Reposite is the all-in-one workspace built for travel and events professionals – Manage relationships, track proposals, discover new suppliers \u0026 grow your business

Reposite

reposite

Long story short: is a template engine changing documents on static webpages, that you can then host anywyere, because you don't need databases or server that has PHP or Python. Jekyll markdown HTML Usual Process Normally the process of adding new post looks like this: I write markdown document with setting parameters like title, date and tags when I’m happy with what I wrote (never), I commit changes and push it to repository on GitHub. Repository name comes from my nick and is also address for blog asvid.github.io Github after pushing to branch master builds website from sources using Jekyll - probably something like running jekyll build result of Jekyll build is not present in a repository, but you see it right now after visiting bloga page The above process works entirely automatically, no need of configuration on repo site or GitHub itself. All you need is having repo name that follows this pattern: . Normally it works. But... {user_name}.github.io I want plugins Sometimes you want to add something cool to your page. I wanted to have it in multiple languages, like Polish and English. Jekyll is not supporting this natively… but it is not impossible 😄 So I’ve found a plugin , that allows adding many languages on same page without need of complete rebuild or restructure. I used it, after a while it was kinda working. After a while longer it was working as I wanted. . Polyglot Locally After pushing changes to GitHub page wasn’t working properly. I learned that GitHub is not simply building everything you throw at it, but it has a of supported plugins. Polyglot is sadly not on this list, despite its creator's attempts to get it on the list. Whitelist itself is understandable for security reasons, we don’t want to GitHub go down because of some evil plugin or hidden bitcoin miner running on GitHub servers. whitelist But I really need this plugin Like every problem this one also has a solution. Even few of them. You can build the page locally and push it to the branch, and keep source on other branch like . There is also , that publishes NodeJS apps as GitHub Pages. master develop NodeJS package But I’m lazy and I don’t want to build manually and push sources and build result separately, also I don’t have NodeJS app, so I use solution number 3. GitHub Actions is a basic CI available for free for every repository. To use this CI you need to create Workflow with yaml configuration telling it what and when should happen. There are , and if  something is missing, you can do one yourself or combine few into one workflow. To add workflow go to your . GitHub Actions many available actions repository->actions->New workflow and then click link to set up a workflow yourself. This will add yaml file with config inside repository in directory .github/workflows To publish Jekyll blog with not whitelisted plugins I used configured inside workflow like this: Jekyll-Actions name: GitHub Pages publication on: push jobs: jekyll: runs-on: ubuntu-16.04 steps: - uses: actions/checkout@v2 # Use GitHub Actions' cache to shorten build times and decrease load on servers - uses: actions/cache@v1 with: path: vendor/bundle key: $-gems-$ restore-keys: |
          $-gems-
    # Standard usage - uses: helaili/jekyll-action@2.0.3 env: JEKYLL_PAT: $ # Specify the Jekyll source location as a parameter - uses: helaili/jekyll-action@2.0.3 env: JEKYLL_PAT: $ This action runs inside container, and then: ubuntu-16.04 downloads repository after each push (on every branch which is causing some issue) is using cache to not download same each run Gems runs action to build page and publish ot on branch , with a push that is possible thanks to master secrets.JEKYLL_PAT And this publishing on branch master means that you shouldn't push source changes to this branch. If you want to use this action, you need to push changes to develop and leave master only for files build and pushed by the script. How to create secret.JEKYLL_PAT Action itself works in isolated container and has no write access to your repository. It can read it because its public. To allow this, you need to create access token with public_repo scope, and then add it in repository as a secret with name expected by configuration . secret.JEKYLL_PAT You generate token from GitHub account settings: . After clicking on Generate new token fill the name and select checkbox public_repo. Settings->Developer Settings->Personal Access Tokens After clicking button on the bottom Generate token you will have the only chance to copy it, I suggest taking it 😃 Copied token needs to be pasted to repository secrets: . Name like in config and value is copied token. Settings->Secrets->New secret secrets.JEKYLL_PAT And it should work. At least works for me 😏 This article was also posted on Jekyll blog hosted on GitHub, with the use of free . Github Pages Previously published at https://asvid.github.io/github-page-deployment

A Simple Guide to Github Page Deployment

I think i have finally managed to put the finger on what is really bugging me with most ICOs and why they are not the value creator most people think they are. Bear with me in the analysis. First there was the token Any Blockchain Dapp starts with a , the economic unit that enables this app to work and gives enough incentives to everyone to build and/or use a given service. Token Tokens illustrate the dynamics of a decentralized network effect. But there is a chicken and egg problem: how do you get a token to get enough value to get the network going when your App is just getting started? Blockchain entrepreneurs have found the solution to that insanely complex problem the web has known for 3 decades: ICO The promise of the network effect By selling a dream project, a white paper, a nice github repositery, a fantastic team of uninvolved advisors and some hype, tokens are priced immediately and can be acquired very early on in the life of a project giving you a chance to own a % of the economy of this future project (as opposed to stock which gives you a chance to own a % of the future cash flow and value of the company). ICOs open the door to boostrapping the network effect when there is not even a product yet to create this network. It’s a 2-in-1 you get a community of “interest” a la kickstarter and you get S** load of money without dilution giving instant economic value to your token. All that is great. Except it’s not. In the current format, ICOs provide early on tokens a value, but also allow any token buyers to sell their token immediately. That translates in a market of super speculative activity around the value of the token, since there is no basic network effect metric to support the value (except in rare cases, read below) 95% of the value of a token is based on speculation today. The reason this is not great, is not because of the speculation in itself but because the first token are not token . Holders (or as we like to call it) are interested in holding the token long enough until the network value has taken over the speculative value. buyers holders Hodlers Imagine backing a kickstarter project. The pool of contribution is closing. The company is good to go with the project. But for some reason at this moment: every early backer start claiming their money back or cancel their product delivery even if the money is not moving back to their pocket. The contributors are not interested in the project Tokens, when put on the market early to trade without real network value to be built in the medium term, create, by design, a different set of incentives for the token buyers, interested in a fast trade and the token holders (those who really believe in the project and want to support it all the way) and eventually even the token producers (the company). If you raised a bunch of money in an ICO but your token is worth very little then you re going to have a hard time to give incentives to your network (not mentioning giving the appearance of value to your economy) Token ownership map You have different type of token owners : they get their share of tokens in the ICO but are locked up to a period that align them with the milestones of the network effect. Those are rarely putting the token value at risk The team : typically crypto funds that will back ICOs early on, or pre ICOs, those will usually align very well with group 1. Funds like Polychain, Pantera, DCG, Metastable or even hedge funds like Blocktower could be put in that group. The institutional buyers : this is where the risk is here. There is a vast amount of people here that are bounty hunters and some are big enough (the ) to create a pump-and-dump scenario that will help the token value to gain high multiples in the first days of trade but will also cause it to crash quickly The public ICO buyers whales those are the rarest *today*. Those are the real users of the token in the token economy designed by the startup. They will be the group of people who probably did not participate in the ICO at first but will want to use the service and for this they will have to either earn or buy tokens available on the marketplace. For example in the prediction market /hedge fund service , the token user is likely a good science/math researcher who wants to apply his own model to predict the market and earn some NUMÉRAIRE (the token they reward scientist when their stock prediction is accurate) The token users: Numerai At this moment in way too many cases (the majority?) Token buyers and Token users are not the same. And can’t be by design until the product is built and start getting adopted. Some projects manage to align both Buyers and Users by not enabling the token to be traded immediately after the end of the ICO, waiting for the protocol to go live. A good example of that is TEZOS, which should go live in the next 3/4 months. To this day the token has not been distributed to token early buyers and the listing to marketplaces will happen near simultaneously to the production of the Tezos chain. Over time as the network effect and the economy takes over the speculative value of a token is getting reduced significantly and token buyer are more contributors to the economy either as holders or token users. The ideal user being a hybrid of buyer, holder and user. In some case you may already have a massive network at hand. You can leverage it and already prove your token “velocity” has value. But this would not happen if you prefer to go ICO first… One of the problems i had with Kik ICO for example, is that by design Token buyers of the ICO are not and cannot be Token Users. KIK average age group is 13/20 years old: not the typical ICO buyer. In Kik’s case the network is already up and running, there was no reason why Kik could not have boostrapped their token by giving it first to their users before going the ICO way. Instead there is a total disconnect between token owners and token users which to me is going to be a source of problem in their economy (which reflects already in their token being valued below the ICO price) Summary The major challenge of a blockchain project is to manage to find the right alignment between all the type of token owners. The ICO format as designed today, can only create unhealthy misalignment. You can fix those by delaying the trade of your token or, if you already own a network by proving the value of your token BEFORE the ICO. In any case, i don’t believe the ICO format as we know today we’ll continue. It’s a great experiment, and probably a necessary one. The next generation of ICOs will find better ways to align the interest of all token owners.

Token buyers, Token holders and Token users

The New York Times Company v. OpenAI Update Court Filing, retrieved on February 26, 2024 is part of . You can jump to any part in this filing . This part is 3 of 15. HackerNoon’s Legal PDF Series here B. The Key to Generalist Language Models: Scale So OpenAI’s research took the logical next step: “scaling up [] model size” by increasing both the “size” and “diversity” of the training data. See GPT-3 Paper at 6. To build its next generation of models, OpenAI’s researchers gathered a more robust set of data in part by “expand[ing]” WebText database into a new version called “WebText2,” which included material shared over a longer period of time. Id. at 8–9. They also used a filtered version of Common Crawl, a repository of data collected by a non-profit research organization representing “a copy of the Internet.” Compl. ¶ 88. OpenAI disclosed all of this no later than July 22, 2020. GPT-3 Paper at 8. At the time, it was common knowledge that WebText2 and Common Crawl included numerous articles published by the Times.[19] The result of this simple act of “scaling up” the training data was, as the Times reported at the time, “mind blowing.”[20] The new GPT-3 model was “by far the most powerful ‘language model’ ever created.” Manjoo, supra note 20. It could conduct “on-the-fly reasoning” and “unscrambl[e] words, perform[] arithmetic, and us[e] novel words in a sentence after seeing them defined only once.” GPT-3 Paper at 5. Increasing the scale of training led to a surprising jump in ability. See, e.g., id. at 22 (Figure 3.10). According to the Times’s reporting, GPT-3 showed that “[m]achines are gaining the ability to write.” Manjoo, supra note 20. Within days, developers began to use it to build unprecedented tools. Id. (“service that responds to email on your behalf”). The “key advance,” as the Times reported, was “GPT-3’s flexibility.” Id. And the reason it was flexible was OpenAI’s decision to “scal[e] up” the “size” of the training data. GPT-3 Paper at 6. The amount of data needed was staggering. Compl. ¶ 85. But it was that “unprecedented scale” that allowed the model to internalize not only a “map of human language,” but achieve a level of adaptability—and “emergent” intelligence—that “no one thought possible.”[21] Continue Reading . Here [19] Compl. ¶ 88 (citing a “2019 snapshot of Common Crawl”); GPT-2 Model Card (noting prevalence of Times content in WebText); GPT-3 Paper at 8 (noting WebText2 is an “expanded version of the WebText dataset”). [20] Farhad Manjoo, How Do You Know a Human Wrote This?, N.Y. Times (July 29, 2020), https://www.nytimes.com/2020/07/29/opinion/gpt-3-ai-automation.html. The Court may take judicial notice of this and other news articles cited in this Motion. In re UBS Auction Rate Sec. Litig., No. 08-cv-2967, 2010 WL 2541166, at *10-12 (S.D.N.Y. June 10, 2010) (judicial notice of “several news items” including Wall Street Journal articles). [21] Cade Metz, Meet GPT-3. It Has Learned to Code (and Blog and Argue), N.Y. Times (Nov. 24, 2020), https://www.nytimes.com/2020/11/24/science/artificial-intelligence-ai-gpt3.html. About HackerNoon Legal PDF Series: We bring you the most important technical and insightful public domain court case filings. This court case retrieved on February 26, 2024, from is part of the public domain. The court-created documents are works of the federal government, and under copyright law, are automatically placed in the public domain and may be shared without legal restriction. fingfx.thomsonreuters.com

ChatGPT's Predecessor Was Trained on 'Filtered' Internet Data from an Open Source Repository

This paper is under CC 4.0 license. available on arxiv Authors: (1) Mounika Vanamala, Department of Computer Science, University of Wisconsin-Eau Claire, United States; (2) Keith Bryant, Department of Computer Science, University of Wisconsin-Eau Claire, United States; (3) Alex Caravella, Department of Computer Science, University of Wisconsin-Eau Claire, United States. Table of Links Abstract & Introduction Discussions Conclusions, Acknowledgment, and References Conclusion Upon recognizing the significance of cyber security vulnerability controls during the software requirement phase, the CAPEC software vulnerability repository emerged as the most practical repository for this study. The arrangement of attack patterns thus facilitates precise identification and seamless referral back to CAPEC for recommended defense strategies. We define and elaborate on topic modeling, as well as unsupervised and supervised ML methods, showcasing recent research instances and the applicability of these approaches. As our research continues, our efforts will involve the implementation of supervised machine learning. The CAPEC repository provides a prelabeled dataset, a valuable asset for training data set implementation. Supervised ML offers the added benefit of proficiently utilizing metrics to fine-tune the ML process, thus enabling thorough evaluation and process enhancement. A training set for the SRS document must either be crafted or located for supervised ML execution. Given the absence of a comparable research framework employing supervised ML, our future endeavors will assess and compare results stemming from Naïve Bayes and RF ML methodologies. Naïve Bayes showcases statistical prowess across both large and small data sets, making it suitable for the modest data set of SRS documents as well as the larger data set encompassing CAPEC Vulnerabilities. RF's capacity to counteract overfitting aligns well with the intricate data from CAPEC. The algorithm returning the most accurate recommendations for CAPEC attack patterns from an SRS document will be harnessed to deploy an automated tool for result processing and visualization. Acknowledgment Funding Information Author’s Contributions Acquisition of data and analysis and interpretation of data and content written. Keith Bryant and Alex Caravella: Conception and design of the article, intellectual content generation, critically reviewed the article. Keith Bryant, Alex Caravella, and Mounika Vanamala: Contribution to intellectual content ideation and reviewed the article along with the coordination for publication. Mounika Vanamala: Ethics This article is original and contains unpublished material. The corresponding author confirms that all of the other authors have read and approved the manuscript and that no ethical issues are involved. References Al-Sabahi, K., Zuping, Z., & Kang, Y. (2018). Latent semantic analysis approach for document summarization based on word embeddings. arXiv preprint arXiv:1807.02748. https://doi.org/10.3837/tiis.2019.01.015 Alyami, H., Nadeem, M., Alharbi, A., Alosaimi, W., Ansari, M. T. J., Pandey, D., ... & Khan, R. A. (2021). The evaluation of software security through quantum computing techniques: A durability perspective. Applied Sciences, 11(24), 11784. https://doi.org/10.3390/app112411784 Asim, M. N., Ghani, M. U., Ibrahim, M. A., Mahmood, W., Dengel, A., & Ahmed, S. (2021). Benchmarking performance of machine and deep learning-based methodologies for Urdu text document classification. Neural Computing and Applications, 33, 5437-5469. https://doi.org/10.1007/s00521-020-05321-8 Bedi, G. (2018). A guide to Text Classification (NLP) using SVM and Naive Bayes with Python. Medium, Nov. Bellaouar, S., Bellaouar, M. M., & Ghada, I. E. (2021, February). Topic modeling: Comparison of LSA and LDA on scientific publications. In 2021 4th International Conference on Data Storage and Data Engineering (pp. 59-64). https://doi.org/10.1145/3456146.3456156 CISA. (2021). c? | CISA. https://www.cisa.gov/uscert/ncas/tips/ST04-001 CVE. (2022). https://cve.mitre.org Delli, U., & Chang, S. (2018). Automated process monitoring in 3D printing using supervised machine learning. Procedia Manufacturing, 26, 865-870. https://doi.org/10.1016/j.promfg.2018.07.111 Guo, Y., & Li, J. (2021). Distributed Latent Dirichlet Allocation on Streams. ACM Transactions on Knowledge Discovery from Data (TKDD), 16(1), 1-20. https://doi.org/10.1145/3451528 Prasad, S. G., Badrinarayanan, M. K., & Sharmila, V. C. (2022). Efficacy and Security Effectiveness: Key Parameters in Evaluation of Network Security. International Journal of Performability Engineering, 18(4), 282. https://doi.org/10.23940/ijpe.22.04.p6.282288 IBM. (2019). What is machine learning? https://www.ibm.com/topics/machinelearning?lnk=fle Mallet, J., Pryor, L., Dave, R., Seliya, N., Vanamala, M., & Sowells-Boone, E. (2022, March). Hold on and swipe: A touch-movement based continuous authentication schema based on machine learning. In 2022 Asia Conference on Algorithms, Computing and Machine Learning (CACML) (pp. 442-447). IEEE. https://doi.org/10.1109/CACML55074.2022.00081 Kanakogi, K., Washizaki, H., Fukazawa, Y., Ogata, S., Okubo, T., Kato, T., ... & Yoshioka, N. (2022). Comparative Evaluation of NLP-Based Approaches for Linking CAPEC Attack Patterns from CVE Vulnerability Information. Applied Sciences, 12(7), 3400. https://doi.org/10.3390/app12073400 Kim, D., & Im, T. (2022). A Systematic Review of Virtual Reality-Based Education Research Using Latent Dirichlet Allocation: Focus on Topic Modeling Technique. Mobile Information Systems, 2022. https://doi.org/10.1155/2022/1201852 Krzeszewska, U., Poniszewska-Marańda, A., & Ochelska-Mierzejewska, J. (2022). Systematic comparison of vectorization methods in classification context. Applied Sciences, 12(10), 5119. https://doi.org/10.3390/app12105119 León-Paredes, G. A., Barbosa-Santillán, L. I., & SánchezEscobar, J. J. (2017). A heterogeneous system based on latent semantic analysis using GPU and multiCPU. Scientific Programming, 2017. https://doi.org/10.1155/2017/8131390 Livingston, F. (2005). Implementation of Breiman’s random forest machine learning algorithm. ECE591Q Machine Learning Journal Paper, 1-13. Macsai, D. 2012. The most important company you’ve never heard of. 1 Minute Read. Fast Company. https://www.fastcompany.com/3017927/30mitre McAllister, P., Zheng, H., Bond, R., & Moorhead, A. (2018). Combining deep residual neural network features with supervised machine learning algorithms to classify diverse food image datasets. Computers in Biology and Medicine, 95, 217-233. https://doi.org/10.1016/j.compbiomed.2018.02.008 Mounika, V., Yuan, X., & Bandaru, K. (2019, December). Analyzing CVE database using unsupervised topic modelling. In 2019 International Conference on Computational Science and Computational Intelligence (CSCI) (pp. 72-77). IEEE. https://doi.org/10.1109/CSCI49370.2019.00019 MITRE ATT&CK®. (2022). https://attack.mitre.org Mohamed, A. E. (2017). Comparative study of four supervised machine learning techniques for classification. International Journal of Applied, 7(2), 1-15. https://www.ijastnet.com/journal/index/859 NIST. (2022). About NIST. https://www.nist.gov/about-nist Prakash, A., Singh, N. K., & Saha, S. K. (2022). Automatic extraction of similar poetry for study of literary texts: An experiment on Hindi poetry. ETRI Journal, 44(3), 413-425. https://doi.org/10.4218/etrij.2019-0396 Rahman, A. S., Shamrat, F. J. M., Tasnim, Z., Roy, J., & Hossain, S. A. (2019). A comparative study on liver disease prediction using supervised machine learning algorithms. International Journal of Scientific & Technology Research, 8(11), 419-422. http://www.ijstr.org/final-print/nov2019/AComparative-Study-On-Liver-Disease-PredictionUsing-Supervised-Machine-LearningAlgorithms.pdf Rustam, F., A. Reshi, S. Mehmood, S. Ullah, B. On, W. Aslam and G. Choi. 2020. COVID-19 Future Forecasting Using Supervised Machine Learning Models. IEEE Access, pp: 101489-99. https://doi.org/10.1109/ACCESS.2020.2997311 Sanguri, K., Bhuyan, A., & Patra, S. (2020). A semantic similarity adjusted document co-citation analysis: a case of tourism supply chain. Scientometrics, 125(1), 233-269. https://doi.org/10.1007/s11192-020-03608-0 Schrider, D. R., & Kern, A. D. (2018). Supervised machine learning for population genetics: a new paradigm. Trends in Genetics, 34(4), 301-312. https://doi.org/10.1016/j.tig.2017.12.005 Shalev-Shwartz, S., & Ben-David, S. (2014). Understanding machine learning: From theory to algorithms. Cambridge university press. https://www.cs.huji.ac.il/~shais/UnderstandingMach ineLearning/ Sharma, C., Sharma, S., & Sakshi. (2022). Latent DIRICHLET allocation (LDA) based information modelling on BLOCKCHAIN technology: A review of trends and research patterns used in integration. Multimedia Tools and Applications, 81(25), 36805-36831. https://doi.org/10.1007/s11042-022-13500-z Siddiqui, N., Dave, R., Vanamala, M., & Seliya, N. (2022). Machine and deep learning applications to mouse dynamics for continuous user authentication. Machine Learning and Knowledge Extraction, 4(2), 502-518. https://doi.org/10.3390/make4020023 Sweeney, E. M., Vogelstein, J. T., Cuzzocreo, J. L., Calabresi, P. A., Reich, D. S., Crainiceanu, C. M., & Shinohara, R. T. (2014). A comparison of supervised machine learning algorithms and feature vectors for MS lesion segmentation using multimodal structural MRI. PloS One, 9(4), e95753. https://doi.org/10.1371/journal.pone.0095753 Uddin, S., Khan, A., Hossain, M. E., & Moni, M. A. (2019). Comparing different supervised machine learning algorithms for disease prediction. BMC Medical Informatics and Decision Making, 19(1), 1-16. https://doi.org/10.1186/s12911-019-1004-8 Ullah, F., Wang, J., Farhan, M., Jabbar, S., Naseer, M. K., & Asif, M. (2020). LSA based smart assessment methodology for SDN infrastructure in IoT environment. International Journal of Parallel Programming, 48, 162-177. https://doi.org/ 10.1007/s10766-018-0570-1 Ullah, F., Jabbar, S., & Mostarda, L. (2021). An intelligent decision support system for software plagiarism detection in academia. International Journal of Intelligent Systems, 36(6), 2730-2752 https://doi.org/10.1002/int.22399 Vanamala, M., Gilmore, J., Yuan, X., & Roy, K. (2020a, December). Recommending attack patterns for software requirements document. In 2020 International Conference on Computational Science and Computational Intelligence (CSCI) (pp. 1813-1818). IEEE. https://doi.org/10.1109/CSCI51800.2020.00334 Vanamala, M., Yuan, X., & Roy, K. (2020b, August). Topic modeling and classification of Common Vulnerabilities and Exposures database. In 2020 International Conference on Artificial Intelligence, Big Data, Computing and Data Communication Systems (icABCD) (pp. 1-5). IEEE. https://doi.org/10.1109/icABCD49160.2020.9183814 Zhu, L., He, Y., & Zhou, D. (2020). A neural generative model for joint learning topics and topic-specific word embeddings. Transactions of the Association for Computational Linguistics, 8, 471-485. https://doi.org/10.1162/tacl_a_00326

Software Repositories and Machine Learning Research in Cyber Security: Conclusions, Acknowledgment

This paper is under CC 4.0 license. available on arxiv Authors: (1) Mounika Vanamala, Department of Computer Science, University of Wisconsin-Eau Claire, United States; (2) Keith Bryant, Department of Computer Science, University of Wisconsin-Eau Claire, United States; (3) Alex Caravella, Department of Computer Science, University of Wisconsin-Eau Claire, United States. Table of Links Abstract & Introduction Discussions Conclusions, Acknowledgment, and References Discussions Semantics of words have a crucial role in properly categorizing words through ML. Two different words can be processed into the same word, which potentially provides inaccurate classification. One example is the preprocessing of the words desert and deserted, these words both become desert. The meaning of the word deserted is lost. It would be essential for an ML model to be effective in semantic analysis if it were to make recommendations upon relevant vulnerabilities, utilizing the CAPEC database. The next discussion is the consideration of implementing an unsupervised, supervised, or semi-supervised ML model. The goal of this research would be to compare keywords from an SRS document to the keywords of CAPEC vulnerabilities. Unsupervised Machine Learning (ML) algorithms find their primary utility in tasks involving the segregation of data into clusters, uncovering underlying data relationships, and reducing dimensionality. For instance, dimensionality reduction becomes a valuable tool when dealing with extensive datasets like the large CAPEC dataset, as it aims to streamline data while preserving its integrity. In the realm of text analysis, research on Latent Dirichlet Allocation (LDA) uncovered substantial adaptation requirements to achieve satisfactory outcomes, largely due to semantic limitations. On the other hand, the Latent Semantic Analysis (LSA) algorithm is designed to capture semantics and establish connections between vectors that words are segmented into. Over time, LSA has frequently been coupled with techniques such as Singular Value Decomposition (SVD) or other intricate algorithms to enhance its effectiveness. It's important to note that evaluating the usefulness of unsupervised methods, in general, can be challenging due to the absence of well-defined metrics to measure model accuracy. This lack of clear metrics adds complexity to the interpretation of results, making it more intricate to discern the quality of outcomes generated by unsupervised ML approaches. Supervised ML is a less complex process and requires fewer tools than unsupervised ML (IBM, 2019). Supervised ML uses a training dataset and validation techniques to derive accurate results in a timelier manner, compared to unsupervised ML. Unsupervised ML works by clustering objects into like groups, identified by the algorithm. The largest limitation for supervised ML requires obtaining the training data set to prep the implemented algorithm. Supervised ML also is significantly more proficient at obtaining metrics for the accuracy of results.

Software Repositories and Machine Learning Research in Cyber Security: Discussions

Software Repositories and Machine Learning Research in Cyber Security: Abstract & Introduction 

In the ever-evolving landscape of software development, finding the right resources can be a daunting and time-consuming task. I've decided to help by curating a compilation of some of my favorite GitHub repositories, that will help you to improve your workflow and skills. This list includes valuable GitHub repositories for topics like learning, project ideas, career opportunities, data collections, database tools, and security. I've included direct links, descriptions, and visuals so that you can get an initial impression of each extension right away. 1. (Sponsored) esProc SPL ⭐ GitHub stars: 4K+ esProc SPL is a next-generation data processing language, that integrates with SQL databases and supports advanced analytics, and parallel processing. With esProc SPL, you can effortlessly transform and analyze massive datasets, uncover hidden patterns and trends, and derive actionable insights from your data. Some of the top features include: Experience fast processing speeds with esProc SPL's optimized algorithms and efficient memory management. ⚡ Top Performance: Access a comprehensive collection of pre-built functions, catering to a wide range of data manipulation tasks. 🚀 Rich Function Library: Enjoy a clear and concise syntax that fosters code readability and maintainability. ✨ Intuitive Syntax: Seamlessly integrate esProc SPL scripts into Java programs via JDBC, bridging the gap between data analysis and application development. 👨‍💻 Java Integration: Execute esProc SPL scripts independently, expanding your data processing capabilities beyond traditional limitations. 🧙‍♀️ Independent Execution: ⭐ Support their GitHub repo: https://github.com/SPLWare/esProc 🌱 Learning 2. A-to-Z Resources for Students ⭐ GitHub stars: 16K+ This repository is a comprehensive collection of resources beneficial for students, covering a wide range of topics. It includes study materials, programming resources, and tools that can aid in academic and personal development. 3. Learning Resources for Developers ⭐ GitHub stars: 5K+ This repository gathers an extensive list of learning resources for developers. From tutorials and courses to resources and tools, it serves as a valuable one-stop-shop for enhancing programming skills. 4. Every Programmer Should Know ⭐ GitHub stars: 75K+ A compilation of essential knowledge that every programmer should be aware of. Covering a variety of topics, it provides insights into algorithms, data structures, system design, and other fundamental concepts. 📀 Data 5. Public Datasets Collection ⭐ GitHub stars: 57K+ This repository curates a vast collection of public datasets from various domains. It's a valuable resource for data scientists and developers looking for high-quality datasets to analyze and derive insights from. 6. JSON Datasets Collection ⭐ GitHub stars: 3K+ This repository provides a curated list of datasets in JSON. It's a handy reference for developers working with JSON data in their projects. 7. Useful Database Tools ⭐ GitHub stars: 3K+ This repository compiles a list of tools and utilities for working with databases. From database design to management and optimization tools, it's a go-to resource for developers dealing with database-related tasks. 💡 Ideas 8. Everything for Indie Hackers ⭐ GitHub stars: 8K+ Focused on independent developers and creators, this repository gathers resources, tools, and advice for individuals pursuing indie projects. It's a supportive community-driven collection for those looking to thrive independently. 9. Machine Learning Project Ideas ⭐ GitHub stars: 7K+ A repository filled with project ideas for Machine Learning developers. It's a great source of inspiration for developers seeking new and interesting projects to work on. 10. Awesome Stacks for Apps ⭐ GitHub stars: 3K+ This repository showcases various technology stacks you can use. It's a valuable resource for developers exploring different tech stacks and architectures for their projects. 11. Frontend Dev Bookmarks ⭐ GitHub stars: 40K+ A curated collection of bookmarks for frontend developers, covering a wide range of topics from appearance and UI to compatibility and design workflow. It's a handy reference for staying updated on best practices and tools in the front-end development landscape. 💼 Career 12. CV Templates ⭐ GitHub stars: 21K+ Some useful templates for creating impressive curriculum vitae (CVs). It's a valuable tool for job seekers, helping them craft visually appealing resumes. 13. Resume Best Practices ⭐ GitHub stars: 6K+ This repository compiles various practical examples to use in resumes. It serves as a comprehensive guide for individuals aiming to enhance their resume presentation, improving their chances of getting a job. 14. Remote Work Resources ⭐ GitHub stars: 27K+ Focused on remote job opportunities, this repository provides a curated list of companies and job boards offering remote work. It's a go-to resource for those seeking remote employment options. 🔐 Security 15. Everything Security ⭐ GitHub stars: 11K+ A collection of awesome software, libraries, documents, books, resources, and cool stuff about security. 16. Web Security Practices ⭐ GitHub stars: 10K+ Focused specifically on web security, this repository gathers resources and tools to help developers secure their web applications. It covers best practices, tools, and frameworks for web security. 17. Privacy Focused Services ⭐ GitHub stars: 11K+ A curated list of resources and tools to enhance online privacy. It covers topics such as privacy-focused software, encryption tools, and practices to protect personal information online. 18. Privacy Tools Collection ⭐ GitHub stars: 5K+ A repository that curates privacy-related software and services. This collection includes tools, guides, and best practices to maintain digital privacy in various online activities. 19. Personal Security Checklist ⭐ GitHub stars: 13K+ A valuable checklist and resources to improve personal online security. It's a practical guide for individuals looking to protect their digital privacy. Writing has always been my passion and it gives me pleasure to help and inspire people. If you have any questions, feel free to reach out! Make sure to receive the best resources, tools, productivity tips, and career growth tips I discover by subscribing to ! my newsletter Also, connect with me on , , and ! Twitter LinkedIn GitHub Also published . here

The 19 Useful GitHub Repositories You Need to Become a Better Developer 🔥🚀

19 টি দরকারী GitHub সংগ্রহস্থল যা আপনাকে আরও ভাল বিকাশকারী হতে হবে 🔥🚀

Die 19 nützlichen GitHub-Repositories, die Sie benötigen, um ein besserer Entwickler zu werden 🔥🚀

Los 19 repositorios de GitHub útiles que necesitas para convertirte en un mejor desarrollador 🔥🚀

Les 19 référentiels GitHub utiles dont vous avez besoin pour devenir un meilleur développeur 🔥🚀

एक बेहतर डेवलपर बनने के लिए आपको 19 उपयोगी GitHub रिपॉजिटरी की आवश्यकता है 🔥🚀

より良い開発者になるために必要な 19 の便利な GitHub リポジトリ 🔥🚀

더 나은 개발자가 되기 위해 필요한 19가지 유용한 GitHub 리포지토리 🔥🚀

Os 19 repositórios GitHub úteis que você precisa para se tornar um desenvolvedor melhor 🔥🚀

19 полезных репозиториев GitHub, которые вам нужны, чтобы стать лучшим разработчиком 🔥🚀

Daha İyi Bir Geliştirici Olmak İçin İhtiyacınız Olan 19 Faydalı GitHub Deposu 🔥🚀

19 kho lưu trữ GitHub hữu ích mà bạn cần để trở thành nhà phát triển giỏi hơn 🔥🚀

成为更好的开发人员所需的 19 个有用的 GitHub 存储库 🔥🚀

To kickstart 2024 on a productive note, I've curated a list of 18 GitHub repositories that might be useful to enhance your development journey. This collection spans a variety of categories, from tools, extensions, cheat sheets, and guides to learning resources, prompt engineering, and other cool stuff. Whether you're a , designer, or tech enthusiast, this collection aims to boost your inspiration and productivity throughout the year. developer Each repository is divided into subcategories for easier navigation. I've also included direct links and descriptions to get the impression right away. 1. (Sponsored) esProc SPL esProc SPL is a next-generation data processing language that integrates with SQL databases and supports advanced analytics and parallel processing. With esProc SPL, you can effortlessly transform and analyze massive datasets, uncover hidden patterns and trends, and derive actionable insights from your data. Some of the top features include: esProc SPL is a scripting language with a rich library of functions and powerful syntax. 💪 Powerful Data Processing: It allows the execution of SPL scripts through JDBC interfaces. ✨ Stored Procedure Equivalent: It offers a mature reporting tool with extensive visualization configurations for creating various types of reports. 📈 Versatile Visualization: it enables the automation of software workflows, including CI/CD processes for code building, testing, and deployment. ⚡ Automated Workflows: Unlike SQL syntax, esProc SPL allows data processing code to be written in multiple statements. 🔥 More flexibility compared to SQL: ⭐ Support their GitHub repo: https://github.com/SPLWare/esProc 💻 Tools and Extensions 2. awesome-git ⭐ GitHub stars: 2k+ https://github.com/dictcp/awesome-git A curated list of delightful Git commands, extensions, and resources to enhance your Git workflow. 3. awesome-vscode ⭐ GitHub stars: 23.6k+ https://github.com/viatsko/awesome-vscode A curated list of extensions, themes, and resources for Visual Studio Code to boost productivity and enhance the development experience. 4. awesome-linux-software ⭐ GitHub stars: 20.3k+ https://github.com/luong-komorebi/Awesome-Linux-Software A list of awesome, tested, and reliable open-source software for Linux users covering a wide range of categories. 🚀 Cheat sheets and guides 5. awesome-cheatsheets ⭐ GitHub stars: 35.7k+ https://github.com/LeCoupa/awesome-cheatsheets A collection of useful cheat sheets for various programming languages, frameworks, and tools, providing quick references for developers. 6. awesome-checklists ⭐ GitHub stars: 2.6k+ https://github.com/huyingjie/Checklist-Checklist A compilation of checklists for software development, ensuring you cover essential tasks and considerations during the development process. 7. awesome-guidelines ⭐ GitHub stars: 9.2k+ https://github.com/Kristories/awesome-guidelines A collection of guidelines, best practices, and resources to help developers create better software and follow industry standards. 🤖 Prompt engineering 8. awesome-chatgpt-prompts ⭐ GitHub stars: 96.3k+ https://github.com/f/awesome-chatgpt-prompts A curated list of prompts for ChatGPT, designed to inspire creative and engaging conversations with OpenAI's language model. 9. awesome-prompt-engineering ⭐ GitHub stars: 2.6k+ https://github.com/promptslab/Awesome-Prompt-Engineering A collection of resources, tools, and examples related to prompt engineering, aiding the generation of diverse and context-aware prompts for processing models. 📚 Learning resources 10. awesome-podcasts ⭐ GitHub stars: 11.8k+ https://github.com/rShetty/awesome-podcasts A compilation of podcasts covering a wide range of topics, including technology, science, culture, and more, offering valuable insights and knowledge. 11. awesome-newsletters ⭐ GitHub stars: 3.6k+ https://github.com/zudochkin/awesome-newsletters A curated list of newsletters across various domains, providing a valuable resource for staying updated on the latest trends, news, and insights. 12. awesome-talks ⭐ GitHub stars: 5.9k+ https://github.com/JanVanRyswyck/awesome-talks A collection of conference and tech talk videos covering diverse topics, offering a rich source of educational content and insights from industry experts. 🏆 Productivity boosters 13. awesome-emails ⭐ GitHub stars: 2.2k+ https://github.com/jonathandion/awesome-emails A compilation of resources and examples for creating effective and impactful email campaigns and enhancing email marketing strategies. 14. awesome-productivity ⭐ GitHub stars: 2.2k+ https://github.com/jyguyomarch/awesome-productivity A curated list of productivity tools, apps, and resources to help individuals and teams boost their efficiency and accomplish more. 15. awesome-quantified-self ⭐ GitHub stars: 2.1k+ https://github.com/woop/awesome-quantified-self A collection of tools and resources for self-tracking and quantified self enthusiasts, facilitating personal data analysis and improvement. ✨ Other cool stuff 16. swag-for-dev ⭐ GitHub stars: 4.2k+ https://github.com/swapagarwal/swag-for-dev A repository of swag, stickers, and goodies offered by various tech companies, making it a fun opportunity for developers and tech enthusiasts. 17. awesome-raspberry-pi ⭐ GitHub stars: 12.2k+ https://github.com/thibmaek/awesome-raspberry-pi A curated list of Raspberry Pi projects, tools, and resources for enthusiasts to explore and make the most out of their Raspberry Pi devices. 18. awesome-github-profile-readme ⭐ GitHub stars: 20.7k+ https://github.com/abhisheknaiidu/awesome-github-profile-readme A collection of creative and engaging GitHub profile README templates and ideas to help users showcase their skills and personality on their GitHub profiles. Writing has always been my passion, and it gives me pleasure to help and inspire people. If you have any questions, feel free to reach out! Make sure to receive the best resources, tools, productivity tips, and career growth tips I discover by subscribing to ! my newsletter Also, connect with me on , , and ! Twitter LinkedIn GitHub Also published . here

Bookmark This: 18 Awesome GitHub Repositories For 2024

In today's dynamic world of software development, staying up-to-date with the latest tools, libraries, and frameworks is crucial for developers. GitHub offers a treasure trove of valuable repositories that can significantly enhance your development skills and expertise. I've compiled a list of 19 GitHub repositories that every developer should be aware of, providing a rich source for learning, practicing, and inspiration. Each repository is divided into subcategories for easier navigation. I've also included direct links and descriptions to get the impression right away. 1. (Sponsored) esProc SPL esProc SPL is a next-generation data processing language that integrates with SQL databases and supports advanced analytics and parallel processing. With esProc SPL, you can effortlessly transform and analyze massive datasets, uncover hidden patterns and trends, and derive actionable insights from your data. Some of the top features include: Experience fast processing speeds with esProc SPL's optimized algorithms and efficient memory management. ⚡ Top Performance: Access a comprehensive collection of pre-built functions catering to a wide range of data manipulation tasks. 🚀 Rich Function Library: Enjoy a clear and concise syntax that fosters code readability and maintainability. ✨ Intuitive Syntax: Seamlessly integrate esProc SPL scripts into Java programs via JDBC, bridging the gap between data analysis and application development. 👨‍💻 Java Integration: Execute esProc SPL scripts independently, expanding your data processing capabilities beyond traditional limitations. 🧙‍♀️ Independent Execution: ⭐ Support their GitHub repo: https://github.com/SPLWare/esProc 🌱 Learning to Code 2. awesome-roadmaps ⭐ GitHub stars 3k+ https://github.com/liuchong/awesome-roadmaps A collection of roadmaps for various programming languages, frameworks, and tools. 3. awesome-courses ⭐ GitHub stars 50k+ https://github.com/prakhar1989/awesome-courses A curated list of online courses for learning programming, web development, and other tech skills. 4. free-certifications ⭐ GitHub stars 12k+ https://github.com/cloudcommunity/Free-Certifications A comprehensive list of certifications and training courses for various tech topics. 5. awesome-algorithms ⭐ GitHub stars 15k+ https://github.com/tayllan/awesome-algorithms A collection of resources for learning and practicing algorithms and data structures. 6. awesome-interview-questions ⭐ GitHub stars 59k+ https://github.com/DopplerHQ/awesome-interview-questions A compilation of common interview questions for software development roles. 🧑‍💻 Building Projects 7. awesome-for-beginners ⭐ GitHub stars 58k+ https://github.com/MunGell/awesome-for-beginners A list of project ideas and resources for beginner programmers. 8. app-ideas ⭐ GitHub stars 69k+ https://github.com/florinpop17/app-ideas A vast collection of app ideas for various programming platforms and skill levels. 9. learn-by-playing ⭐ GitHub stars 115+ https://github.com/lmammino/awesome-learn-by-playing A collection of games and interactive projects to enhance coding skills. 10. project-based-learning ⭐ GitHub stars 123k+ https://github.com/practical-tutorials/project-based-learning A list of project-based learning resources for various tech fields. 11. build-your-own-x ⭐ GitHub stars 229k+ https://github.com/codecrafters-io/build-your-own-x A collection of guides on how to build your own programming languages, tools, and frameworks. 🚀 Tools and Resources 12. free-for-dev ⭐ GitHub stars 76k+ https://github.com/ripienaar/free-for-dev A curated list of free tools and resources for developers. 13. awesome-selfhosted ⭐ GitHub stars 157k+ https://github.com/awesome-selfhosted/awesome-selfhosted A collection of self-hosted software applications for various purposes. 14. awesome-design-tools ⭐ GitHub stars 30k+ https://github.com/goabstract/Awesome-Design-Tools A comprehensive list of design tools for various design purposes. 15. awesome-stock-resources ⭐ GitHub stars 11k+ https://github.com/neutraltone/awesome-stock-resources A collection of free and paid stock photos, icons, and other design assets. 💯 Patterns and Best Practices 16. awesome-sre ⭐ GitHub stars 10k+ https://github.com/dastergon/awesome-sre A collection of resources for learning and implementing Site Reliability Engineering practices. 17. awesome-design-patterns ⭐ GitHub stars 33k+ https://github.com/DovAmir/awesome-design-patterns A catalog of software design patterns and their applications. 18. beautiful-docs ⭐ GitHub stars 8k+ https://github.com/matheusfelipeog/beautiful-docs A collection of resources and best practices for creating beautiful and effective documentation. 19. awesome-scalability ⭐ GitHub stars 49k+ ] https://github.com/binhnguyennus/awesome-scalability A curated list of resources on scalability, performance, and optimization for software systems. Writing has always been my passion, and it gives me pleasure to help and inspire people. If you have any questions, feel free to reach out! Make sure to receive the best resources, tools, productivity tips, and career growth tips I discover by subscribing to ! my newsletter Also, connect with me on , , and ! Twitter LinkedIn GitHub Also published . here

Bookmark This: 19 Essential GitHub Repositories

এটিকে বুকমার্ক করুন: 19টি প্রয়োজনীয় গিটহাব সংগ্রহস্থল

Setzen Sie ein Lesezeichen: 19 wichtige GitHub-Repositories

Marque esto como favorito: 19 repositorios esenciales de GitHub

Ajoutez ceci à vos favoris : 19 référentiels GitHub essentiels

इसे बुकमार्क करें: 19 आवश्यक GitHub रिपॉजिटरी

これをブックマーク: 19 の重要な GitHub リポジトリ

이것을 북마크에 추가하세요: 19가지 필수 GitHub 리포지토리

Marque isto: 19 repositórios essenciais do GitHub

Добавьте это в закладки: 19 основных репозиториев GitHub

Bunu Yer İşaretlerine Ekleyin: 19 Temel GitHub Deposu

Đánh dấu trang này: 19 kho GitHub cần thiết

将此添加为书签：19 个基本 GitHub 存储库

How to Structure Your K8s GitOps Repository at Scale [Part 1]

Authors:
(1) Philipp Straubinger, University of Passau, Passau, Germany;
(2) Gordon Fraser, University of Passau, Passau, Germany. Table of Links Abstract and Introduction
Gamification Elements of Gamekins
Intellij Plugin for Gamekins
Conclusions
Acknowledgement and References 2 GAMIFICATION ELEMENTS OF GAMEKINS 2.1 Challenges Gamekins offers a variety of different challenges, which are test and quality-oriented tasks for the developer to solve. There are currently eight different types of challenges available[2]: • Build Challenge: This challenge shows the developer that the build on the CI failed and has to be fixed. • Test Challenge: This generic challenge shows that the developer has to write a new test. • Class Coverage Challenge: This challenge tasks the developer to cover more lines in a specific class. • Method Coverage Challenge: This challenge focuses on improving the coverage of a specific method. • Line Coverage Challenge: This challenge assigns the developer an uncovered line that they have to cover. • Branch Coverage Challenge: This challenge focuses on the improvement of branch coverage of a covered line. • Mutation Challenge: This challenge tasks the developer to detect a mutant generated by PIT[3] by writing a new test. • Smell Challenge: This challenge focuses on the removal of code and test smell with the help of SonarLint[4]. 2.2 Quests Since the original inception as described in prior work [3, 4], the way quests are implemented has changed. Instead of having multiple challenges solved after each other, quests are now test- and qualityrelated tasks that involve making multiple quality improvements and interacting with gamification elements. It is therefore not bound to challenges anymore, but rather on improving different test and quality-related metrics. The following types of quests are available: • Add Tests Quest: This quest tasks the developer to add a specified number of tests to the existing test suite. • Cover Branches Quest: This quest focuses on covering an additional specified number of branches with new tests. • Cover Lines Quest: This quest focuses on covering an additional specified number of lines with new tests. • Receive Challenges Quest: This quest promotes interaction with other developers by receiving a challenge from another developer. • Send Challenges Quest: This quest promotes interaction with other developers by sending a challenge to them. • Solve Achievements Quest: This quest focuses on the completion of a new achievement. • Solve Challenges Quest: This quest tasks the developer to solve a specified number of new challenges of one type. • Solve Challenges Without Rejection Quest: This quest focuses on solving a specified number of challenges regardless of their types without rejecting one in between. 2.3 Achievements Developers are rewarded based on their testing accomplishments, encompassing various achievements of differing difficulty levels. These achievements range from simple tasks like adding a test to a project to more challenging objectives such as achieving 100% coverage. Certain achievements remain hidden until they are completed and are tied to individual actions, like the addition of new tests. Achievements are triggered when users commit to the project repository. There are two main types of achievements: individual achievements, which involve completing a specific number of challenges, and project-level achievements, which are linked to reaching a particular threshold within the project. This paper is available on arxiv under CC BY-SA 4.0 DEED license. [2] Detailed information can be found in prior work [3, 4] [3] https://pitest.org/ [4] https://www.sonarsource.com/products/sonarlint/ Authors: (1) Philipp Straubinger, University of Passau, Passau, Germany; (2) Gordon Fraser, University of Passau, Passau, Germany. Authors: Authors: (1) Philipp Straubinger, University of Passau, Passau, Germany; (2) Gordon Fraser, University of Passau, Passau, Germany. Table of Links Abstract and Introduction Gamification Elements of Gamekins Intellij Plugin for Gamekins Conclusions Acknowledgement and References Abstract and Introduction Abstract and Introduction Gamification Elements of Gamekins Gamification Elements of Gamekins Intellij Plugin for Gamekins Intellij Plugin for Gamekins Conclusions Conclusions Acknowledgement and References Acknowledgement and References 2 GAMIFICATION ELEMENTS OF GAMEKINS 2.1 Challenges Gamekins offers a variety of different challenges, which are test and quality-oriented tasks for the developer to solve. There are currently eight different types of challenges available[2]: • Build Challenge: This challenge shows the developer that the build on the CI failed and has to be fixed. • Test Challenge: This generic challenge shows that the developer has to write a new test. • Build Challenge: • Class Coverage Challenge: This challenge tasks the developer to cover more lines in a specific class. • Class Coverage Challenge: • Method Coverage Challenge: This challenge focuses on improving the coverage of a specific method. • Method Coverage Challenge: • Line Coverage Challenge: This challenge assigns the developer an uncovered line that they have to cover. • Line Coverage Challenge: • Branch Coverage Challenge: This challenge focuses on the improvement of branch coverage of a covered line. • Branch Coverage Challenge: • Mutation Challenge: This challenge tasks the developer to detect a mutant generated by PIT[3] by writing a new test. • Mutation Challenge: • Smell Challenge : This challenge focuses on the removal of code and test smell with the help of SonarLint[4]. • Smell Challenge 2.2 Quests Since the original inception as described in prior work [3, 4], the way quests are implemented has changed. Instead of having multiple challenges solved after each other, quests are now test- and qualityrelated tasks that involve making multiple quality improvements and interacting with gamification elements. It is therefore not bound to challenges anymore, but rather on improving different test and quality-related metrics. The following types of quests are available: • Add Tests Quest: This quest tasks the developer to add a specified number of tests to the existing test suite. • Add Tests Quest: • Cover Branches Quest: This quest focuses on covering an additional specified number of branches with new tests. • Cover Branches Quest: • Cover Lines Quest: This quest focuses on covering an additional specified number of lines with new tests. • Receive Challenges Quest: This quest promotes interaction with other developers by receiving a challenge from another developer. • Send Challenges Quest: This quest promotes interaction with other developers by sending a challenge to them. • Send Challenges Quest: • Solve Achievements Quest: This quest focuses on the completion of a new achievement. • Solve Achievements Quest: • Solve Challenges Quest: This quest tasks the developer to solve a specified number of new challenges of one type. • Solve Challenges Quest: • Solve Challenges Without Rejection Quest: This quest focuses on solving a specified number of challenges regardless of their types without rejecting one in between. • Solve Challenges Without Rejection Quest: 2.3 Achievements Developers are rewarded based on their testing accomplishments, encompassing various achievements of differing difficulty levels. These achievements range from simple tasks like adding a test to a project to more challenging objectives such as achieving 100% coverage. Certain achievements remain hidden until they are completed and are tied to individual actions, like the addition of new tests. Achievements are triggered when users commit to the project repository. There are two main types of achievements: individual achievements, which involve completing a specific number of challenges, and project-level achievements, which are linked to reaching a particular threshold within the project. This paper is available on arxiv under CC BY-SA 4.0 DEED license. This paper is available on arxiv under CC BY-SA 4.0 DEED license. available on arxiv [2] Detailed information can be found in prior work [3, 4] [3] https://pitest.org/ [4] https://www.sonarsource.com/products/sonarlint/

An IDE Plugin for Gamified Continuous Integration: Gamification Elements of Gamekins

This paper is available on arxiv under CC 4.0 license.
Authors:
(1) Andrea Roncoli, Department of Computer, Science (University of Pisa);
(2) Aleksandra Ciprijanovi´c´, Computational Science and AI Directorate (Fermi National Accelerator Laboratory) and Department of Astronomy and Astrophysics (University of Chicago);
(3) Maggie Voetberg, Computational Science and AI Directorate, (Fermi National Accelerator Laboratory);
(4) Francisco Villaescusa-Navarro, Center for Computational Astrophysics (Flatiron Institute);
(5) Brian Nord, Computational Science and AI Directorate, Fermi National Accelerator Laboratory, Department of Astronomy and Astrophysics (University of Chicago) and Kavli Institute for Cosmological Physics (University of Chicago). Table of Links Abstract and Intro Data and Methods Results Conclusions Acknowledgments and Disclosure of Funding, and References Additional Plots 2 Data and Methods 2.1 Domain Adaptation Optimization and Computing Resources We performed experiments on NVIDIA A100 40GB GPU. For each of the models, implemented using PyTorch Geometric [19], we perform a hyperparameter search using the Optuna library [1], with 50 trials per model. More details on code performance, model implementations, and selected hyperparameters can be found in the publicly available code[4]. 2.2 Evaluation [1] https://arepo-code.org/ [2] http://www.tapir.caltech.edu/~phopkins/Site/GIZMO.html [3] CAMELS dataset documentation: https://camels.readthedocs.io/en/latest/index.html [4] GitHub repository will be added after the anonymous review stage. This paper is available on arxiv under CC 4.0 license. Authors: (1) Andrea Roncoli, Department of Computer, Science (University of Pisa); (2) Aleksandra Ciprijanovi´c´, Computational Science and AI Directorate (Fermi National Accelerator Laboratory) and Department of Astronomy and Astrophysics (University of Chicago); (3) Maggie Voetberg, Computational Science and AI Directorate, (Fermi National Accelerator Laboratory); (4) Francisco Villaescusa-Navarro, Center for Computational Astrophysics (Flatiron Institute); (5) Brian Nord, Computational Science and AI Directorate, Fermi National Accelerator Laboratory, Department of Astronomy and Astrophysics (University of Chicago) and Kavli Institute for Cosmological Physics (University of Chicago). This paper is available on arxiv under CC 4.0 license. available on arxiv Authors: Authors: (1) Andrea Roncoli, Department of Computer, Science (University of Pisa); (2) Aleksandra Ciprijanovi´c´, Computational Science and AI Directorate (Fermi National Accelerator Laboratory) and Department of Astronomy and Astrophysics (University of Chicago); (3) Maggie Voetberg, Computational Science and AI Directorate, (Fermi National Accelerator Laboratory); (4) Francisco Villaescusa-Navarro, Center for Computational Astrophysics (Flatiron Institute); (5) Brian Nord, Computational Science and AI Directorate, Fermi National Accelerator Laboratory, Department of Astronomy and Astrophysics (University of Chicago) and Kavli Institute for Cosmological Physics (University of Chicago). Table of Links Abstract and Intro Abstract and Intro Data and Methods Data and Methods Results Results Conclusions Conclusions Acknowledgments and Disclosure of Funding, and References Acknowledgments and Disclosure of Funding, and References Additional Plots Additional Plots 2 Data and Methods 2.1 Domain Adaptation Optimization and Computing Resources We performed experiments on NVIDIA A100 40GB GPU. For each of the models, implemented using PyTorch Geometric [19], we perform a hyperparameter search using the Optuna library [1], with 50 trials per model. More details on code performance, model implementations, and selected hyperparameters can be found in the publicly available code[4]. Optimization and Computing Resources 2.2 Evaluation [1] https://arepo-code.org/ [2] http://www.tapir.caltech.edu/~phopkins/Site/GIZMO.html [3] CAMELS dataset documentation: https://camels.readthedocs.io/en/latest/index.html [4] GitHub repository will be added after the anonymous review stage.

Adaptive Graph Neural Networks for Cosmological Data Generalization: Data and Methods

Imagine you're tasked with implementing a geo-fencing feature for your service. At first glance, dropping in an IP GeoLocation API might seem straightforward, but often, project constraints or requirements complicate the simplest solutions. Let's explore our options. Local GeoIP Database Implementation This method involves embedding a geolocation database directly within your application. It offers fast response times as it resides in-memory and operates independently of external services. However, this approach can be resource-intensive and harder to manage. Let’s see it in more detail. Pros Speed: IP lookups in milliseconds or less.
Reliability: No reliance on third-party services reduces failure chances.
Scalability: No extra costs as usage grows. Cons Resource Intensive: Each app instance consumes significant memory.
More Dependencies: Requires packages for decoding and looking up GeoIP data.
Challenging Updates: Updates require manual intervention or another self-hosted service. Using External GeoIP APIs (Often Paid) Opting for a third-party API to handle geolocation queries reduces your application's resource load and ensures access to the most current data, but it comes with its own challenges: Pros Minimal Resource Use: Outsourcing GeoIP data and logic doesn't burden your app's resources.
Ease of Implementation: Usually involves consuming a standard HTTP/GraphQL or gRPC API endpoint.
Fewer Dependencies: Often only requires an HTTP client.
Updates without hassle: Third-party will handle updates Cons Slower Responses: Calls to third-party services can introduce significant latency.
Increased Unreliability: Greater likelihood of failures due to network issues or third-party downtimes.
Scaling Costs: Costs can escalate as usage increases. Introducing Atlas: Combining the Best of Both Worlds Faced with these challenges, I developed Atlas—a robust solution designed to synergize the benefits of both approaches. Atlas acts as a self-hosting HTTP service that automatically manages and serves the latest MaxMind geolocation databases, providing: Low Latency: Similar to local databases, Atlas offers rapid response times. (often in a few milliseconds) Reliability and Ease of Updates: It autonomously handles database updates, removing the typical maintenance burdens. Cost Efficiency: No additional costs with scale in terms of third-party fees. Dead-Simple API: A very simple API that lets you implement quicker and focus on what matters. Open and Free: Atlas is Open Source and freely available under Apache-2.0 License. By hosting Atlas closer to your application but operating like a remote API, it offers a middle ground that maximizes efficiency without the drawbacks of either method we have discussed. Why Rust? Safe, Performant, and Resource-Efficient Atlas is written in Rust, a language chosen for its unparalleled safety, performance, and resource efficiency. Rust's ownership model ensures memory safety without the need for a garbage collector, which is particularly advantageous during database updates—these operations consume minimal memory, avoiding the typical overhead associated with garbage-collected languages. This design choice not only boosts Atlas's performance but also enhances its reliability, making it an ideal solution for managing GeoIP data efficiently and safely. How to Deploy and Use Atlas? Atlas Docker images are automatically built and pushed to Docker Hub via GitHub Actions, making it easy for anyone to use. For detailed instructions on using these Docker images or building Atlas from source and configuration parameters, please refer to the Atlas README.md. Atlas features a straightforward API, documented with OpenAPI 3.0 Specs. You can access the API documentation from the public internet here: https://atlas-rs.fly.dev/swagger-ui/. Here’s an example of how you can use curl to query the demo instance of Atlas (hosted publicly thanks to Fly.io and the GeoLite2 MaxMind database license) to retrieve country information for an IP address 8.8.8.8: > curl https://atlas-rs.fly.dev/geoip/lookup/country/8.8.8.8 | jq
{
  "results": {
    "8.8.8.8": {
      "country": {
        "iso_code": "US",
        // additional fields...
      },
      // additional results...
    }
  },
  "database_build_epoch": 1715091859
} Please note that this demo instance is intended only for demonstration and documentation purposes. Join the Atlas Community and Contribute As a newly introduced open-source project, Atlas is in the early stages of building its community. I am excited about the potential for Atlas to evolve and thrive with contributions from developers like you. Whether you're interested in refining functionality, adding new features, or simply improving documentation, your contributions are welcome and greatly valued. How You Can Contribute Try Atlas: The best way to start is by using Atlas in your projects. Experiment with it, identify any issues, and suggest improvements based on your real-world usage.


Report Issues: If you encounter any bugs or issues while using Atlas, please report them on the GitHub issues page. This feedback is crucial for continual improvement.


Suggest Features: Have ideas for new features or enhancements? Open a discussion on the GitHub repository or contribute directly by submitting a pull request.


Improve Documentation: As Atlas evolves, so too does the need for clear and comprehensive documentation. Whether it's enhancing the current content or writing tutorials and guides, your knowledge-sharing is invaluable.


Spread the Word: If you find Atlas useful, consider sharing it within your networks. Blog about your experiences, talk about Atlas at meetups, or share it on social media. Commitment to Open Source I am relatively new to Rust but bring many years of experience from other technology stacks. This project presents a great opportunity for more experienced Rust developers to contribute, ensuring that Atlas adheres to Rust's best practices and conventions since I know that it is not as good as it can be right now. I am committed to maintaining Atlas as a community-driven project and believe in open, collaborative development. I am eager to see how the community will shape Atlas's path forward and encourage you to join me in this journey, helping to build a tool that serves the needs of developers globally. In the end, I would like to give a special thanks to oschwald for creating the rust maxminddb crate which made Atlas possible. Future Directions As we continue to develop and improve Atlas, my vision is to create a robust, user-friendly minimal service. As of today, Atlas only supports MaxMind databases, but it would be beneficial to have an extensible implementation so more and more formats can be supported. Another aspect I would like to pay attention to is adding more endpoint types such as gRPC so that users can choose the best endpoint based on their requirements and needs. Thank you for taking the time to learn about Atlas. I am excited to see where we can take this project with your support and collaboration! Imagine you're tasked with implementing a geo-fencing feature for your service. At first glance, dropping in an IP GeoLocation API might seem straightforward, but often, project constraints or requirements complicate the simplest solutions. Let's explore our options. Local GeoIP Database Implementation Local GeoIP Database Implementation This method involves embedding a geolocation database directly within your application. It offers fast response times as it resides in-memory and operates independently of external services. However, this approach can be resource-intensive and harder to manage. Let’s see it in more detail. Pros Speed: IP lookups in milliseconds or less. Reliability: No reliance on third-party services reduces failure chances. Scalability: No extra costs as usage grows. Speed : IP lookups in milliseconds or less. Speed Reliability : No reliance on third-party services reduces failure chances. Reliability Scalability : No extra costs as usage grows. Scalability Cons Resource Intensive: Each app instance consumes significant memory. More Dependencies: Requires packages for decoding and looking up GeoIP data. Challenging Updates: Updates require manual intervention or another self-hosted service. Resource Intensive : Each app instance consumes significant memory. Resource Intensive More Dependencies : Requires packages for decoding and looking up GeoIP data. More Dependencies Challenging Updates : Updates require manual intervention or another self-hosted service. Challenging Updates Using External GeoIP APIs (Often Paid) Using External GeoIP APIs (Often Paid) Opting for a third-party API to handle geolocation queries reduces your application's resource load and ensures access to the most current data, but it comes with its own challenges: Pros Minimal Resource Use: Outsourcing GeoIP data and logic doesn't burden your app's resources. Ease of Implementation: Usually involves consuming a standard HTTP/GraphQL or gRPC API endpoint. Fewer Dependencies: Often only requires an HTTP client. Updates without hassle: Third-party will handle updates Minimal Resource Use : Outsourcing GeoIP data and logic doesn't burden your app's resources. Minimal Resource Use Ease of Implementation : Usually involves consuming a standard HTTP/GraphQL or gRPC API endpoint. Ease of Implementation Fewer Dependencies : Often only requires an HTTP client. Fewer Dependencies Updates without hassle : Third-party will handle updates Updates without hassle Cons Slower Responses: Calls to third-party services can introduce significant latency. Increased Unreliability: Greater likelihood of failures due to network issues or third-party downtimes. Scaling Costs: Costs can escalate as usage increases. Slower Responses : Calls to third-party services can introduce significant latency. Slower Responses Increased Unreliability : Greater likelihood of failures due to network issues or third-party downtimes. Increased Unreliability Scaling Costs : Costs can escalate as usage increases. Scaling Costs Introducing Atlas : Combining the Best of Both Worlds Introducing Atlas Faced with these challenges, I developed Atlas —a robust solution designed to synergize the benefits of both approaches. Atlas acts as a self-hosting HTTP service that automatically manages and serves the latest MaxMind geolocation databases, providing: Atlas Low Latency: Similar to local databases, Atlas offers rapid response times. (often in a few milliseconds) Low Latency : Similar to local databases, Atlas offers rapid response times. (often in a few milliseconds) Low Latency Reliability and Ease of Updates: It autonomously handles database updates, removing the typical maintenance burdens. Reliability and Ease of Updates : It autonomously handles database updates, removing the typical maintenance burdens. Reliability and Ease of Updates Cost Efficiency: No additional costs with scale in terms of third-party fees. Cost Efficiency : No additional costs with scale in terms of third-party fees. Cost Efficiency Dead-Simple API: A very simple API that lets you implement quicker and focus on what matters. Dead-Simple API : A very simple API that lets you implement quicker and focus on what matters. Dead-Simple API Open and Free: Atlas is Open Source and freely available under Apache-2.0 License. Open and Free: Atlas is Open Source and freely available under Apache-2.0 License. Open and Free : Atlas is Open Source and freely available under Apache-2.0 License. Open and Free By hosting Atlas closer to your application but operating like a remote API, it offers a middle ground that maximizes efficiency without the drawbacks of either method we have discussed. Why Rust? Safe, Performant, and Resource-Efficient Why Rust? Atlas is written in Rust, a language chosen for its unparalleled safety, performance, and resource efficiency. Rust's ownership model ensures memory safety without the need for a garbage collector, which is particularly advantageous during database updates—these operations consume minimal memory, avoiding the typical overhead associated with garbage-collected languages. This design choice not only boosts Atlas's performance but also enhances its reliability, making it an ideal solution for managing GeoIP data efficiently and safely. How to Deploy and Use Atlas? Atlas Docker images are automatically built and pushed to Docker Hub via GitHub Actions, making it easy for anyone to use. For detailed instructions on using these Docker images or building Atlas from source and configuration parameters, please refer to the Atlas README.md . Atlas README.md Atlas features a straightforward API, documented with OpenAPI 3.0 Specs. You can access the API documentation from the public internet here: https://atlas-rs.fly.dev/swagger-ui/ . https://atlas-rs.fly.dev/swagger-ui/ Here’s an example of how you can use curl to query the demo instance of Atlas (hosted publicly thanks to Fly.io and the GeoLite2 MaxMind database license) to retrieve country information for an IP address 8.8.8.8 : Fly.io 8.8.8.8 > curl https://atlas-rs.fly.dev/geoip/lookup/country/8.8.8.8 | jq
{
  "results": {
    "8.8.8.8": {
      "country": {
        "iso_code": "US",
        // additional fields...
      },
      // additional results...
    }
  },
  "database_build_epoch": 1715091859
} > curl https://atlas-rs.fly.dev/geoip/lookup/country/8.8.8.8 | jq
{
  "results": {
    "8.8.8.8": {
      "country": {
        "iso_code": "US",
        // additional fields...
      },
      // additional results...
    }
  },
  "database_build_epoch": 1715091859
} Please note that this demo instance is intended only for demonstration and documentation purposes. Please note that this demo instance is intended only for demonstration and documentation purposes. Join the Atlas Community and Contribute Join the Atlas Community and Contribute As a newly introduced open-source project, Atlas is in the early stages of building its community. I am excited about the potential for Atlas to evolve and thrive with contributions from developers like you. Whether you're interested in refining functionality, adding new features, or simply improving documentation, your contributions are welcome and greatly valued. How You Can Contribute Try Atlas: The best way to start is by using Atlas in your projects. Experiment with it, identify any issues, and suggest improvements based on your real-world usage. Report Issues: If you encounter any bugs or issues while using Atlas, please report them on the GitHub issues page. This feedback is crucial for continual improvement. Suggest Features: Have ideas for new features or enhancements? Open a discussion on the GitHub repository or contribute directly by submitting a pull request. Improve Documentation: As Atlas evolves, so too does the need for clear and comprehensive documentation. Whether it's enhancing the current content or writing tutorials and guides, your knowledge-sharing is invaluable. Spread the Word: If you find Atlas useful, consider sharing it within your networks. Blog about your experiences, talk about Atlas at meetups, or share it on social media. Try Atlas: The best way to start is by using Atlas in your projects. Experiment with it, identify any issues, and suggest improvements based on your real-world usage. Try Atlas : The best way to start is by using Atlas in your projects. Experiment with it, identify any issues, and suggest improvements based on your real-world usage. Try Atlas Report Issues: If you encounter any bugs or issues while using Atlas, please report them on the GitHub issues page. This feedback is crucial for continual improvement. Report Issues : If you encounter any bugs or issues while using Atlas, please report them on the GitHub issues page. This feedback is crucial for continual improvement. Report Issues Suggest Features: Have ideas for new features or enhancements? Open a discussion on the GitHub repository or contribute directly by submitting a pull request. Suggest Features : Have ideas for new features or enhancements? Open a discussion on the GitHub repository or contribute directly by submitting a pull request. Suggest Features Improve Documentation: As Atlas evolves, so too does the need for clear and comprehensive documentation. Whether it's enhancing the current content or writing tutorials and guides, your knowledge-sharing is invaluable. Improve Documentation : As Atlas evolves, so too does the need for clear and comprehensive documentation. Whether it's enhancing the current content or writing tutorials and guides, your knowledge-sharing is invaluable. Improve Documentation Spread the Word: If you find Atlas useful, consider sharing it within your networks. Blog about your experiences, talk about Atlas at meetups, or share it on social media. Spread the Word : If you find Atlas useful, consider sharing it within your networks. Blog about your experiences, talk about Atlas at meetups, or share it on social media. Spread the Word Commitment to Open Source I am relatively new to Rust but bring many years of experience from other technology stacks. This project presents a great opportunity for more experienced Rust developers to contribute, ensuring that Atlas adheres to Rust's best practices and conventions since I know that it is not as good as it can be right now. I am committed to maintaining Atlas as a community-driven project and believe in open, collaborative development. I am eager to see how the community will shape Atlas's path forward and encourage you to join me in this journey, helping to build a tool that serves the needs of developers globally. In the end, I would like to give a special thanks to oschwald for creating the rust maxminddb crate which made Atlas possible. special thanks to oschwald oschwald maxminddb Future Directions As we continue to develop and improve Atlas, my vision is to create a robust, user-friendly minimal service. As of today, Atlas only supports MaxMind databases, but it would be beneficial to have an extensible implementation so more and more formats can be supported. Another aspect I would like to pay attention to is adding more endpoint types such as gRPC so that users can choose the best endpoint based on their requirements and needs. Thank you for taking the time to learn about Atlas. I am excited to see where we can take this project with your support and collaboration!

IP Geo-Location: Local Database vs. Remote API—Finding the Middle Ground With Atlas

JSON in Swift: What You Need to Know

Are you a developer, startup, or entrepreneur with a passion for crypto? If your answer is yes, this one’s for you! Rootstock is proud to announce its latest hackathon on TAIKAI — and this summer’s theme is Bitcoin meets Solidity. The ecosystem and its community are encouraging talented teams with bright ideas to explore and build on the Rootstock network — pushing the boundaries of what's possible on the Bitcoin blockchain. As you may know, Rootstock is a smart contract platform secured by the Bitcoin network that's fully compatible with the Ethereum Virtual Machine. This opens the door to Solidity-based decentralized applications that leverage Bitcoin's unparalleled security. Whether you've been coding in Solidity for years or are brand new to the space, this hackathon is all about creativity, collaboration, and innovation. Dedicated tracks have been established to cover everyday DeFi applications, tokenized real-world assets, and infrastructure and cross-chain interoperability. No matter what you're interested in, there's a home for you in the Rootstock ecosystem. Sign up to the Bitcoin Meets Solidity hackathon now! Here are some Important Details for the Hackathon When's it taking place? The hackathon commences virtually on May 15th, and competitors have until June 7 to submit their projects. How big can my team be? Our hackathon welcomes ambitious developers who are looking to fly solo — or teams with a maximum of five members. What are the rules? Getting involved in the Rootstock hackathon is pretty straightforward. First off, your project should have been entirely developed during the hackathon — and offer something new or innovative. Ideas or code copied from elsewhere will be disqualified. Submissions need to include the project's source code, a brief summary of what it aims to achieve, and any instructions for the judging panel to follow. Don't forget to provide a Rootstock wallet address in case you win a prize! It's also important to stress that this hackathon is separate from the Rootstock Grants Program, but winners have a chance to be fast-tracked for an application. What needs to be delivered? By the end of the hackathon, you should have a smart contract deployed on Rootstock — as well as two on-chain transactions successfully executed in a testnet environment. Each project also needs to provide a GitHub repository with a descriptive README. A pitch video's also required where you demonstrate your product in action, and show off its key features. This is a great way to stand out from the competition! We've set up a dedicated submission form for all of these deliverables. How will submissions be judged? For the best chance of success, it's worth paying close attention to the judging criteria for this hackathon. The judging panel will be looking for original apps with never-before-seen utility — or an exciting new approach to an existing problem. Points are awarded for usable, well-designed apps that are intuitive and functional. Judges will be asking whether the end product is practical, meet a need in the marketplace, and would be eligible for a Rootstock grant. And they'll be reflecting on the amount of effort put in by the applicants. We want to see applicants who stretch themselves and push the boundaries of what's possible. What's the scoring criteria? Here's a breakdown of how each of these requirements will be weighted: Feature implementation

60%

Does the project work?



Software quality

20%

How well has the code been written?



Wow factor

10%

Does it go beyond what was asked?



Creativity

10%

Is it original and unexpected? What are the prizes up for grabs? The total prize pool for this Rootstock hackathon is a cool $17,000. The project in first place will win $7,000 — with $4,000 for second, and $1,000 for third. A further $5,000 has been set aside for bounties. Remind me of the dates again? The hackathon is open from May 15 to June 7 — and winners will be paid between June 10 and 15. A fantastic opportunity Past Rootstock hackathons have been a resounding success — and winning teams have gone on to achieve amazing things. This is a chance to show off your coding skills to the world, meet like-minded developers, and become part of a vibrant community. If all of this wasn't enough, Rootstock is a great blockchain to build on. More than 140 dApps have already been built on this Layer 2 network, which offers considerably lower fees than both Bitcoin and Ethereum. So… what are you waiting for? It's time to start building better on Bitcoin! Register to the Bitcoin Meets Solidity hackathon now. About Rootstock Rootstock is the first, biggest, and longest-lasting Bitcoin sidechain. It is the only Bitcoin layer 2 that combines the security of Bitcoin's proof-of-work, with Ethereum's smart contract capabilities. Rootstock is open-source, EVM-compatible, and secured by over 60% of Bitcoin’s hashing power, which makes it a gateway to a vibrant ecosystem of dApps that continues to evolve to become fully trustless. Website | X | Developer Portal | Discord | Youtube | Blog Are you a developer, startup, or entrepreneur with a passion for crypto? Are you a developer, startup, or entrepreneur with a passion for crypto? If your answer is yes, this one’s for you! Rootstock is proud to announce its latest hackathon on TAIKAI — and this summer’s theme is Bitcoin meets Solidity. Bitcoin meets Solidity. The ecosystem and its community are encouraging talented teams with bright ideas to explore and build on the Rootstock network — pushing the boundaries of what's possible on the Bitcoin blockchain. As you may know, Rootstock is a smart contract platform secured by the Bitcoin network that's fully compatible with the Ethereum Virtual Machine. This opens the door to Solidity-based decentralized applications that leverage Bitcoin's unparalleled security. Rootstock Rootstock smart contract Whether you've been coding in Solidity for years or are brand new to the space, this hackathon is all about creativity, collaboration, and innovation. Solidity Dedicated tracks have been established to cover everyday DeFi applications, tokenized real-world assets, and infrastructure and cross-chain interoperability. No matter what you're interested in, there's a home for you in the Rootstock ecosystem. Sign up to the Bitcoin Meets Solidity hackathon now! S ign up to the Bitcoin Meets Solidity hackathon now! S S S ign up to the Bitcoin Meets Solidity hackathon now! ign up to the Bitcoin Meets Solidity hackathon now! Here are some Important Details for the Hackathon Here are some Important Details for the Hackathon When's it taking place? When's it taking place? The hackathon commences virtually on May 15th , and competitors have until June 7 to submit their projects. May 15th June 7 How big can my team be? How big can my team be? Our hackathon welcomes ambitious developers who are looking to fly solo — or teams with a maximum of five members. five members. What are the rules? What are the rules? Getting involved in the Rootstock hackathon is pretty straightforward. First off, your project should have been entirely developed during the hackathon — and offer something new or innovative. Ideas or code copied from elsewhere will be disqualified. First off, your project should have been entirely developed during the hackathon — and offer something new or innovative. Ideas or code copied from elsewhere will be disqualified. Submissions need to include the project's source code, a brief summary of what it aims to achieve, and any instructions for the judging panel to follow. Don't forget to provide a Rootstock wallet address in case you win a prize! Submissions need to include the project's source code, a brief summary of what it aims to achieve, and any instructions for the judging panel to follow. Don't forget to provide a Rootstock wallet address in case you win a prize! It's also important to stress that this hackathon is separate from the Rootstock Grants Program, but winners have a chance to be fast-tracked for an application. It's also important to stress that this hackathon is separate from the Rootstock Grants Program , but winners have a chance to be fast-tracked for an application. Rootstock Grants Program Rootstock Grants Program What needs to be delivered? By the end of the hackathon, you should have a smart contract deployed on Rootstock — as well as two on-chain transactions successfully executed in a testnet environment. Each project also needs to provide a GitHub repository with a descriptive README. A pitch video's also required where you demonstrate your product in action, and show off its key features. This is a great way to stand out from the competition! We've set up a dedicated submission form for all of these deliverables. How will submissions be judged? For the best chance of success, it's worth paying close attention to the judging criteria for this hackathon. The judging panel will be looking for original apps with never-before-seen utility — or an exciting new approach to an existing problem. Points are awarded for usable , well-designed apps that are intuitive and functional . usable intuitive functional Judges will be asking whether the end product is practical, meet a need in the marketplace, and would be eligible for a Rootstock grant. And they'll be reflecting on the amount of effort put in by the applicants. We want to see applicants who stretch themselves and push the boundaries of what's possible. What's the scoring criteria? Here's a breakdown of how each of these requirements will be weighted: Feature implementation

60%

Does the project work?



Software quality

20%

How well has the code been written?



Wow factor

10%

Does it go beyond what was asked?



Creativity

10%

Is it original and unexpected? Feature implementation

60%

Does the project work? Software quality

20%

How well has the code been written? Wow factor

10%

Does it go beyond what was asked? Creativity

10%

Is it original and unexpected? Feature implementation 60% Does the project work? Feature implementation Feature implementation Feature implementation 60% 60% 60% Does the project work? Does the project work? Does the project work? Software quality 20% How well has the code been written? Software quality Software quality Software quality 20% 20% 20% How well has the code been written? How well has the code been written? How well has the code been written? Wow factor 10% Does it go beyond what was asked? Wow factor Wow factor Wow factor 10% 10% 10% Does it go beyond what was asked? Does it go beyond what was asked? Does it go beyond what was asked? Creativity 10% Is it original and unexpected? Creativity Creativity Creativity 10% 10% 10% Is it original and unexpected? Is it original and unexpected? Is it original and unexpected? What are the prizes up for grabs? What are the prizes up for grabs? The total prize pool for this Rootstock hackathon is a cool $17,000. The project in first place will win $7,000 — with $4,000 for second, and $1,000 for third. A further $5,000 has been set aside for bounties. Remind me of the dates again? The hackathon is open from May 15 to June 7 — and winners will be paid between June 10 and 15. A fantastic opportunity Past Rootstock hackathons have been a resounding success — and winning teams have gone on to achieve amazing things. This is a chance to show off your coding skills to the world, meet like-minded developers, and become part of a vibrant community. If all of this wasn't enough, Rootstock is a great blockchain to build on. More than 140 dApps have already been built on this Layer 2 network, which offers considerably lower fees than both Bitcoin and Ethereum. So… what are you waiting for? It's time to start building better on Bitcoin! Register to the Bitcoin Meets Solidity hackathon now. Register to the Bitcoin Meets Solidity hackathon now. Register to the Bitcoin Meets Solidity hackathon now. About Rootstock Rootstock is the first, biggest, and longest-lasting Bitcoin sidechain. It is the only Bitcoin layer 2 that combines the security of Bitcoin's proof-of-work, with Ethereum's smart contract capabilities. Rootstock is open-source, EVM-compatible, and secured by over 60% of Bitcoin’s hashing power, which makes it a gateway to a vibrant ecosystem of dApps that continues to evolve to become fully trustless. Website | X | Developer Portal | Discord | Youtube | Blog Website | X | Developer Portal | Discord | Youtube | Blog Website Website X X Developer Portal Developer Portal Discord Discord Youtube Youtube Blog Blog

Join the Bitcoin Meets Solidity Hackathon, Compete for $17,000 in Prizes!

বিটকয়েন মিটস সলিডিটি হ্যাকাথনে যোগ দিন, $17,000 পুরস্কারের জন্য প্রতিযোগিতা করুন!

Nehmen Sie am Bitcoin Meets Solidity Hackathon teil und konkurrieren Sie um Preise im Wert von 17.000 $!

Únase al Hackathon Bitcoin Meets Solidity, ¡compita por $17,000 en premios!

Rejoignez le hackathon Bitcoin Meets Solidity et participez à la compétition pour remporter 17 000 $ de prix !

बिटकॉइन मीट्स सॉलिडिटी हैकथॉन में शामिल हों, $17,000 के पुरस्कार के लिए प्रतिस्पर्धा करें!

Bitcoin Meets Solidity ハッカソンに参加して、賞金 17,000 ドルを競い合いましょう。

Bitcoin Meets Solidity Hackathon에 참여하여 $17,000의 상금을 놓고 경쟁하세요!

Participe do Hackathon Bitcoin Meets Solidity e concorra a US$ 17.000 em prêmios!

Присоединяйтесь к хакатону Bitcoin Meets Solidity и поборитесь за призы в размере 17 000 долларов США!

Bitcoin Meets Solidity Hackathon'a katılın, 17.000$ Ödül için yarışın!

Tham gia cuộc thi Hackathon Bitcoin Meets Solidity, tranh tài để giành giải thưởng trị giá 17.000 USD!

参加比特币与 Solidity 黑客马拉松，争夺 17,000 美元的奖金！

Authors:
(1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de);
(2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de);
(3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de);
(4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Table of Links Abstract and 1 Introduction 2 Background 3 Design and Implementation of Licma and 3.1 Design 3.2 Implementation 4 Methodology and 4.1 Searching and Downloading Python Apps 4.2 Comparison with Previous Studies 5 Evaluation and 5.1 GitHub Python Projects 5.2 MicroPython 6 Comparison with previous studies 7 Threats to Validity 8 Related Work 9 Conclusion, Acknowledgments, and References 4 METHODOLOGY To analyze Python applications, we constructed two distinct data sets of popular Python and MicroPython projects. Furthermore, we compared our findings in Python programs with previous studies about Java and C code. 4.1 Searching and Downloading Python Apps Both data sets represent very different domains where Python is used, ranging from server and desktop use to low-level embedded code. How we selected the projects in both data sets for our empirical study is described in the following. 4.1.1 Python Projects from GitHub. For our evaluation of crypto misuses in Python code we focus on open-source code. Thus, we crawled and downloaded the top 895 Python repositories from GitHub sorted by stars. To further understand the influence of dependencies, we downloaded them with Pythons standard dependency manager pip for each project. Afterwards, we ended up with 14,442 Python packages of which 3,420 are unique. As our analysis works upon a per-file basis, we reduced our set to only those source code files that include the function calls referenced in our rules, e.g., AES.new (...) . In addition, we filter for production code and ignore test code which should be non-existent during the execution of the application. After applying these 2 filter steps, we ended up with 946 source files from 155 different repositories. Unfortunately, Babelfish was unable to parse 35 of these files, and reached the maximum recursion depth for the AST XPath queries for at least one rule in 50 files. These 85 parsing failures are distributed amongst 61 different projects. However, for each of the projects at least 1 file with a crypto usage was analyzed successfully. In total, we successfully analyzed 861 different files within 155 Python repositories with LICMA. 4.1.2 Curated Top MicroPython Projects. As an extension to our Python application set, we crawled 51 MicroPython projects which are stated as the top announced MicroPython projects[5]. Like for the regular Python applications, we downloaded all dependencies with pip and got 113 dependencies with 1 duplicate dependency. Afterwards, we applied the same filter steps as before: The usage of crypto and the exclusion of test files. These steps, resulted in 5 files which seem to use the Python crypto libraries supported by LICMA. Note that we included the MicroPython crypto library ucryptolib in LICMA and our filtering steps. To further understand this small number of potential usages, we also analyzed our data set of MicroPython applications manually. This analysis reveals that we potentially missed five crypto usages. This paper is available on arxiv under CC BY 4.0 DEED license. [5] https://awesomeopensource.com/projects/micropython Lead image by Roman Synkevych on Unplash Authors: (1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de); (2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de); (3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de); (4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Authors: Authors: (1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de); (2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de); (3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de); (4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2 Background 2 Background 3 Design and Implementation of Licma and 3.1 Design 3 Design and Implementation of Licma and 3.1 Design 3.2 Implementation 3.2 Implementation 4 Methodology and 4.1 Searching and Downloading Python Apps 4 Methodology and 4.1 Searching and Downloading Python Apps 4.2 Comparison with Previous Studies 4.2 Comparison with Previous Studies 5 Evaluation and 5.1 GitHub Python Projects 5 Evaluation and 5.1 GitHub Python Projects 5.2 MicroPython 5.2 MicroPython 6 Comparison with previous studies 6 Comparison with previous studies 7 Threats to Validity 7 Threats to Validity 8 Related Work 8 Related Work 9 Conclusion, Acknowledgments, and References 9 Conclusion, Acknowledgments, and References 4 METHODOLOGY To analyze Python applications, we constructed two distinct data sets of popular Python and MicroPython projects. Furthermore, we compared our findings in Python programs with previous studies about Java and C code. 4.1 Searching and Downloading Python Apps Both data sets represent very different domains where Python is used, ranging from server and desktop use to low-level embedded code. How we selected the projects in both data sets for our empirical study is described in the following. 4.1.1 Python Projects from GitHub. For our evaluation of crypto misuses in Python code we focus on open-source code. Thus, we crawled and downloaded the top 895 Python repositories from GitHub sorted by stars. To further understand the influence of dependencies, we downloaded them with Pythons standard dependency manager pip for each project. Afterwards, we ended up with 14,442 Python packages of which 3,420 are unique. 4.1.1 Python Projects from GitHub. As our analysis works upon a per-file basis, we reduced our set to only those source code files that include the function calls referenced in our rules, e.g., AES.new (...) . In addition, we filter for production code and ignore test code which should be non-existent during the execution of the application. After applying these 2 filter steps, we ended up with 946 source files from 155 different repositories. Unfortunately, Babelfish was unable to parse 35 of these files, and reached the maximum recursion depth for the AST XPath queries for at least one rule in 50 files. These 85 parsing failures are distributed amongst 61 different projects. However, for each of the projects at least 1 file with a crypto usage was analyzed successfully. In total, we successfully analyzed 861 different files within 155 Python repositories with LICMA . Babelfish LICMA 4.1.2 Curated Top MicroPython Projects . As an extension to our Python application set, we crawled 51 MicroPython projects which are stated as the top announced MicroPython projects[5]. Like for the regular Python applications, we downloaded all dependencies with pip and got 113 dependencies with 1 duplicate dependency. Afterwards, we applied the same filter steps as before: The usage of crypto and the exclusion of test files. These steps, resulted in 5 files which seem to use the Python crypto libraries supported by LICMA. Note that we included the MicroPython crypto library ucryptolib in LICMA and our filtering steps. To further understand this small number of potential usages, we also analyzed our data set of MicroPython applications manually. This analysis reveals that we potentially missed five crypto usages. 4.1.2 Curated Top MicroPython Projects This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv [5] https://awesomeopensource.com/projects/micropython https://awesomeopensource.com/projects/micropython Lead image by Roman Synkevych on Unplash Lead image by Roman Synkevych on Unplash Roman Synkevych on Unplash

How We Analyzed Crypto API Misuses in 895 GitHub Projects

Authors:
(1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de);
(2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de);
(3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de);
(4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Table of Links Abstract and 1 Introduction 2 Background 3 Design and Implementation of Licma and 3.1 Design 3.2 Implementation 4 Methodology and 4.1 Searching and Downloading Python Apps 4.2 Comparison with Previous Studies 5 Evaluation and 5.1 GitHub Python Projects 5.2 MicroPython 6 Comparison with previous studies 7 Threats to Validity 8 Related Work 9 Conclusion, Acknowledgments, and References 5.2 MicroPython When we applied LICMA upon the 5 source files containing crypto API usages of the MicroPython data set, we identified no misuse. For this reason, we inspected the MicroPython repositories for usages of other crypto functions not covered by LICMA and identified 5 additional files. We notice that the crypto module ucryptolib which is provided by MicroPython, is only used by tests in 2 projects. For the remaining 3 findings, the crypto functions are written in C rather than Python. Thus, these files were removed due to our filter steps described in Section 4.1.2. Our small analysis of MicroPython projects shows that for further exploration of MicroPython applications, we need to consider custom implementations of AES in Python and C. This seems to be a common pattern for embedded code where performance is important and low-level code is often shipped as custom C blobs. Thus, we can observe the importance of hybrid analysis approaches [5, 10]. This paper is available on arxiv under CC BY 4.0 DEED license. Authors: (1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de); (2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de); (3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de); (4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Authors: Authors: (1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de); (2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de); (3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de); (4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2 Background 2 Background 3 Design and Implementation of Licma and 3.1 Design 3 Design and Implementation of Licma and 3.1 Design 3.2 Implementation 3.2 Implementation 4 Methodology and 4.1 Searching and Downloading Python Apps 4 Methodology and 4.1 Searching and Downloading Python Apps 4.2 Comparison with Previous Studies 4.2 Comparison with Previous Studies 5 Evaluation and 5.1 GitHub Python Projects 5 Evaluation and 5.1 GitHub Python Projects 5.2 MicroPython 5.2 MicroPython 6 Comparison with previous studies 6 Comparison with previous studies 7 Threats to Validity 7 Threats to Validity 8 Related Work 8 Related Work 9 Conclusion, Acknowledgments, and References 9 Conclusion, Acknowledgments, and References 5.2 MicroPython When we applied LICMA upon the 5 source files containing crypto API usages of the MicroPython data set, we identified no misuse. For this reason, we inspected the MicroPython repositories for usages of other crypto functions not covered by LICMA and identified 5 additional files. We notice that the crypto module ucryptolib which is provided by MicroPython, is only used by tests in 2 projects. For the remaining 3 findings, the crypto functions are written in C rather than Python. Thus, these files were removed due to our filter steps described in Section 4.1.2. LICMA LICMA Our small analysis of MicroPython projects shows that for further exploration of MicroPython applications, we need to consider custom implementations of AES in Python and C. This seems to be a common pattern for embedded code where performance is important and low-level code is often shipped as custom C blobs. Thus, we can observe the importance of hybrid analysis approaches [5, 10]. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv

MicroPython Analysis: Exploring Crypto API Usage and Custom Implementations

Authors:
(1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de);
(2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de);
(3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de);
(4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Table of Links Abstract and 1 Introduction 2 Background 3 Design and Implementation of Licma and 3.1 Design 3.2 Implementation 4 Methodology and 4.1 Searching and Downloading Python Apps 4.2 Comparison with Previous Studies 5 Evaluation and 5.1 GitHub Python Projects 5.2 MicroPython 6 Comparison with previous studies 7 Threats to Validity 8 Related Work 9 Conclusion, Acknowledgments, and References 5 EVALUATION In this Section, we present our evaluation of crypto misuses in real-world Python applications from GitHub and MicroPython projects. 5.1 GitHub Python Projects Overall, LICMA identified 1,501 possible misuses in our data set of Python applications attributed to 81 repositories. Thus, 52.26 % of the 155 analyzed Python applications that contain crypto usages have at least one misuse. As discussed in Section 3.1, we distinguish between potential and definite misuses. While a potential misuse requires a manual inspection to decide whether it is harmful, a definite misuse indicates that the analysis was able to resolve the respective crypto parameter. Thus, we know that a rule of LICMA is definitely violated by the respective API call. We identified 85 definite misuses which could be identified within one class file and thus are local. The remaining 1,416 misuses are potential misuses. 5.1.1 Dependencies. From the 1,501 misuses, only 7.00 % are within the application code and not in dependencies. These misuses are within 14.81 % of the applications with at least one misuse. The remaining misuses are found in dependencies and can be reduced to 290 unique misuses. Thus, developers introduce most of their misuses by using dependencies rather than using the respective crypto library directly. In total, only 12 projects are affected by misuses in the application code itself. To understand the influence of dependencies within the applications with the most misuses, we inspected the 10 Python projects with more than 30 misuses. Figure 2 confirms the previous observation that most of the misuses are in dependencies and only a few projects use a crypto library directly. The Scapy repository[6] is an exception as all misuses are in its code. Our investigation reveals that this repository is often used as a dependency by other projects. Thus, these findings can be attributed to dependencies as well. While, the previous results focused on the projects, we also inspected the dependencies causing most of the misuses. In total, 5 of the observed dependencies are responsible for a misuse in more than 10 different projects. For 34 projects we observe a misuse within the repository Scapy which was the only analyzed repository in Figure 2 without any misuse in its dependencies. Thus, confirming our previous observation about this project. 5.1.2 Rules and Python Cryptographic Libraries. In order to get a better understanding of the underlying reasons of the misuses, we evaluated how often a misuse per rule and library occurs (Fig. 3). Our analysis reveals that most of the misuses are related to the use of different block modes, §1 and §2, of the M2Crypto library, and constant encryption keys, §3, for the cryptography library. We assume that the few numbers of misuses of §1 and §2 of cryptography are due to the design of the library. The library suggests to use a high-level symmetric encryption class, called Fernet, instead of the low-level symmetric encryption classes which would enable the respective misuses. Most of the misuses due to insecure PBE configurations, §4 and §5, are by developers using the library PyCrypto. While, none of the 3 previously mentioned libraries make it impossible to produce a misuse of one of our 5 rules, the library PyNaCl completely prevents misuses for §1, §2, and §5. In our study, we found only 2 instances of a misuse due to a constant encryption key for PyNaCl. 5.1.3 Reasons for Definite Misuses. Among the definite misuses, there is at least one misuse for all previously discussed rules. We identified 13 definite misuses in 5 different projects which use the ECB encryption mode (§1). In all cases, the mode is passed explicitly with the parameter and not implicitly as in Java [4]. For 8 misuses we observed that a static IV is used, e.g. zero bytes, and thus resulting in an insecure encryption with the block mode CBC (§2). Furthermore, we identified that the scapy project which is also commonly used as a dependency uses a constant encryption key resulting in 14 misuses (§3). For example, we found a zero byte-array as key. For password-based encryption, we identified 18 misuses within 14 projects which pass a static salt instead of a randomly generated one (§4). In total, we identify 32 misuses which are due to requesting only 1 iteration instead of an value greater than 1,000 as recommended (§5). Thus, the process of generating a password is faster but very insecure, e.g., due to dictionary attacks. This paper is available on arxiv under CC BY 4.0 DEED license. [6] https://github.com/secdev/scapy Authors: (1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de); (2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de); (3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de); (4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Authors: Authors: (1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de); (2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de); (3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de); (4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2 Background 2 Background 3 Design and Implementation of Licma and 3.1 Design 3 Design and Implementation of Licma and 3.1 Design 3.2 Implementation 3.2 Implementation 4 Methodology and 4.1 Searching and Downloading Python Apps 4 Methodology and 4.1 Searching and Downloading Python Apps 4.2 Comparison with Previous Studies 4.2 Comparison with Previous Studies 5 Evaluation and 5.1 GitHub Python Projects 5 Evaluation and 5.1 GitHub Python Projects 5.2 MicroPython 5.2 MicroPython 6 Comparison with previous studies 6 Comparison with previous studies 7 Threats to Validity 7 Threats to Validity 8 Related Work 8 Related Work 9 Conclusion, Acknowledgments, and References 9 Conclusion, Acknowledgments, and References 5 EVALUATION In this Section, we present our evaluation of crypto misuses in real-world Python applications from GitHub and MicroPython projects. 5.1 GitHub Python Projects Overall, LICMA identified 1,501 possible misuses in our data set of Python applications attributed to 81 repositories. Thus, 52.26 % of the 155 analyzed Python applications that contain crypto usages have at least one misuse. LICMA As discussed in Section 3.1, we distinguish between potential and definite misuses. While a potential misuse requires a manual inspection to decide whether it is harmful, a definite misuse indicates that the analysis was able to resolve the respective crypto parameter. Thus, we know that a rule of LICMA is definitely violated by the respective API call. We identified 85 definite misuses which could be identified within one class file and thus are local. The remaining 1,416 misuses are potential misuses. LICMA 5.1.1 Dependencies. From the 1,501 misuses, only 7.00 % are within the application code and not in dependencies. These misuses are within 14.81 % of the applications with at least one misuse. The remaining misuses are found in dependencies and can be reduced to 290 unique misuses. Thus, developers introduce most of their misuses by using dependencies rather than using the respective crypto library directly. In total, only 12 projects are affected by misuses in the application code itself. 5.1.1 Dependencies. To understand the influence of dependencies within the applications with the most misuses, we inspected the 10 Python projects with more than 30 misuses. Figure 2 confirms the previous observation that most of the misuses are in dependencies and only a few projects use a crypto library directly. The Scapy repository[6] is an exception as all misuses are in its code. Our investigation reveals that this repository is often used as a dependency by other projects. Thus, these findings can be attributed to dependencies as well. Scapy While, the previous results focused on the projects, we also inspected the dependencies causing most of the misuses. In total, 5 of the observed dependencies are responsible for a misuse in more than 10 different projects. For 34 projects we observe a misuse within the repository Scapy which was the only analyzed repository in Figure 2 without any misuse in its dependencies. Thus, confirming our previous observation about this project. 5.1.2 Rules and Python Cryptographic Libraries. In order to get a better understanding of the underlying reasons of the misuses, we evaluated how often a misuse per rule and library occurs (Fig. 3). Our analysis reveals that most of the misuses are related to the use of different block modes, §1 and §2, of the M2Crypto library, and constant encryption keys, §3, for the cryptography library. We assume that the few numbers of misuses of §1 and §2 of cryptography are due to the design of the library. The library suggests to use a high-level symmetric encryption class, called Fernet , instead of the low-level symmetric encryption classes which would enable the respective misuses. Most of the misuses due to insecure PBE configurations, §4 and §5, are by developers using the library PyCrypto. While, none of the 3 previously mentioned libraries make it impossible to produce a misuse of one of our 5 rules, the library PyNaCl completely prevents misuses for §1, §2, and §5. In our study, we found only 2 instances of a misuse due to a constant encryption key for PyNaCl . 5.1.2 Rules and Python Cryptographic Libraries. M2Crypto cryptography Fernet PyNaCl 5.1.3 Reasons for Definite Misuses. Among the definite misuses, there is at least one misuse for all previously discussed rules. We identified 13 definite misuses in 5 different projects which use 5.1.3 Reasons for Definite Misuses. the ECB encryption mode (§1). In all cases, the mode is passed explicitly with the parameter and not implicitly as in Java [4]. For 8 misuses we observed that a static IV is used, e.g. zero bytes, and thus resulting in an insecure encryption with the block mode CBC (§2). Furthermore, we identified that the scapy project which is also commonly used as a dependency uses a constant encryption key resulting in 14 misuses (§3). For example, we found a zero byte-array as key. IV is used, e.g. zero bytes, and thus resulting in an insecure encryption with the block mode CBC (§2). Furthermore, we identified that the scapy For password-based encryption, we identified 18 misuses within 14 projects which pass a static salt instead of a randomly generated one (§4). In total, we identify 32 misuses which are due to requesting only 1 iteration instead of an value greater than 1,000 as recommended (§5). Thus, the process of generating a password is faster but very insecure, e.g., due to dictionary attacks. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv [6] https://github.com/secdev/scapy https://github.com/secdev/scapy

Stories, News & Mentions about REPOSITE

Reposite’s Stories on HackerNoon