Get the most recent info and news about SaferMe on HackerNoon, where 10k+ technologists publish stories for 4M+ monthly readers.

The Leader In Contact Tracing For Business. Used in over 30 countries around the world. Learn how to get you people back to work safely

SaferMe

saferme

To serve aspiring entrepreneurs within the skilled trades industry, The Home Depot Foundation is partnering with Bunker Labs to introduce an entrepreneurship program designed to guide U.S ...

The Home Depot Foundation Creates New Skilled Trades Opportunities

The wearable device produced by SaferMe comes in the form of a card attached to a lanyard that should be worn unobstructed around the neck. Using Bluetooth technology to record when it comes close ...

Contact tracing device plans at Maui school spur protests

What Are the Top Startups in Oceania?

Hi all! My name is Taras Egorov; I'm an engineer at inDrive. I'll show you how we set up an infrastructure capable of running more than 5,000 tests per day on iOS and Android devices combined. The secret is simple: we used Selenoid. Preface Last year, our colleagues conducted a study of auto testing, and we took part in a survey as part of the study. We were pleased with the survey's findings, so we decided to write an article to share our experience with you and get some advice in return. We thought it a good idea to divide the material into two parts: the first one focusing on Android and the second on iOS. Let's begin with Android. Running the tests on Android Selenoid is a tool for running and managing browsers and Android emulators in a Docker container. You can read more about this . popular in the documentation To write Appium tests, we use: Kotlin; JUnit 5; Maven. The first run. Setting up Selenoid Create a config file: browsers.json {

  "android": {

    "default": "10.0",

    "versions": {

      "10.0": {

        "image": "browsers/android:10.0",

        "port": "4444",

        "path": "/wd/hub"

      }

    }

  }

} The emulator image is specified in . The guys from have prepared ready-made images of Android emulators. You can check them out or . The images don't differ from each other in any way. image aerokube here here Let’s take the image as an example. The image must be downloaded beforehand: , otherwise the tests will not run: browsers/android:10.0 docker pull browsers/android:10.0 Original error: create container: Error response from daemon: No such image: browsers/android:10.0 The next step is to run Selenoid. We do that directly via , or there’s the option of using . docker Configuration Manager docker run -d \

           -v /var/run/docker.sock:/var/run/docker.sock \

           -v "$(pwd)/selenoid/config/":/etc/selenoid/:ro \

           -p 4444:4444 \

           --name selenoid \

           aerokube/selenoid:1.10.7 You can check to see if Selenoid is working properly by following the link in your browser: http://localhost:4444 You are using Selenoid 1.10.7! Specify the Selenoid address in the Appium tests in the driver: ...
val driver = AndroidDriver(URL("http://localhost:4444/wd/hub"), capabilities)
... Next, specify the link to the build in capabilities: ... 
capabilities.setCapability("appium:app", "https://storage.example.com/builds/app.apk")
... If unable to provide a link, you can specify the path to the build:** ...
capabilities.setCapability("appium:app", "/builds/app.apk")
... Where is the path inside the container where the emulator is being run. For this option to work properly, be sure to specify the in : /builds/app.apk volumes browsers.json {

  "android": {

    "default": "10.0",

    "versions": {

      "10.0": {

        ...

        "volumes": [

          "/home/username/app.apk:/builds/app.apk:ro"

        ]

        ...

      }

    }

  }

} Where is the path to the build on the host platform. /home/username/app.apk That's it, we've almost set up Selenoid, and now we can try running the tests: ./mvnw test But, unfortunately, the tests will not be able to run. Let's look into this and see what's wrong. The second run. Taking a look at the logs and video The first thing to do after a failed startup is to check out the Selenoid logs: docker logs selenoid [INIT] [Loading configuration files...]
[INIT] [Loaded configuration from /etc/selenoid/browsers.json]
[INIT] [Video Dir: /opt/selenoid/video]
[INIT] [Your Docker API version is 1.41]
[INIT] [Timezone: UTC]
[INIT] [Listening on :4444]
[NEW_REQUEST] [unknown] [172.17.0.1]
[NEW_REQUEST_ACCEPTED] [unknown] [172.17.0.1]
[LOCATING_SERVICE] [android] [10.0]
[USING_DOCKER] [android] [10.0]
[CREATING_CONTAINER] [selenoid/android:10.0]
[STARTING_CONTAINER] [selenoid/android:10.0] [75e454341da7fc4b58ba104a5180813bac6cd7c124037a759b6c976e65b168fa]
[CONTAINER_STARTED] [selenoid/android:10.0] [75e454341da7fc4b58ba104a5180813bac6cd7c124037a759b6c976e65b168fa] [0.40s]
[0] [REMOVING_CONTAINER] [75e454341da7fc4b58ba104a5180813bac6cd7c124037a759b6c976e65b168fa]
[0] [CONTAINER_REMOVED] [75e454341da7fc4b58ba104a5180813bac6cd7c124037a759b6c976e65b168fa]
[0] [SERVICE_STARTUP_FAILED] [http://172.17.0.3:4444/wd/hub does not respond in 30s] We see that the status is SERVICE_STARTUP_FAILED. Go to the and look at the status value: documentation SERVICE_STARTUP_FAILED - Failed to start Docker container or driver binary The error doesn’t tell you much, and more information is required. It would be good to take a look at the container logs. Let's do that by enabling logging: docker run -d \

           -p 4444:4444 \

           -v /var/run/docker.sock:/var/run/docker.sock \

           -v "$(pwd)/selenoid/config/":/etc/selenoid/:ro \

           -v  "$(pwd)/selenoid/logs/":/opt/selenoid/logs/ \

           aerokube/selenoid:1.10.7 \

           -log-output-dir /opt/selenoid/logs We also enable logs in the Capabilities section: ...
capabilities.setCapability("enableLog", true)
... Run the tests and review the logs using the browser : http://localhost:4444/logs/ 2023-04-16T13:44:43.909768530Z Waiting X server...
2023-04-16T13:44:44.009494775Z Logging to: /tmp/fluxbox.log
2023-04-16T13:44:44.047587277Z Waiting X server...
2023-04-16T13:44:44.151933325Z Waiting X server...
2023-04-16T13:44:44.262850410Z * daemon not running; starting now at tcp:5037
2023-04-16T13:44:44.457972956Z * daemon started successfully
2023-04-16T13:44:44.458249266Z adb: no devices/emulators found
2023-04-16T13:44:45.463480812Z adb: no devices/emulators found
2023-04-16T13:44:46.471547723Z adb: no devices/emulators found
2023-04-16T13:44:47.476093515Z adb: no devices/emulators found
2023-04-16T13:44:48.481987351Z adb: no devices/emulators found
2023-04-16T13:44:49.486503149Z adb: no devices/emulators found
2023-04-16T13:44:50.492757801Z adb: no devices/emulators found
2023-04-16T13:44:51.499094108Z adb: no devices/emulators found
2023-04-16T13:44:52.505862428Z adb: no devices/emulators found
2023-04-16T13:44:53.513276412Z adb: no devices/emulators found
2023-04-16T13:44:54.520642210Z adb: no devices/emulators found
2023-04-16T13:44:55.527420189Z adb: no devices/emulators found
2023-04-16T13:44:56.534631013Z adb: no devices/emulators found
2023-04-16T13:44:57.316094939Z WARNING. Using fallback path for the emulator registration directory.
2023-04-16T13:44:57.335415397Z checkValid: hw configs not eq
2023-04-16T13:44:57.541959741Z adb: device offline
2023-04-16T13:44:58.547907700Z adb: device offline
2023-04-16T13:44:58.565504866Z emulator: WARNING: System image is writable
2023-04-16T13:44:58.565528396Z emulator: Cold boot: different AVD configuration
2023-04-16T13:44:58.565532576Z Your emulator is out of date, please update by launching Android Studio:
2023-04-16T13:44:58.565536346Z  - Start Android Studio
2023-04-16T13:44:58.565539506Z  - Select menu "Tools > Android > SDK Manager"
2023-04-16T13:44:58.565543076Z  - Click "SDK Tools" tab
2023-04-16T13:44:58.565546216Z  - Check "Android Emulator" checkbox
2023-04-16T13:44:58.565549216Z  - Click "OK"
2023-04-16T13:44:58.565552146Z 
2023-04-16T13:44:59.554451514Z adb: device offline
2023-04-16T13:45:00.560926060Z adb: device offline
2023-04-16T13:45:01.568777440Z adb: device offline
2023-04-16T13:45:12.124226047Z emulator: INFO: boot completed
2023-04-16T13:45:12.124251007Z emulator: INFO: boot time 27848 ms
2023-04-16T13:45:12.124255077Z emulator: Increasing screen off timeout, logcat buffer size to 2M.
2023-04-16T13:45:12.152557294Z emulator: Revoking microphone permissions for Google App. The container logs are not much help here either, because you can't see the Appium logs. Now let's try to enable them. To do this, let's look at the script : entry point.sh ...
if [ -z "$VERBOSE" ]; then
    APPIUM_ARGS="$APPIUM_ARGS --log-level error"
else
    EMULATOR_ARGS="$EMULATOR_ARGS -verbose"
fi
... To enable Appium logs, the parameters and : must be passed to the container: VERBOSE=true APPIUM_ARGS=--log-level debug {

  "android": {

    "default": "10.0",

    "versions": {

      "10.0": {

        ...

        "env": [

          "VERBOSE=true",

          "APPIUM_ARGS=--log-level debug"

        ]

        ...

      }

    }

  }

} To enable Appium to debug logs, you need to pass VERBOSE; in this case, the emulator logs turn on and start filling the "ether"” But we fixed that for future images =) Now it is enough to pass to . APPIUM_ARGS=-log-level debug ...
[HTTP] --> POST /wd/hub/session/c89fa9c2-ca2b-49cd-ab31-590eeccf77d1/element
[HTTP] {"using":"id","value":"authorization_edittext_phone"}
[debug] [W3C (c89fa9c2)] Calling AppiumDriver.findElement() with args: ["id","authorization_edittext_phone","
c89fa9c2-ca2b-49cd-ab31-590eeccf77d1"]
[debug] [BaseDriver] Valid locator strategies for this request: xpath, id, class name, accessibility id, -and
roid uiautomator
[debug] [BaseDriver] Waiting up to 0 ms for condition
[debug] [WD Proxy] Matched '/element' to command name 'findElement'
[debug] [WD Proxy] Proxying [POST /element] to [POST http://127.0.0.1:8200/wd/hub/session/65943f03-3b35-4d3eb221-d6dc7988f935/element] with body: {"strategy":"id","selector":
"authorization_edittext_phone","context":"","multiple":false}
[WD Proxy] Got response with status 404: {"sessionId":"65943f03-3b35-4d3e-b221-d6dc7988f935","value":{"error"
:"no such element","message":"An element could not be located on the page using the given search parameters","stacktrace":"io.appium.uiautomator2.common.exceptions.El
ementNotFoundException: An element could not be located on the page using the given search parameters\n\tat io.appium.uiautomator2.handler.FindElement.safeHandle(Find
Element.java:73)\n\tat io.appium.uiautomator2.handler.request.SafeRequestHandler.handle(SafeRequestHandler.java:41)\n\tat io.appium.uiautomator2.server.AppiumServlet.
handleRequest(AppiumServlet.java:253)\n\tat io.appium.uiautomator2.server.AppiumServlet.handleHttpRequest(AppiumServlet.java:247)\n\tat io.appium.uiautomator2.http.Se
rverHandler.channelRead(ServerHandler.java:68)\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:366)\n\tat io
.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:352)\n\tat io.netty.chann...
[debug] [W3C] Matched W3C error code 'no such element' to NoSuchElementError
[debug] [W3C (c89fa9c2)] Encountered internal error running command: NoSuchElementError: An element could not
be located on the page using the given search parameters.
[debug] [W3C (c89fa9c2)]     at AndroidUiautomator2Driver.findElOrEls (/opt/node_modules/appium/node_modules/appium-android-driver/lib/commands/find.js:75:11)
[debug] [W3C (c89fa9c2)]     at process._tickCallback (internal/process/next_tick.js:68:7)
[HTTP] <-- POST /wd/hub/session/c89fa9c2-ca2b-49cd-ab31-590eeccf77d1/element 404 23 ms - 444
... As seen from the logs, Appium cannot find our element. Let's see what is happening on the emulator screen. To do this, we have to run the Selenoid UI: docker run -d \

           --name selenoid-ui \

           -p 8080:8080 \

           --link selenoid:selenoid \

           aerokube/selenoid-ui:1.10.4 \

           --selenoid-uri "http://selenoid:4444" Go to and open the Selenoid UI: http://0.0.0.0:8080 Be sure to enable VNC and video recording in the tests: ...

capabilities.setCapability("enableVNC", true)

capabilities.setCapability("enableVideo", true)

... The Selenoid startup command ends up looking like this: docker run -d \

-v /var/run/docker.sock:/var/run/docker.sock \

-v "(pwd)/selenoid/logs/":/opt/selenoid/logs/ \

-v /opt/selenoid/video/:/opt/selenoid/video/ \

-e OVERRIDE_VIDEO_OUTPUT_DIR="/opt/selenoid/video/" \

-p 4444:4444 \

-name selenoid \

aerokube/selenoid:1.10.7 \

-log-output-dir /opt/selenoid/logs Open the Selenoid UI once the tests are up and running: And here's . a video of it https://www.youtube.com/watch?v=Hm7s5ZjnVYQ&embedable=true We found the cause of the startup error. Great! Let’s move on. The third run. Building an emulator image As it turns out, the images of Selenoid emulators won’t work without Google Play services. To remedy this situation, you must build an emulator image yourself. The guys from aerokube have assembled everything you need for this: and . a repository with photos documentation the repository. Downloading Go to the folder. selenium Run the script and answer the questions. This is what it looks like in our case: ./automate_android.sh Specify Appium version: [1.18.1]

>> 1.18.1

Specify Android image type (possible values: "default", "google_apis", "google_apis_playstore", "android-tv", "android-wear"): [default]

>> google_apis

Specify Application Binary Interface (possible values: "armeabi-v7a", "arm64-v8a", "x86", "x86_64"): [x86]

>> x86

Specify Android version: [8.1]

>> 10.0

Specify device preset name if needed (e.g. "Nexus 4"):

>>

Specify SD card size, Mb: [500]

>>

Specify userdata.img size, Mb: [500]

>>

Are you building a Chrome Mobile image (for mobile web testing): [n]

>> y

Specify Chromedriver version if needed (required for Chrome Mobile):

>> 74.0.3729.6

Specify image tag: [selenoid/chrome-mobile:74.0]

>> android-emulator:10.0

Add Android quick boot snapshot? [y]

>> n When I saw the question Add Android quick boot snapshot?, I thought it was an emulator . But if you look at the , it calls a , which is needed to install APK applications. Basically, it doesn't give us any gain. snapshot code script We already use snapshot emulators , but we'll talk about that in other articles. to speed up container launches Once the image is built, we will be prompted to push it into the registry. Since we don't need that yet, we will kindly decline the offer: Push?  >> n We have put together a build with Google Play services. Remember to change the image parameter in browsers.json, and restart Selenoid. Now let's try rerunning the tests: [INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------ And of the test run. here’s a video https://www.youtube.com/watch?v=w-uzB7hg7g8&t=1s&embedable=true To sum up What we have done: Configured Selenoid to run Android tests. Learned how to check out the logs and videos to troubleshoot. Built our own emulator image with Google Play services. Something else I would like to tell you about: Selenoid timeouts. If your app is large, you might run into problems with timeouts. How we tried making the container run faster. The video shows that the run takes about a minute or so. How we tried running native Android tests written in Espresso on Selenoid. Spoiler alert: this works! Meanwhile, in the next part, we'll tell you how we scaled up the infrastructure and ran tests on iOS.

How to Run 5000+ Tests on Mobile Devices Everyday; From inDrive's Playbook (Part 1)

কিভাবে প্রতিদিন মোবাইল ডিভাইসে 5000+ পরীক্ষা চালাবেন; ইনড্রাইভের প্লেবুক থেকে (পর্ব 1)

So führen Sie täglich über 5000 Tests auf Mobilgeräten durch; Aus dem Playbook von inDrive (Teil 1)

Cómo ejecutar más de 5000 pruebas en dispositivos móviles todos los días; Del libro de jugadas de InDrive (Parte 1)

Comment exécuter plus de 5 000 tests sur des appareils mobiles au quotidien ; Du Playbook d'InDrive (Partie 1)

मोबाइल उपकरणों पर प्रतिदिन 5000+ परीक्षण कैसे करें; इनड्राइव की प्लेबुक से (भाग 1)

モバイルデバイスで毎日 5000 件以上のテストを実行する方法; InDrive のプレイブックより (パート 1)

매일 모바일 장치에서 5000개 이상의 테스트를 실행하는 방법 inDrive의 플레이북(1부)에서

Como executar mais de 5.000 testes em dispositivos móveis todos os dias; Do manual do InDrive (parte 1)

Her Gün Mobil Cihazlarda 5000'den Fazla Test Nasıl Çalıştırılır; inDrive'ın Başucu Kitabı'ndan (Bölüm 1)

Cách chạy hơn 5000 bài kiểm tra trên thiết bị di động mỗi ngày; Từ Playbook của InDrive (Phần 1)

如何每天在移动设备上运行 5000 多个测试；来自 InDrive 的剧本（第 1 部分）

Engineering managers often rely on subjective clues to assess how their team is doing. But decisions made based on gut feel and imperfect measurements are less than ideal — sometimes they result in team success; other times they result in disappointment. Subjective measures need to be supplemented with objective data; with a combination of the two, managers are more likely to make choices that benefit their teams. When baseball managers learned this lesson, it got the Hollywood treatment. depicted the metrics-first approach to baseball management popularized by Billy Beane, then-manager of the Oakland A’s. Employing three lessons from Beane’s management approach can help engineering leaders drive productivity and efficiency on their teams. Moneyball Lesson #1: Use objective metrics Beane gained notoriety for prioritizing statistics over scouts’ instincts and consistency over flash. This approach is rooted in —  the field dedicated to “the search for objective knowledge about baseball” and statistical analysis of the sport. Though sabermetrics was founded by baseball fans, Beane applied this predilection for objectivity to managing his team. Rather than relying on scouts’ instincts, intangibles like a player’s footwork, or prestigious metrics like batting average, Beane favored a selection of under-appreciated metrics more closely correlated with consistent results. Historically, software development has been a field lacking in objective measurements. Classic workload estimates like can be useful for internal scoping but are too subjective to translate throughout an org; one team’s size “XL” project is another team’s “Medium.” Engineering leaders need objective measurements. Our version of sabermetrics involves analyzing the data generated by our own VCS, which is full of objective data about the number of Commits logged in a given period, or the length of time a Pull Request stays open before it’s picked up for review. Objective measurements can help engineering leaders measure progress across teams, projects, and quarters, and are instrumental in setting and achieving . sabermetrics T-shirt sizes effective departmental goals Lesson #2: Focus on leading indicators Of course, not all objective data is equally useful; one of the hallmarks of Beane’s strategy involved the careful selection of metrics. When recruiting, most managers looked at a player’s batting average — the number of times they hit a ball into fair territory and successfully reached first base, divided by their number of at-bats. Beane looked at their , or OBP, a measure of how often a batter reaches first base, even if they get there without actually hitting the ball. A player must be a good hitter to have a good batting average, but what puts them in a position to score a run is getting to first base. From a data-first perspective, the value of an at-bat is not in the hit itself but in the player’s two feet making it safely to first. Similarly, to the rest of the organization, your team may be defined by their most eye-catching stats and praised when they deploy a much-anticipated revenue-generating feature. But just as a player’s batting average doesn’t account for every time they get on base, a list of features completed can only reveal so much about your team’s productivity. The true measure of your team’s success will be their ability to deliver value in a predictable, reliable manner. To track that, you’ll need to look past success metrics and dig into health metrics, measurements that can help you assess your team’s progress earlier in the process. For example, an engineering manager might look at “Time to Open,” which is a measure of the period between when a developer first logs a Commit in a Pull Request and when that Pull Request is finally opened. Code can’t move through your development pipeline until a Pull Request is opened, and . Time to Open is similar to OBP. It’s not a prestigious metric, but it’s a critical one. Just as you can’t score if you don’t get on base, your team can’t deploy code that never makes it to a Pull Request. As a manager, you need to make sure that developers are opening small, frequent Pull Requests. If they’re not, it may be worth reinforcing good code hygiene practices across your team and speaking directly with developers to determine whether there’s something particular that’s tripping them up in the codebase. on-base percentage smaller Pull Requests will move through your pipeline more quickly Lesson #3: Use Metrics in Context Of course, Beane’s approach wasn’t perfect. Metrics alone can’t tell you everything you need to know about a potential player, nor do they hold all of the answers when it comes to engineering. Data is useful, but leaning too strongly on one metric is shortsighted. Though Beane was famous for seeing the value in a player’s OBP, there’s also evidence that at times, he . Not every college player with a strong OBP was cut out to play professional baseball. While a scout might be able to differentiate between a promising young athlete and one who was unlikely to succeed, a metric can’t make that distinction. As an engineering leader, you need to rely on a combination of instinct and data. Start with how you feel — is your ? — and then use metrics to confirm or challenge your assumptions. When something is surprising, consider it a signal that you need to investigate further. You might need to or find new ways to . Beane’s approach to managing his team was headline-grabbing because it was revolutionary, representing a major shift in the way fans, commentators, and managers thought about the sport of baseball. Many of his groundbreaking strategies are now commonplace, having been adopted across the league. Data-informed engineering leadership is still at that revolutionary stage. It’s not standard practice to use objective engineering metrics to assess your team’s progress or guide its strategy, but it will be. relied too heavily on that one metric engineering team moving slow re-evaluate a broken process communicate within your team

Engineering Metrics: The Moneyball Approach

To help soothe the shock of returning to work after the holidays, we've started a new tradition over at and kick off the year with a good movie or two. Since it had to be something both entertaining and inspiring, we chose to go with a classic: , the 2011 film starring Brad Pitt. Waydev Moneyball Based on true events, it tells the story of Billy Bean, General Manager for the Oakland Athletics baseball team, who started using sabermetrics, an empirical analysis of baseball that uses statistics to improve team performance. Using this new metrics-based approach, Billy Bean propelled Oakland Athletics from a low-performing team to a spectacular success that shocked the sports world. They were able to rise from what looked like a slow but certain death to a spectacular series of successes with the team winning a whopping 20 consecutive games. Here’s what we’ve learned from watching it: Moneyball Business Lesson 1: Learn to embrace change (especially when it’s the only option) The movie reminded us that change is never easy and, many times it comes as the last resort – an option that is unpopular, unwanted and fraught with dangers. The story does not portray Bean as the visionary who chose to take a new path because he’s bored with the comfort of always doing the same things. He does it because the team was sinking, and it had become clear to him that going along with the old strategy would not get them anywhere. To him, it felt like the only option. Whether you are managing a sports team, a marketing or an , there will come a time when what seems like a big change could help reach daring goals. It’s not always going to come as a last resort (hopefully!) so the ability to spot opportunities and to take risks becomes a key skill that you can and should develop. If you are lucky, you might get plenty of time and opportunities to practice before being confronted with a radical situation. So, when was the last time you took a risk with your team? – switching to a new tool, changing the way you hold meetings, or looking at your team’s performance in a different light? engineering one Moneyball Business Lesson 2: There’s magic in numbers While the movie focuses on how the Oakland Athletics’ use of statistics helped shape a winning team and triggered some revolutionary changes in the world of baseball at the time, the same often applies in business. “ ” - Peter Brand, Moneyball People are overlooked for a variety of biased reasons and perceived flaws. Age, appearance, personality. […] mathematics cuts straight through that. No manager can afford to ignore the numbers. Whether you are looking at sales reports, financial projections, or a potentially new team structure – you are most likely making business . decisions based on thorough analysis and not gut feeling While managing a team of people is far more challenging than putting together a financial report, using stats to keep track of work volumes, project progress, and each team member’s contribution can be immensely valuable. Moneyball Business Lesson 3: Others will surely follow (but probably not when you need them to) There’s a powerful moment towards the end of the movie where the owner of the Boston Red Sox baseball team, realizing that sabermetrics will be the future of the game, says to Bean “I know you've taken it in the teeth out there, but (you are) the first guy through the wall. It always gets bloody, always. It's the threat of not just the way of doing business, but in their minds, it's threatening the game. […] And every time that happens, whether it's the government or a way of doing business or whatever it is, the people are holding the reins, have their hands on the switch”. Changes are scary and feel threatening to everyone, not just to the ones making them, so expect resistance from all sides. Eventually, others will follow, but only after they see that it works and that it was the right thing to do. After witnessing the amazing results that the Oakland Athletics were able to achieve, many others followed and using sabermetrics became the norm for many teams. Only two years after Billy Bean refused Boston Red Sox’ offer to join them as the general manager for a whopping $12.5 million salary, the Red Sox won the World Series using the strategy that he helped model. There’s clearly a lesson in that, but we’ll let you ponder what it could be. If you what to start tracking the output of your engineering team , you can do it now with tools like Gitprime , Code Climate or Waydev . The article was published first on Waydev Git Analytics Blog

3 Business Lessons We (Re)Learned (Re)Watching Moneyball at Waydev

As hot as stories about artificial intelligence (AI), augmented/virtual reality (AR/VR), blockchain , and the Internet of Things (IoT) have been in recent months, we often can’t help but think of these technologies as a long way off from mainstream adoption. Movies like Ready Player One and Avengers: Infinity Wars only perpetuate this perception by mixing real technologies with fantasy, making the tech we wield in the real world seem primitive in the process. The reality, though? AI, AR/VR, blockchain, and IoT are already playing an important role in our everyday lives, with countless examples hiding in plain sight. In Part One of our series, we look at Artificial Intelligence (AI) . Artificial Intelligence is NOT Killer Robots In pop culture, AI is often represented as a highly-evolved and self-aware artificial “brain” in a robot capable of overthrowing the human race, as in or . Ex Machina The Terminator movies In reality, AI is overwhelmingly beneficial to humans and is more often associated with software applications than with robots. And it’s already here, in applications we use every day. Mapping and Ridesharing Google Maps being able to predict your commute time or suggest the fastest possible way to work relies on , a form of AI which leverages the vastness of historical trip data to make predictions or decisions. So too does Uber or Uber Eats, when it tells you the estimated time it will take for your chow mein to arrive. machine learning (ML) What’s perhaps even more impressive is that Google is able to , and then use ML to keep Google Maps updated. use computer vision (CV), another form of artificial intelligence, to “read” street signs in images captured by its Street View cars Google Maps analyzes historical trip data to let you know how to go somewhere and how long it might take. Ecommerce and Customer Service By now, you’re probably aware that Amazon analyzes your shopping behavior on its website and shows you merchandise you’re the most likely to buy, based on past page browsing and purchase history. That’s ML/AI, too. So too is the Seattle tech giant’s Alexa, an AI assistant that can do everything from control your home appliances to help you order another box of diapers from Amazon. (How convenient!) It’s not just Amazon that’s investing heavily in AI assistants; Microsoft, Google, and Apple are a few others who have introduced such AI personalities to the world as Cortana, Google Assistant, and Siri, respectively. Machine learning algorithms are also being used to automate warehouse operations, allowing companies like Amazon to fulfill upon their lightning fast delivery expectations. Businesses that must provide customer service or support are now turning to AI-enabled chatbots, which are capable of interacting with customers without human input. These chatbots allow businesses to provide a level of service that most customers find acceptable for routine inquiries, without having to employ a large workforce of customer service reps. Dating & Social Networking The dating apps you (or your single friends) use are investing heavily into AI/machine-learning to provide even better matches for you to swipe left or right on. Tinder, for example, which uses AI-based matching to occasionally suggest four users it thinks you have a great chance to hit it off with, offering you a free “Super Like” to use on one of the four. (Using a “Super Like” increases a user’s likelihood of matching by three times, according to Tinder.) began testing a new feature last year called “Super Likeable,” Another ML feature in Tinder is the ability to have Tinder automatically use your best, most successful photos in an automated form of A/B testing. This is something a competing service, OKCupid, has implemented as well. When OKCupid users are not using their most effective photos, the app alerts them so they can change to a better photo. Dating apps (or even social networking apps, for that matter) that gain a mastery over machine learning algorithms will absolutely turn the industry on its head — imagine not having to swipe at all to meet your perfect match after your first month, because the app has learned exactly what you’re looking for. Tinder’s Super Likeable feature occasionally present you with four matches Tinder’s AI algorithms thinks are especially great for you. Advanced Analytics in Sports Are you a fan of the NBA? Computer vision (CV) and AI are becoming an important tool in every NBA team’s arsenal. Back in 2013, a company called SportsVu partnered with the NBA to provide six motion capture cameras in every NBA arena. The cameras generated data that was then able to be used to provide all kinds of machine learning-based observations that quickly proved superior to mere human observations. Today, a company called Second Spectrum has the rights to provide this rich motion capture data to every NBA team, and its services are a big reason why teams like the Golden State Warriors are all-in on “small ball” and three pointers. Major League Baseball (MLB) has been using artificial intelligence even longer than the NBA, as anyone who’s watched Moneyball probably knows. MLB teams use , or advanced in-game statistical data, to model game outcomes when using different lineups (such as pitchers), batting orders, or other tactics at a manager’s disposal. sabermetrics Music Recommendations Going back to consumer applications, if you’ve ever used Spotify’s , you’ve allowed (perhaps unwittingly) an AI to dictate your musical preferences. (Don’t feel bad, though; pretty soon, AI will tell us what to wear, eat, and do with our lives — and we’ll gladly listen!) “Discover Weekly” feature Spotify’s “Discover Weekly” uses machine learning to give you curated playlists of songs you “should” like. Avoiding Killer Robots Any responsible overview of artificial intelligence should introduce the idea of , the theoretical point at which super AI becomes capable of rapid self-improvement, such that it would no longer need humans and therefore could theoretically pursue our extinction. technological singularity So real is this possibility to some that Elon Musk, CEO of Tesla, has gone on the record to say: “With artificial intelligence, we are summoning the demon. You know all those stories where there’s the guy with the pentagram and the holy water and he’s like, yeah, he’s sure he can control the demon? Doesn’t work out.” However, most experts agree that this is a scenario we won’t need to worry about with proper governance and is not even likely to be in the cards until 2040–2050 at the earliest. (There’s no need to lock up your Roomba just yet.) Today and for the foreseeable future, AI is benign, pro-human, and is proving enormously valuable for companies that choose to implement it into their applications. “With regard to mobile apps, AI is one area in which we’re seeing massive interest. AI-enabled mobile apps are particularly interesting because anybody with a smartphone — even a 5 year old phone — running a well-developed app can tap into the wisdom of billions or trillions of data points from users who came before. That’s the beauty of cloud computing and AI,” explains Harry Lee, CEO of , a in Los Angeles and the San Francisco Bay Area. CitrusBits leading mobile app development agency In Part Two of our series, we’ll explore how Augmented Reality and Virtual Reality (AR/VR) are quickly becoming a modern reality and discuss some of the most interesting applications today.

“Future” Tech That’s Hiding in Plain Sight: Artificial Intelligence (Part 1 of 4)

Last week we dove into the world of dependent types. We linked tensors with their shapes at the type level. This gave our program some extra type safety and allowed us to avoid certain runtime errors. This week, we’re going to solve another runtime conundrum: missing placeholders. We’ll add some more dependent type machinery to ensure we’ve plugged in all the necessary placeholders! But we’ll see this is not as straightforward as shapes. To follow along with the code in this article, take a look at on my Haskell Tensor Flow Github repository! All the code for this article is in . As usual, I’ve listed the necessary compiler extensions and imports at the bottom of the article. If you want to run the code yourself, you’ll have to get Haskell and Tensor Flow running first. Take a look at our guide for that! this branch DepShape.hs Haskell Tensor Flow Now to start, let’s remind ourselves what placeholders are in Tensor Flow and how we use them. Placeholder Review Placeholders represent tensors that can have different values on different application runs. This is often the case when we’re training on different samples of data. Here’s our very simple example in Python. We’ll create a couple placeholder tensors by providing their shapes and no values. Then when we actually run the session, we’ll provide a value for each of those tensors. node1 = tf.placeholder(tf.float32)node2 = tf.placeholder(tf.float32)adderNode = tf.add(node1, node2)sess = tf.Session()result1 = sess.run(adderNode, {node1: 3, node2: 4.5 }) The weakness here is that there’s nothing forcing us to provide values for those tensors! We could try running our program without them and we’ll get a runtime crash: ...sess = tf.Session()result1 = sess.run(adderNode)print(result1)…

Terminal Output:

InvalidArgumentError (see above for traceback): You must feed a value for placeholder tensor 'Placeholder' with dtype float   [[Node: Placeholder = Placeholder[dtype=DT_FLOAT, shape=[], _device="/job:localhost/replica:0/task:0/cpu:0"]()]] Unfortunately, the Haskell Tensor Flow library doesn’t actually do any better here. When we want to fill in placeholders, we provide a list of “feeds”. But our program will still compile even if we pass an empty list! We’ll encounter similar runtime errors: (node1 :: Tensor Value Float) <- placeholder [1](node2 :: Tensor Value Float) <- placeholder [1]let adderNode = node1 `add` node2let runStep = \node1Feed node2Feed -> runWithFeeds [] adderNoderunStep (encodeTensorData [1] input1) (encodeTensorData [1] input2)…

Terminal Output:

TensorFlowException TF_INVALID_ARGUMENT "You must feed a value for placeholder tensor 'Placeholder_1' with dtype float and shape [1]\n\t [[Node: Placeholder_1 = Placeholder[dtype=DT_FLOAT, shape=[1], _device=\"/job:localhost/replica:0/task:0/cpu:0\"]()]]" In the and examples, we bury the call to within our neural network API. We only provide a object. This model object forces us to provide the expected input and output tensors. So anyone using our model wouldn't make a manual call. Iris MNIST runWithFeeds Model runWithFeeds data Model = Model  { train :: TensorData Float          -> TensorData Int64          -> Session ()  , errorRate :: TensorData Float              -> TensorData Int64              -> SummaryTensor              -> Session (Float, ByteString)  } This isn’t a bad solution! But it’s interesting to see how we can push the envelope with dependent types, so let’s try that! Adding More “Safe” Types The first step we’ll take is to augment Tensor Flow’s type. We’ll want it to have shape information like and . But we’ll also attach a name to each piece of data. This will allow us to identify which tensor to substitute the data in for. At the type level, we refer to this name as a . TensorData SafeTensor SafeShape Symbol data SafeTensorData a (n :: Symbol) (s :: [Nat]) where  SafeTensorData :: (TensorType a) => TensorData a -> SafeTensorData a n s Next, we’ll need to make some changes to our type. First, each will get a new type parameter. This parameter refers to a mapping of names (symbols) to shapes (which are still lists of naturals). We'll call this a placeholder list. So each tensor will have type-level information for the placeholders it depends on. Each different placeholder has a name and a shape. SafeTensor SafeTensor data SafeTensor v a (s :: [Nat]) (p :: [(Symbol, [Nat])]) where  SafeTensor :: (TensorType a) => Tensor v a -> SafeTensor v a s p Now, recall when we substituted for placeholders, we used a list of feeds. But this list had no information about the names or dimensions of its feeds. Let’s create a new type containing the different elements we need for our feeds. It should also contain the correct type information about the placeholder list. The first step of to define the type so that it has the list of placeholders it contains, like the . SafeTensor data FeedList (pl :: [(Symbol, [Nat])]) where This structure will look like a linked list, like our . Thus we’ll start by defining an “empty” constructor: SafeShape data FeedList (pl :: [(Symbol, [Nat])]) where  EmptyFeedList :: FeedList '[] Now we’ll add a “Cons”-like constructor by creating yet another type operator . Each “piece” of our linked list will contain two different items. First, the tensor we are substituting for. Next, it will have the data we’ll be using for the substitution. We can use type parameters to force their shapes and data types to match. Then we need the resulting placeholder type. We have to append the type-tuple containing the symbol and shape to the previous list. This completes our definition. :--: data FeedList (pl :: [(Symbol, [Nat])]) where  EmptyFeedList :: FeedList '[]  (:--:) :: (KnownSymbol n)    => (SafeTensor Value a s p, SafeTensorData a n s)     -> FeedList pl    -> FeedList ( '(n, s) ': pl)

infixr 5 :--: Note that we force the tensor to be a tensor. We can only substitute data for rendered tensors, hence this restriction. Let's add a quick so we can render our items. Value safeRender SafeTensor safeRender :: (MonadBuild m) => SafeTensor Build a s pl -> m (SafeTensor Value a s pl)safeRender (SafeTensor t1) = do  t2 <- render t1  return $ SafeTensor t2 Making a Placeholder Now we can write our function. We’ll add a as a type constraint. Then we’ll take a to give ourselves the type information for the shape. The result is a new tensor that maps the symbol and the shape in the placeholder list. safePlaceholder KnownSymbol SafeShape safePlaceholder :: (MonadBuild m, TensorType a, KnownSymbol sym) =>   SafeShape s -> m (SafeTensor Value a s '[ '(sym, s)])safePlaceholder shp = do  pl <- placeholder (toShape shp)  return $ SafeTensor pl This looks a little crazy, and it kind’ve is! But we’ve now created a tensor that stores its own placeholder information at the type level! Updating Old Code Now that we’ve done this, we’re also going to have to update some of our older code. The first part of this is pretty straightforward. We’ll need to change so that it has the type information. It will have an empty list for the placeholders. safeConstant safeConstant :: (TensorType a, ShapeProduct s ~ n) =>   Vector n a -> SafeShape s -> SafeTensor Build a s '[]safeConstant elems shp = SafeTensor (constant (toShape shp) (toList elems)) Our mathematical operations will be a bit more tricky though. Consider adding two arbitrary tensors. They may share placeholder dependencies but may not. What should be the placeholder type for the resulting tensor? Obviously the union of the two placeholder maps of the input tensors! Luckily for us, we can use from the library to represent this concept. Union type-list safeAdd :: (TensorType a, a /= Bool, TensorKind v)  => SafeTensor v a s p1  -> SafeTensor v a s p2  -> SafeTensor Build a s (Union p1 p2)safeAdd (SafeTensor t1) (SafeTensor t2) = SafeTensor (t1 `add` t2) We’ll make the same update with matrix multiplication: safeMatMul :: (TensorType a, a /= Bool, a /= Int8, a /= Int16,               a /= Int64, a /= Word8, a /= ByteString, TensorKind v)   => SafeTensor v a '[i,n] p1 -> SafeTensor v a '[n,o] p2 -> SafeTensor Build a '[i,o] (Union p1 p2)safeMatMul (SafeTensor t1) (SafeTensor t2) = SafeTensor (t1 `matMul` t2) Running with Placeholders Now we have all the information we need to write our function. This will take a , and it will also take a with the same placeholder type. Remember, a contains a series of items. They must match up symbol-for-symbol and shape-for-shape with the placeholders within the . Let’s look at the type signature: safeRun SafeTensor FeedList FeedList SafeTensorData SafeTensor safeRun :: (TensorType a, Fetchable (Tensor v a) r) =>  FeedList pl -> SafeTensor v a s pl -> Session r The constraint enforces that we can actually get the “result” out of our tensor. For instance, we can "fetch" a vector of floats out of a tensor that uses as its underlying value. Fetchable r Float We’ll next define a tail-recursive helper function to build the vanilla “list of feeds” out of our . Through pattern matching, we can pick out the tensor to substitute for and the data we’re using. We can combine these into a feed and append to the growing list: FeedList safeRun = ...  where    buildFeedList :: FeedList ss -> [Feed] -> [Feed]    buildFeedList EmptyFeedList accum = accum    buildFeedList ((SafeTensor tensor_, SafeTensorData data_) :--: rest) accum =       buildFeedList rest ((feed tensor_ data_) : accum) Now all we have to do to finish up is call the normal function with the list we’ve created! runWithFeeds safeRun :: (TensorType a, Fetchable (Tensor v a) r) =>  FeedList pl -> SafeTensor v a s pl -> Session rsafeRun feeds (SafeTensor finalTensor) = runWithFeeds (buildFeedList feeds []) finalTensor  where  ... And here’s what it looks like to use this in practice with our simple example. Notice the type signatures do get a little cumbersome. The signatures we place on the initial placeholder tensors are necessary. Otherwise the compiler wouldn’t know what label we’re giving them! The signature containing the union of the types is unnecessary. We can remove it if we want and let type inference do its work. main3 :: IO (VN.Vector Float)main3 = runSession $ do  let (shape1 :: SafeShape '[2,2]) = fromJust $ fromShape (Shape [2,2])  (a :: SafeTensor Value Float '[2,2] '[ '("a", '[2,2])]) <- safePlaceholder shape1  (b :: SafeTensor Value Float '[2,2] '[ '("b", '[2,2])] ) <- safePlaceholder shape1  let result = a `safeAdd` b  (result_ :: SafeTensor Value Float '[2,2] '[ '("b", '[2,2]), '("a", '[2,2])]) <- safeRender result  let (feedA :: Vector 4 Float) = fromJust $ fromList [1,2,3,4]  let (feedB :: Vector 4 Float) = fromJust $ fromList [5,6,7,8]  let fullFeedList = (b, safeEncodeTensorData shape1 feedB) :--:                     (a, safeEncodeTensorData shape1 feedA) :--:                     EmptyFeedList  safeRun fullFeedList result_

{- It runs![6.0,8.0,10.0,12.0]-} Now suppose we make some mistakes with our types. Here we’ll take out the “A” feed from our feed list: -- Let’s take out Feed A!main = …  let fullFeedList = (b, safeEncodeTensorData shape1 feedB) :--:                     EmptyFeedList  safeRun fullFeedList result_

{- Compiler Error!• Couldn't match type ‘'['("a", '[2, 2])]’ with ‘'[]’      Expected type: SafeTensor Value Float '[2, 2] '['("b", '[2, 2])]        Actual type: SafeTensor                       Value Float '[2, 2] '['("b", '[2, 2]), '("a", '[2, 2])]-} Here’s what happens when we try to substitute a vector with the wrong size. It will identify that we have the wrong number of elements! main = …  -- Wrong Size!  let (feedA :: Vector 8 Float) = fromJust $ fromList [1,2,3,4,5,6,7,8]  let (feedB :: Vector 4 Float) = fromJust $ fromList [5,6,7,8]  let fullFeedList = (b, safeEncodeTensorData shape1 feedB) :--:                     (a, safeEncodeTensorData shape1 feedA) :--:                     EmptyFeedList  safeRun fullFeedList result_

{- Compiler Error!Couldn't match type ‘4’ with ‘8’        arising from a use of ‘safeEncodeTensorData’-} Conclusion: Pros and Cons So let’s take a step back and look at what we’ve constructed here. We’ve managed to provide ourselves with some pretty cool compile time guarantees. We’ve also added de-facto documentation to our code. Anyone familiar with the codebase can tell at a glance what placeholders we need for each tensor. It’s a lot harder now to write incorrect code. There are still error conditions of course. But if we’re smart we can write our code to deal with these all upfront. That way we can fail gracefully instead of throwing a random run-time crash somewhere. But there are drawbacks. Imagine being a Haskell novice and walking into this codebase. You’ll have no real clue what’s going on (I wouldn’t have 2 months ago). The types are very cumbersome after a while, so continuing to write them down gets very tedious. Though as I mentioned, type inference can deal with a lot of that. But if you don’t track them, the type union can be finicky about the ordering of your placeholders. We could fix this with another type family though. All these factors could present a real drag on development. But then again, tracking down run-time errors can also do this. Tensor Flow’s error messages can still be a little cryptic. This can make it hard to find root causes. Since I’m still a novice with dependent types, this code was a little messy. Next week we’ll take a look at a more polished library that uses dependent types for neural networks. We’ll see how the library allows us to specify a learning system in just a few lines of code! Grenade If you’re new to Haskell, I hope none of this dependent type madness scared you! The language is much easier than these last couple posts make it seem! Try it out, and download our . It’ll give you some instructions and tools to help you learn! Getting Started Checklist If you’re an experienced Haskeller and want to try out Tensor Flow, download our ! It will walk you through incorporating the library into a Stack project! Tensor Flow Guide Appendix: Compiler Extensions and Imports {-# LANGUAGE GADTs                #-}{-# LANGUAGE DataKinds            #-}{-# LANGUAGE KindSignatures       #-}{-# LANGUAGE TypeOperators        #-}{-# LANGUAGE ScopedTypeVariables  #-}{-# LANGUAGE TypeFamilies         #-}{-# LANGUAGE FlexibleContexts     #-}{-# LANGUAGE UndecidableInstances #-}

import           Data.ByteString (ByteString)import           Data.Int (Int64, Int8, Int16)import           Data.Maybe (fromJust)import           Data.Proxy (Proxy(..))import           Data.Type.List (Union)import qualified Data.Vector as VNimport           Data.Vector.Sized (Vector, toList, fromList)import           Data.Word (Word8)import           GHC.TypeLits (Nat, KnownNat, natVal)import           GHC.TypeLits

import           TensorFlow.Coreimport           TensorFlow.Core (Shape(..), TensorType, Tensor, Build)import           TensorFlow.Ops (constant, add, matMul, placeholder)import           TensorFlow.Session (runSession, run)import           TensorFlow.Tensor (TensorKind)

Checking it’s all in Place: Placeholders and Dependent Types

TunnelBear is quickly becoming one of the most popular options for “normal” people to use VPNs. It’s easy to use and the heavily targeted, yet non-obnoxious marketing doesn’t hurt either. Plus I have an irrational affection for brands that combine awesome products with a cute front-end. The same reason I’m in love with . Neat microphones Not Open-Source TunnelBear is cheap and non-intrusive, but not open-source. The account management happens on their servers, using unique user tokens. So the client is not all that critical, and doesn’t provide much attack surface. But attacking TB’s service is not the point of this post. That said, the client is after all a proprietary piece of software that runs on your PC, managing the most private part of your communication: your internet connection. So it’s important to know what makes it tick, and what it knows and shares about you. TunnelBear has yet to have a major fracas, and (spoilers), I didn’t find any in my analysis. Yet there might be certain parts of this software that may surprise you. Windows TunnelBear targets the broader, “average Joe” audience, so my analysis is focused on the Windows client. Saying “TunnelBear is not open-source” isn’t quite true. First of all , and it’s written in C#, which, if you’re not familiar with reverse engineering, is the same thing as having a neatly formatted and optimized copy of the full source code — minus the comments. it uses FOSS components Resources The TunnelBear base installation copies some 165 files onto your PC. The separate parts of the software are Assets (such as audio files and pictures used in the UI) Certificates (issued by Google, root and key) Language assemblies (for some odd reason my copy contains the French resource, despite the actual app being English) A copy of ’s proxy engine (a Tor component) obfs4 Various (very brittle) Batch scripts to manage -ing, monitoring and DNS (-cache) route A copy of the management tool Hyper-V Network VSP Bind A build of OpenSSL OpenVPN drivers The GalaSoft MVVM Light Toolkit BitStadium’s HockeyApp SDK IntelliBear, a DNS proxy, which is not written in C#. This is the app that uses aforementioned Batch scripts. , a UI toolkit MahApps Metro ManagedWifi (NativeWifi), a simple wrapper around the wlanapi Windows API , a JSON (de)parser NewtonSoft JSON All other TunnelBear code as .NET assemblies (with full debug info) So quite heavy. But that’s what you need to close every possible leak on Windows. If you just want to proxy your browser, something like is more than enough. But not every app honors the internet options, so other connections still expose your actual IP. You need to proxy . TorGateway everything Startup The app is launched by this hilarious script: Set WshShell = CreateObject(“WScript.Shell”)cmds=WshShell.RUN(“TBear.Client.exe”, 0, True)Set WshShell = Nothing So let’s take a look at our entry point, TBear.Client. I’m looking at version 2.3.29.0. There are multiple mentions of a version 3 in the code, and many checks to enable or disable updates to v3, more on that later. This assembly is linked to all the image, sound and font assets. It also contains the default English resources. No bear glove = risky internet loveGrr. Your privates are showing… etc. pp. First off is the connection helper routine. It simply waits for an internet connection by using with a default maximum of 3 attempts. It pings as a check. Utils.PingTunnelBear() www.tunnelbear.com The actual app is launched async. On startup, it first restores the default proxy. This applies to the “internet options” proxy settings withing windows. These are stored in as an address and a flag (on/off). It only resets the proxy address if the existing one is local, which is a good idea if you are already using another proxy. Software\Microsoft\Windows\CurrentVersion\Internet Settings It also makes sure to resume operation and to reconnect the VPN when the system power mode changes. Now to the actual startup handler. This is the first time we encounter a curious flag called . This flag controls a number of things. One of them being the server that is accessed by the client, which is tunnelbear.com for production, but staging.tunnelbear.com otherwise. Utils.IsProd More importantly though, this disables or enables the frighteningly comprehensive logging-to-stdout that is baked into every routine: Utils.IsGodModeUnlocked = ; (!Utils.IsProd) {Logger. ();} false if InitializeConsole Another curious flag is the self-explanatory . AutoUpdater.IsBeta It then tests of the system (or the current user) is capable of running IntelliBear (the DNS proxy, remember). This is done by creating a dummy VPN instance on port 53. If that fails, the user probably doesn’t have permission or something is already running there. Finally we get to parse the command line options. The following are available: , for setting the UI language -lang , whether to auto connect on startup -autoconnect , to force the VPN to use TCP -tcp , logs the last IB error ( logs the last info statement) -intellibear-error -intellibear-info forces IB into verbose mode. -intellibear-verbose forces a reset -reset runs this UI test mode -uitest mode uses these credentials to login and stores them “safe”ly on disk -autologin user password Depending on whether this is your first launch you are presented with either the “onboarding” or “main” window. Telemetry via Hockey is also initialized at this point. But let’s take a closer look at the storage routine for our most sensitive data: k = Array.IndexOf<string>(e.Args, “-auto-login”); (e.Args.Length > k + 2) {Utils. (“STORE_USER”, e.Args[k + 1]);Utils. (“STORE_PASS”, e.Args[k + 2]);} int if SafeSave SafeSave We find this function in TBear.Common, a collection of helper functions. Of course this function has logging built in, but the only thing that’s logged are the names of the keys that are modified. Long story short, the data is encrypted using and saved to the KVS. No issues here. Basically all settings are managed within IsolatedStorage. ProtectedData IsolatedStorage Account Settings The fun stuff happens server-side. If you click anything that changes state in your account, you will do so on the TunnelBear website. For example, this is what happens when you click “upgrade” in the UI: Utils. (string. (Utils. () + “account#/change?token={0}”, task.Result.Result. ())); LaunchBrowser Format GetBaseWebsite ToString The base website is either the production or staging server. But how is the token generated? (). (Utils. (“STORE_USER”), Utils. (“STORE_PASS”)); new TBearClient GetDeepLinkToken SafeRestore SafeRestore That doesn’t seem to have a terribly high amount of entropy considering the average user’s password. Let’s dig deeper. The DeepLinkToken generator is actually a two-step process, as it consults the API first. API Fallback Same as with the front-end, the API’s base URL depends on whether it’s the production version. So it’s . But hold on. This API could be blocked. So how does TunnelBear circumvent this? [https://(staging).tunnelbear.com/core/](https://%28staging%29.tunnelbear.com/core/) This is were the API backup IP LUT comes in. It’s filled on startup by updating from AWS. The whole process is a bit convoluted (everything is done with delegated task in TunnelBear), but it boils down to this: Poll for API backup IPs and the API gateway hostname to use. https://s3.amazonaws.com/tunnelbear/(redacted)/config3.json Meticulously log everything along the way. IP, add as a backup address to the LUT. foreach [https://ip/core/](https://ip/core/a) The API usually returns four IPs. This is a pretty awesome fallback that I wouldn’t have expected, but the implementation does have to major issues in my opinion: This API (even though I censored it above) can be trivially polled by any software. It can then be added to a blocklist automatically. All IPs can be blocked by either service signature or even region, as they are close, both in a network and geo sense. extremely though doesn’t use the IPs, but only the gateway, which is the first entry in the LUT. GetApiBase() Login Token But I digress. Back to the login token. Nothing special, which is kind of worrying. It’s a simple POST request to . The POST data is api/core/getLoginToken username=turbo password=nicetry That’s it. The header also refuses caching and uses the language from the settings. I want to view my token. Now, the fallback actually makes this way easier. I redacted the full API URL above, because the tunnelbear.com API domain has a CloudFlare WAF, so the IP probably shouldn’t be public ;-). This also interferes with cURL (you just get a CF challenge site if you don’t fake the UA). But using one of the IPs: Success! $ curl -data “username=minxomat%40gmail.com&password=nicetryagain” -k https://(redacted)/core/getLoginToken {“details”:”15242acd-****–****-****-7484152ce15c”,”result”:”PASS”} PASS indicates success, as the server will also send a 200 OK if the request fail. The kills certificate errors (no domain, duh!). -k Now, we can see that the token really only does depend on the cleartext password. If you know the e-mail address of someone who uses TunnelBear, you just need to brute-force the password. Of course that is completely infeasible. With the normal URL, you are going to hit CloudFlare limits, with the IPs you can distribute an attack across four points, but your are still going to be discovered as a traffic anomaly pretty quickly. If you are presented with the website that contains the DeepLinkToken, you’ll still need to log in. But if you are logged in, it’ll take you right where it should. Diagnose Mode If your bear is misbehaving, there’s a troubleshooting mode, which can be launched with the command line arg . -help AutoConnect Wifi An unusual feature of TunnelBear are it’s . If you think about it, this is an essential feature (and currently exclusive to the windows version). It polls the Windows WLAN API to check if the current WiFi network is open and immediately enables the VPN connection even if it was off. WiFi management capabilities If you have logging enabled, the log will contain the names of all WiFi profiles that were connected and whether they are secure or not. This part of the client doesn’t phone home, so your privacy remains intact. Vigilant Mode Another interesting, but essential setting is the . My criticism here is that (probably for UX reasons) it’s disabled by default. vigilant mode It’s a fact of life, WiFi connections drop. […] Vigilant helps to protect you by blocking any unsecured traffic while TunnelBear is connecting. So… how? VigilantFirewall, a class living in TBear.Common, is a thin wrapper around a patchwork of external utils (like everything network-related on Windows). To block everything, it of course needs to allow exceptions, which are just the program files TunnelBear uses. It uses the to manage it’s rules. So, no voodoo magic or self-made nonsense. Windows firewall API Hardware Fingerprint “Wait. You said privacy! What in the world does it want with a hardware fingerprint?!”, I hear you ask. Every time an instance of TBearClient is created, it creates a hardware fingerprint. And spoilers again, . But let’s not get ahead of ourselves. First we need to dissect how this fingerprint is created in the first place. The data used is yes, it is shared with their server BIOS metadata (manufacturer, version, ID etc.) CPU (speed, name, ID) The machine GUID from the registry The MAC address GPU ID … But actually, most of this file is dead code. I suspect it has been copy & pastes from something else. The only relevant routine is this: That’s slightly weird though. It first tries to get the GUID from the 32bit registry. The value returned can be null, in which case it tries the 64bit registry. However, this call could fail, too, potentially setting the fingerprint to null and causing an exception elsewhere. Anyhow, this function doesn’t call any other method present in this class. OK. Now, who uses this fingerprint? New User Registration That. The registration is a larger POST request to the API. The header contains the language and curiously the OpenVPN version. The POST data is: User Password Assembly name, version and OS name Country A flag whether to return JSON The fingerprint So it’s pretty clear why the fingerprint is sent on registration. If you combine cURL with a small script and a junkmail API, you could create new TunnelBear accounts within seconds on the same machine, circumventing the paid model altogether. However, all of them would have the same hardware fingerprint and you’d be blocked quickly. But, this is kind of pointless. Because now you know how to generate bogus fingerprints. The only identifying info then is your IP. But again, use something like TorGateway and simply rotate circuits between each account generation. Infinite free TunnelBear. Stuff for TunnelBear to think about, not a critical bug by any means though. Misc Other things are pretty routine. Setting proxy info, firing up the VPN etc. Nothing special, and nothing phones home. Certificates are created and installed JIT. IntelliBear If you just download the free version of TunnelBear, IntelliBear is disabled. It allows you to configure tunneling on a per-URL basis. However, the IntelliBear runtime ships by default and isn’t secured by anything else. In order to know about what URLs are used, you need to proxy DNS. Now, many of you are probably using a residential internet connection. Which means you are probably also using a DNS proxy without knowing it. I see a lot of people changing their DNS to e.g. Google’s. The truth is: It doesn’t matter. Whatsoever. Even if you think you are using that DNS, and your PC thinks it’s using it. Most ISP employ transparent DNS proxies, that MITM your DNS requests and serve you from a local POP to increase performance. However, these DNS caches often suffer from stupidly high cache times (that you can’t purge) and sometimes even serve ads. If you want to know if you are affected, . see this discussion Happy to report that TunnelBear has it’s own functions to detect DNS leaks and even IPv6 leaks. Awesome! Let’s poke the IntelliBear: C:\Program Files\TunnelBear>intellibear32.exe -helpUsage of intellibear32.exe:-debug=”error”: Debug level, set between error, info or verbose-f=”domains.txt”: Domain list file path-intel=”none”: Is using Intellibear?-log=””: Log path-p=””: Which proto use for lookup domain-r=””: Regex pattern for match domain to use tcp proto-s=”scripts”: Script directory path-server=””: Server ip-t=0: How many seconds to timeout-tap=”utun0": Which Tap adapter to use The actual wrapper code for IB is missing from the assemblies, though. In Conclusion After reviewing thousands of lines of code, I can pretty confidentially say that TunnelBear has no privacy issues, doesn’t collect unnecessary telemetry and is a streamlined, fast and intuitive app. So, if you were looking at the feature set of TunnelBear and you need nothing more, I can recommend it from a privacy standpoint. If you are in desperate need of absolute* privacy, Tor will be the better choice. All this also means that it’s pretty easy to implement your own TunnelBear client! Coming Up You might notice that I didn’t touch on the more advanced features in depth. That’s because V3 is out, where most of these are completely overhauled (hah, get it?). So coming up is a complementary audit of the paid V3 version. Stay tuned.

Poking The Bear: Is TunnelBear’s Client Safe To Use?

helps entrepreneurs and creatives build efficient websites. Orson.io website creator helps you make your own website based on professional templates built with the best web design and marketing principles. You can design your website as you want just by drag and drop. No code required. Create your own website totally optimized for Search Engine Optimization and follow the the suggestions in the website builder in order to boost your online visibility. Orson interviewed , Co-Founder at to know more. Kevin William David tsifei chan Orson Hi Tsifei, So what is Orson? Orson is the easiest way for entrepreneurs and designers to create professional and visible websites without a single line of code. Tell me more about the problem you are trying to solve? Internet is everywhere and yet, it is still very complicated to have a beautiful and visible website. Making a website visible should be as easy as editing a document on Word or Docs. Google Having a website is great but being visible on Search Engines with their website is better. At Orson, we believe is the answer to help them build a better website. SEO How is Orson different from what already exists in the market? The thing is, most SMEs don’t even follow the most basic rules of proper SEO. We want to make entrepreneurs successful thanks to their website and their SEO. Orson.io’s editor’s main focus is on SEO thanks to Orson Bot, which will give you SEO advice along the way as you’re creating your website. When you publish, it will check and make sure you properly filled out the title, description and will even provide you with precise pointers on how to do so. The target audience is companies who want to invest in SEO and want to be able to make and animate their website without coding. Who uses Orson? What types of roles do your customers have at their companies? New entrepreneurs use Orson.io to launch their startup or company in order to collect emails. Entrepreneurs who already have a website that’s not performing well in terms of design or SEO and want to create a new one. Marketing department who use Orson.io to create websites so they can be autonomous without calling their IT department. Web agencies, freelancers who create websites on Orson.io for their customers to give them autonomy for the future. They can really customize Orson.io websites with HTML/JS and CSS. How are your customers using Orson? Could you share a few different use cases? is a French government organization which promotes entrepreneurship all over the world using Orson.io to create websites for each of their hubs all around the world. It allows them to have an amazing template where each country’s coordinator can then adjust the content to their country. French Tech They launched 12 websites in 12 cities in 2 weeks. Some example: http://www.frenchtechticket.com/ http://sf.lafrenchtech.com/ http://tokyo.lafrenchtech.com/ is great web agency who targets green revolution farmers and create amazing websites for them to help them to promote their new type of agro-services all over France. Parlons Terroir http://www.parlonsterroirs.fr/ http://www.lafermedes3vaches.fr/ https://www.fermedetravailles.fr/ Have there been unique use cases for Orson that you hadn’t thought of or expected? Some big companies contacted us in the past to create a template with them so they can offer it to their different franchisees or customers in order to unify their online communication. Were there any early ‘growth hacks’ or tactics that have contributed to your current success? Our main growth hack is to create side-project related to our business which is great not only for the product itself and its exposure, but is also a great source of valuable backlinks, which only goes to improve our SEO standings. Some of the amazing projects we’ve created so far: : People who can invest time in coding with amazing Free HTML5 and responsive Templates Mashup Template : Bootstrap theme editor Bootstrap Magic : Curated list of French resources and tools for startups Logiciels Saas Frenchtech What were some of the biggest challenges while building the product early on and how did you solve them? One of the biggest challenge at the beginning building the product was to prioritize features that we wanted for the MVP. We didn’t have tools to connect with users such as or , so we were doing it the old way: meeting our users, checking what they were doing on their screen. Intercom Zendesk What have been some of the most interesting integrations you’ve added? Are there any that have been particularly impactful for you? On Orson.io, there were quite a lot of users who created their website with bad quality images so we implemented as an open gallery for our users to get instant access to their amazing, curated collection system. Unsplash We have also integrated Google Visual API to check for low-quality images on our customers websites to suggest better quality image based on the content of their initial visuals. Before we end, What are the top products that you depend on to run the company & how do you use them? We use Intercom everyday to exchange, get feedback from our users and customers. Really great product, getting a lot of improvement everyday. Intercom — — We use internally but also our commercial partners partners, webagencies and freelances which use Orson to create amazing website for their customers. We exchange on the best practices, on how to answer to customers questions and how to be efficient. Slack — Ticketing system that we use to develop our product. It’s really great to make the product amazing. Our Marketing and IT department are very familiar with the software and it’s quite pleasant to use. Codebase Originally published at siftery.com .

Stories, News & Mentions about SAFERME

Saferme’s Stories on HackerNoon

Saferme's News & Mentions