf UUID: Generierungsschwachstellen und Best Practices

Nunca confíe en UUID para la autenticación: vulnerabilidades de generación y mejores prácticas

Ne vous fiez jamais à l'UUID pour l'authentification : vulnérabilités de génération et meilleures pratiques

प्रमाणीकरण के लिए कभी भी UUID पर निर्भर न रहें: उत्पन्न होने वाली कमज़ोरियाँ और सर्वोत्तम अभ्यास

認証に UUID を決して使用しないでください: 生成の脆弱性とベスト プラクティス

인증을 위해 UUID에 의존하지 마십시오: 생성 취약점 및 모범 사례

Nunca confie no UUID para autenticação: vulnerabilidades de geração e práticas recomendadas

Никогда не полагайтесь на UUID для аутентификации: уязвимости поколений и лучшие практики

Kimlik Doğrulama için Asla UUID'ye Güvenmeyin: Güvenlik Açıkları Oluşturma ve En İyi Uygulamalar

Không bao giờ dựa vào UUID để xác thực: Các lỗ hổng thế hệ và các phương pháp hay nhất

永远不要依赖 UUID 进行身份验证：生成漏洞和最佳实践

Customizing Dashboards: Building a Custom Extensions Engine for Your Apps

Stack: Older developers and engineers might remember the LAMP stack💡  and although it’s reengineered, if we strip down everything to the basics what we find and need is: an operating system


a web server


a database


a programming language What I’m going to talk to you today is how I reimagined the LAMP stack in an alternative format: Linux
Apache
MySql
Php
to:
Ubuntu
Apache
Sqlite3
Python What Does It Take? Nowadays, all that I hear all too often is: “I want to become a developer how do I get started?”, “I want to become a developer what laptop do I need?” or “Do I need to buy the latest MacBook to become a developer?” and to be honest, it’s starting to get to me. No kids, you don’t need the latest fancy tech or a rocket🚀 to become a developer, what you need is an operating system that is capable of installing programming packages and can compile them; you can even use your grandma’s old laptop. And now you ask: “How can this be?!” Let’s take a short trip down memory lane; almost 3 and a half years ago, I started tinkering with an SBC - single board computer that starts at under 50E to buy, and on it right now, I have a web server, a database, am performing hundreds of web-scrapes per hour, and on top of it, I’m working on developing an API endpoint. This SBC is not even the latest in its range and has: 8GB of LPDDR4  internal memory


1.5GHz quad-core ARM Cortex-A72 CPU (launched in 2015) - that you can easily and safely overclock at 2GHz (+fan extension & heatsink) Here’s what GPT has to say about these specs:
The specifications you provided are decent for certain types of computing tasks, but they may not be sufficient for others. Here's an evaluation: 8GB LPDDR4 internal memory:
LPDDR4 is a relatively fast and power-efficient type of RAM commonly used in mobile devices and some laptops.
8GB is a moderate amount of memory that should be sufficient for everyday tasks like web browsing, office work, and light multitasking. It can also handle moderate gaming and content creation applications.
However, for more demanding tasks like video editing, graphic design, or running virtual machines, 8GB may be limiting, and you might experience performance bottlenecks.
1.5GHz Quad-Core ARM Cortex-A72 CPU:


The ARM Cortex-A72 is a capable processor design commonly found in smartphones, tablets, and other mobile devices.


A quad-core configuration means it has four cores, allowing it to handle multiple tasks simultaneously more efficiently.


The 1.5GHz clock speed is decent for general-purpose computing tasks, including web browsing, media consumption, and productivity applications.


However, for more demanding tasks such as gaming, video editing, or running complex software, a higher clock speed and possibly more cores would provide better performance.
In summary, these specifications are suitable for light to moderate computing tasks, such as everyday productivity, web browsing, and multimedia consumption. However, for more demanding tasks or future-proofing, you may want to consider upgrading to a system with more RAM and a faster CPU. Trust me, in the beginning, light to moderate is more than sufficient, so with a Pi board, you can easily have a working desktop environment in which you can learn how to code, and not only frontend but even backend programming languages such as Python, c++ (which is even more energy efficient), or javascript. What do I use? On my Raspberry Pi, I am developing code with: Ubuntu Desktop - courtesy of desktopify:

Which I had to secure and in doing so I learned about:


web server vulnerabilities


firewalls


antivirus


intrusion prevention software IPS


networking


DNS


strong password management


ssh keys


SSL certificates






VSCode remotely connecting to the server


Python3 scripts which scrape the web and build HTML webpages embodied by CSS


requests


selenium


pandas


parallel processing - concurrent.futures




Javascript coupled with PHP here and there.


Python3 scripts that automatically write in my Sqlite3 database in JSON format.


Flask app, a small and lightweight Python web framework that provides useful tools and features that make creating web applications in Python.


And lastly, a Javascript piece of code that calls the Flask endpoint - a RESTful API endpoint
For close to 4 years at a definitely amortized cost of 120E and < 4E per month in electricity🔌. To summarize everything, here’s the BerryNews system architecture: The key factors here are Efficient Resource Utilization + Resource Utilization Constraints. Why splurge when you can write efficient code? Conclusion: If we were to sum up everything, we’d end up with a table such as this on a 100-dollar computer: Category

Keywords



Programming languages

Python3, Javascript, PHP, CSS, HTML, SQL



Data formats

JSON



Frameworks

flask, selenium, concurrent.futures



Databases

sqlite3



Networking

router config, DNS



Cybersecurity

UFW (firewall), ClamAV (antivirus), Fail2ban (IPS), password management, SSH Keys, Let’s Encrypt (SSL certificate)



Linux

Raspberry Pi, Ubuntu Desktop, VSCode So, tell me, do you still think you need the latest laptop specs to become a developer? Stack: Stack: Older developers and engineers might remember the LAMP stack💡  and although it’s reengineered, if we strip down everything to the basics what we find and need is: strip down everything to basics an operating system a web server a database a programming language an operating system an operating system a web server a web server a database a database a programming language a programming language What I’m going to talk to you today is how I reimagined the LAMP stack in an alternative format : the LAMP stack in an alternative format Linux Apache MySql Php
to: Ubuntu Apache Sqlite3 Python Linux Apache MySql Php to: to: Ubuntu Apache Sqlite3 Python What Does It Take? What Does It Take? Nowadays, all that I hear all too often is: “I want to become a developer how do I get started?”, “I want to become a developer what laptop do I need?” or “Do I need to buy the latest MacBook to become a developer?” and to be honest, it’s starting to get to me. No kids , you don’t need the latest fancy tech or a rocket🚀 to become a developer, what you need is an operating system that is capable of installing programming packages and can compile them; you can even use your grandma’s old laptop. And now you ask: “How can this be?!” No kids Let’s take a short trip down memory lane; almost 3 and a half years ago, I started tinkering with an SBC - single board compute r that starts at under 50E to buy, and on it right now, I have a web server, a database, am performing hundreds of web-scrapes per hour, and on top of it, I’m working on developing an API endpoint. SBC single board compute This SBC is not even the latest in its range and has: SBC 8GB of LPDDR4  internal memory 1.5GHz quad-core ARM Cortex-A72 CPU (launched in 2015) - that you can easily and safely overclock at 2GHz (+fan extension & heatsink) 8GB of LPDDR4  internal memory 8GB of LPDDR4  internal memory 1.5GHz quad-core ARM Cortex-A72 CPU (launched in 2015) - that you can easily and safely overclock at 2GHz (+fan extension & heatsink) 1.5GHz quad-core ARM Cortex-A72 CPU (launched in 2015) - that you can easily and safely overclock at 2GHz (+fan extension & heatsink) Here’s what GPT has to say about these specs:
The specifications you provided are decent for certain types of computing tasks, but they may not be sufficient for others. Here's an evaluation: 8GB LPDDR4 internal memory: LPDDR4 is a relatively fast and power-efficient type of RAM commonly used in mobile devices and some laptops. 8GB is a moderate amount of memory that should be sufficient for everyday tasks like web browsing, office work, and light multitasking. It can also handle moderate gaming and content creation applications. However, for more demanding tasks like video editing, graphic design, or running virtual machines, 8GB may be limiting, and you might experience performance bottlenecks. 1.5GHz Quad-Core ARM Cortex-A72 CPU:


The ARM Cortex-A72 is a capable processor design commonly found in smartphones, tablets, and other mobile devices.


A quad-core configuration means it has four cores, allowing it to handle multiple tasks simultaneously more efficiently.


The 1.5GHz clock speed is decent for general-purpose computing tasks, including web browsing, media consumption, and productivity applications.


However, for more demanding tasks such as gaming, video editing, or running complex software, a higher clock speed and possibly more cores would provide better performance.
In summary, these specifications are suitable for light to moderate computing tasks, such as everyday productivity, web browsing, and multimedia consumption. However, for more demanding tasks or future-proofing, you may want to consider upgrading to a system with more RAM and a faster CPU. 8GB LPDDR4 internal memory: LPDDR4 is a relatively fast and power-efficient type of RAM commonly used in mobile devices and some laptops. 8GB is a moderate amount of memory that should be sufficient for everyday tasks like web browsing, office work, and light multitasking. It can also handle moderate gaming and content creation applications. However, for more demanding tasks like video editing, graphic design, or running virtual machines, 8GB may be limiting, and you might experience performance bottlenecks. 1.5GHz Quad-Core ARM Cortex-A72 CPU: The ARM Cortex-A72 is a capable processor design commonly found in smartphones, tablets, and other mobile devices.


A quad-core configuration means it has four cores, allowing it to handle multiple tasks simultaneously more efficiently.


The 1.5GHz clock speed is decent for general-purpose computing tasks, including web browsing, media consumption, and productivity applications.


However, for more demanding tasks such as gaming, video editing, or running complex software, a higher clock speed and possibly more cores would provide better performance.
In summary, these specifications are suitable for light to moderate computing tasks, such as everyday productivity, web browsing, and multimedia consumption. However, for more demanding tasks or future-proofing, you may want to consider upgrading to a system with more RAM and a faster CPU. The ARM Cortex-A72 is a capable processor design commonly found in smartphones, tablets, and other mobile devices. A quad-core configuration means it has four cores, allowing it to handle multiple tasks simultaneously more efficiently. The 1.5GHz clock speed is decent for general-purpose computing tasks, including web browsing, media consumption, and productivity applications. However, for more demanding tasks such as gaming, video editing, or running complex software, a higher clock speed and possibly more cores would provide better performance.
In summary, these specifications are suitable for light to moderate computing tasks, such as everyday productivity, web browsing, and multimedia consumption. However, for more demanding tasks or future-proofing, you may want to consider upgrading to a system with more RAM and a faster CPU. The ARM Cortex-A72 is a capable processor design commonly found in smartphones, tablets, and other mobile devices. The ARM Cortex-A72 is a capable processor design commonly found in smartphones, tablets, and other mobile devices. A quad-core configuration means it has four cores, allowing it to handle multiple tasks simultaneously more efficiently. A quad-core configuration means it has four cores, allowing it to handle multiple tasks simultaneously more efficiently. The 1.5GHz clock speed is decent for general-purpose computing tasks, including web browsing, media consumption, and productivity applications. The 1.5GHz clock speed is decent for general-purpose computing tasks, including web browsing, media consumption, and productivity applications. However, for more demanding tasks such as gaming, video editing, or running complex software, a higher clock speed and possibly more cores would provide better performance.
In summary, these specifications are suitable for light to moderate computing tasks, such as everyday productivity, web browsing, and multimedia consumption. However, for more demanding tasks or future-proofing, you may want to consider upgrading to a system with more RAM and a faster CPU. However, for more demanding tasks such as gaming, video editing, or running complex software, a higher clock speed and possibly more cores would provide better performance.
In summary, these specifications are suitable for light to moderate computing tasks, such as everyday productivity, web browsing, and multimedia consumption. However, for more demanding tasks or future-proofing, you may want to consider upgrading to a system with more RAM and a faster CPU. Trust me, in the beginning, light to moderate is more than sufficient, so with a Pi board, you can easily have a working desktop environment in which you can learn how to code, and not only frontend but even backend programming languages such as Python, c++ (which is even more energy efficient), or javascript. desktop What do I use? What do I use? On my Raspberry Pi, I am developing code with: Ubuntu Desktop - courtesy of desktopify:

Which I had to secure and in doing so I learned about:


web server vulnerabilities


firewalls


antivirus


intrusion prevention software IPS


networking


DNS


strong password management


ssh keys


SSL certificates VSCode remotely connecting to the server Python3 scripts which scrape the web and build HTML webpages embodied by CSS


requests


selenium


pandas


parallel processing - concurrent.futures Javascript coupled with PHP here and there. Python3 scripts that automatically write in my Sqlite3 database in JSON format. Flask app, a small and lightweight Python web framework that provides useful tools and features that make creating web applications in Python. And lastly, a Javascript piece of code that calls the Flask endpoint - a RESTful API endpoint
For close to 4 years at a definitely amortized cost of 120E and < 4E per month in electricity🔌. Ubuntu Desktop - courtesy of desktopify: Which I had to secure and in doing so I learned about:


web server vulnerabilities


firewalls


antivirus


intrusion prevention software IPS


networking


DNS


strong password management


ssh keys


SSL certificates Ubuntu Desktop - courtesy of desktopify : Ubuntu desktopify Which I had to secure and in doing so I learned about:


web server vulnerabilities


firewalls


antivirus


intrusion prevention software IPS


networking


DNS


strong password management


ssh keys


SSL certificates Which I had to secure and in doing so I learned about: web server vulnerabilities


firewalls


antivirus


intrusion prevention software IPS


networking


DNS


strong password management


ssh keys


SSL certificates secure web server vulnerabilities firewalls antivirus intrusion prevention software IPS networking DNS strong password management ssh keys SSL certificates web server vulnerabilities web server vulnerabilities web server vulnerabilities firewalls firewalls antivirus antivirus intrusion prevention software IPS intrusion prevention software IPS networking networking DNS DNS DNS strong password management strong password management ssh keys ssh keys ssh keys SSL certificates SSL certificates SSL certificates VSCode remotely connecting to the server VSCode remotely connecting to the server Python3 scripts which scrape the web and build HTML webpages embodied by CSS requests


selenium


pandas


parallel processing - concurrent.futures Python3 scripts which scrape the web and build HTML webpages embodied by CSS Python3 HTML CSS requests selenium pandas parallel processing - concurrent.futures requests requests selenium selenium pandas pandas parallel processing - concurrent.futures parallel processing - concurrent.futures Javascript coupled with PHP here and there. Javascript coupled with PHP here and there. Javascript PHP Python3 scripts that automatically write in my Sqlite3 database in JSON format. Python3 scripts that automatically write in my Sqlite3 database in JSON format. Sqlite3 JSON Flask app, a small and lightweight Python web framework that provides useful tools and features that make creating web applications in Python. Flask app, a small and lightweight Python web framework that provides useful tools and features that make creating web applications in Python. Flask web framework And lastly, a Javascript piece of code that calls the Flask endpoint - a RESTful API endpoint For close to 4 years at a definitely amortized cost of 120E and < 4E per month in electricity🔌. And lastly, a Javascript piece of code that calls the Flask endpoint - a RESTful API endpoint endpoint RESTful For close to 4 years at a definitely amortized cost of 120E and < 4E per month in electricity🔌. To summarize everything, here’s the BerryNews system architecture: The key factors here are Efficient Resource Utilization + Resource Utilization Constraints . Efficient Resource Utilization Resource Utilization Constraints Why splurge when you can write efficient code? Conclusion: If we were to sum up everything, we’d end up with a table such as this on a 100-dollar computer: Category

Keywords



Programming languages

Python3, Javascript, PHP, CSS, HTML, SQL



Data formats

JSON



Frameworks

flask, selenium, concurrent.futures



Databases

sqlite3



Networking

router config, DNS



Cybersecurity

UFW (firewall), ClamAV (antivirus), Fail2ban (IPS), password management, SSH Keys, Let’s Encrypt (SSL certificate)



Linux

Raspberry Pi, Ubuntu Desktop, VSCode Category

Keywords Programming languages

Python3, Javascript, PHP, CSS, HTML, SQL Data formats

JSON Frameworks

flask, selenium, concurrent.futures Databases

sqlite3 Networking

router config, DNS Cybersecurity

UFW (firewall), ClamAV (antivirus), Fail2ban (IPS), password management, SSH Keys, Let’s Encrypt (SSL certificate) Linux

Raspberry Pi, Ubuntu Desktop, VSCode Category Keywords Category Category Category Keywords Keywords Keywords Programming languages Python3, Javascript, PHP, CSS, HTML, SQL Programming languages Programming languages Python3, Javascript, PHP, CSS, HTML, SQL Python3, Javascript, PHP, CSS, HTML, SQL Data formats JSON Data formats Data formats JSON JSON Frameworks flask, selenium, concurrent.futures Frameworks Frameworks flask, selenium, concurrent.futures flask, selenium, concurrent.futures Databases sqlite3 Databases Databases sqlite3 sqlite3 Networking router config, DNS Networking Networking router config, DNS router config, DNS Cybersecurity UFW (firewall), ClamAV (antivirus), Fail2ban (IPS), password management, SSH Keys, Let’s Encrypt (SSL certificate) Cybersecurity Cybersecurity UFW (firewall), ClamAV (antivirus), Fail2ban (IPS), password management, SSH Keys, Let’s Encrypt (SSL certificate) UFW ( firewall ), ClamAV ( antivirus ), Fail2ban ( IPS ), password management, SSH Keys, Let’s Encrypt ( SSL certificate ) firewall antivirus IPS SSL certificate Linux Raspberry Pi, Ubuntu Desktop, VSCode Linux Linux Raspberry Pi, Ubuntu Desktop, VSCode Raspberry Pi, Ubuntu Desktop, VSCode So, tell me, do you still think you need the latest laptop specs to become a developer? So, tell me, do you still think you need the latest laptop specs to become a developer?

RaspberryPi: Technology Overload - LAMP🕯 to UASP🐝

রাস্পবেরিপি: প্রযুক্তি ওভারলোড - LAMP🕯 থেকে UASP🐝

RaspberryPi: Technologie-Überlastung – LAMP🕯 zu UASP🐝

RaspberryPi: Sobrecarga tecnológica: LAMP🕯 a UASP🐝

RaspberryPi : surcharge technologique - LAMP🕯 vers UASP🐝

रास्पबेरीपाई: प्रौद्योगिकी अधिभार - LAMP🕯 से UASP🐝 तक

RaspberryPi: テクノロジーの過剰 - LAMP🕯からUASP🐝まで

RaspberryPi: 기술 과부하 - LAMP🕯에서 UASP🐝까지

RaspberryPi: sobrecarga de tecnologia - LAMP🕯 para UASP🐝

RaspberryPi: технологическая перегрузка — от LAMP🕯 до UASP🐝

RaspberryPi: Aşırı Teknoloji Yükü - LAMP🕯'den UASP🐝'ye

RaspberryPi: Quá tải công nghệ - LAMP🕯 đến UASP🐝

RaspberryPi：技术超载 - 从 LAMP🕯 到 UASP🐝

Portfolio Management: All The Ways AI Is Transforming Modern Asset Strategies

পোর্টফোলিও ম্যানেজমেন্ট: সমস্ত উপায় এআই আধুনিক সম্পদ কৌশলগুলিকে রূপান্তরিত করছে

Portfoliomanagement: Wie KI moderne Anlagestrategien verändert

Gestión de carteras: todas las formas en que la IA está transformando las estrategias de activos modernas

Gestion de portefeuille : toutes les façons dont l'IA transforme les stratégies d'actifs modernes

पोर्टफोलियो प्रबंधन: वे सभी तरीके जिनसे AI आधुनिक परिसंपत्ति रणनीतियों को बदल रहा है

ポートフォリオ管理: AI が現代の資産戦略をどのように変革しているか

포트폴리오 관리: AI가 현대 자산 전략을 변화시키는 모든 방법

Gerenciamento de portfólio: todas as maneiras pelas quais a IA está transformando as estratégias modernas de ativos

Управление портфелем: все способы, которыми ИИ трансформирует современные стратегии управления активами

Portföy Yönetimi: Yapay Zekanın Modern Varlık Stratejilerini Dönüştürdüğü Tüm Yollar

Quản lý danh mục đầu tư: Tất cả các cách AI đang chuyển đổi các chiến lược tài sản hiện đại

投资组合管理：人工智能正在改变现代资产战略

Why Humans Are Drawn to Games

কেন মানুষ গেমের প্রতি আকৃষ্ট হয়

Warum Menschen sich zu Spielen hingezogen fühlen

Por qué los humanos se sienten atraídos por los juegos

Pourquoi les humains sont attirés par les jeux

मनुष्य खेलों की ओर क्यों आकर्षित होते हैं?

Stories, News & Mentions about NOWADAYS

Nowadays’s Stories on HackerNoon