Score10

score10

10 Questions with Shrav Mehta, Founder and CEO at Secureframe via [The Startup Founder Interview Template]. HackerNoon: What is your company in 2–5 words? Shrav Mehta: Security compliance automation software provider. Why is now the time for your company to exist? SM: Several years ago, everything to do with compliance was completely manual. There were no APIs to integrate with. If you looked at HR systems like Gusto or Rippling for example, there were no APIs to pull the data that you needed as part of the compliance process. AWS didn't have a robust suite of APIs to pull evidence. But as technology and APIs evolved, automation became much more possible in the compliance process. Over time, that allowed Secureframe to automate so much of the compliance process that it’s now about three to four times faster than it was a few years ago. What do you love about your team, and why are you the ones to solve this problem? SM: When we were first building Secureframe, many of the big auditors told us that automating compliance was not really possible. They believed that the complex and nuanced nature of compliance tasks made them unsuitable for automation. However, my team and I thought otherwise. We realized that many of the manual tasks we were doing, such as screenshotting an AWS dashboard or a GitHub repo to pull down information, could be streamlined through automation. Despite the skepticism we faced, we were convinced that with the right approach and technology, many parts of the compliance process could indeed be automated. We recognized that the belief that it couldn't be done was more of a preconceived notion rather than a fact. Drawing from our experiences at previous startups, we knew that other companies were facing similar challenges and were actively seeking automated solutions to simplify their compliance efforts. This further motivated us to develop Secureframe and provide the much-needed automation in the compliance space. If you weren’t building your startup, what would you be doing? SM: I would definitely be interested in building something in cybersecurity. Cybersecurity and AI are probably the two fastest-growing spaces in software technology today. Cyber threats will continue to evolve and get more complex. There will always be bad actors out there and you will always need good cybersecurity products and tooling to fight those bad actors. I think there are an infinite number of opportunities in cybersecurity. Secureframe is where I'm focused right now, but if I were to do anything else, I would almost certainly work on something at the intersection of cybersecurity and AI. At the moment, how do you measure success? What are your metrics? SM: Every company has one key metric that they're evaluated on. For most venture-backed companies, it's revenue-focused. For Secureframe, the number one metric we look at is ARR (annual recurring revenue). The next big one is NDR (net dollar retention), which is the number of our existing customers that are growing and expanding. Our third most important metric is NPS (net promoter score), which measures the happiness of our customers. And the fourth most important metric is CAC (customer acquisition cost) payback period. For example, if I had $1 billion to spend on marketing, I'm sure I could increase our growth rate a lot, but there would be no constraint. So, we aim to spend marketing and sales money in the most efficient way possible in order to generate more revenue. That’s one reason why CAC payback period matters, because it puts an efficiency cap on your resources. In a few sentences, what do you offer to whom? SM: Secureframe's platform helps organizations achieve and maintain compliance with standards like SOC 2, ISO 27001, HIPAA, and NIST frameworksto name a few. We automate risk assessments and monitor third-party vendors' compliance status, ensuring they adhere to necessary security and privacy standards. Our platform also streamlines internal risk management processes, including identifying vulnerabilities, implementing controls, and continuously monitoring for nonconformities. We assist companies in preparing for audits and our customers range from startups to large global enterprises, with our platform flexibly adapting to their specific compliance needs. What’s most exciting about your traction to date? SM: The thing we're really excited about is the traction we're seeing with enterprise customers. Most enterprises still have the same problems with security and compliance that they’ve always had — the process is too slow and very manual, and they need deeper levels of automation. But there are so many frameworks and regulations that they need to comply with. The problem is just much bigger than it is for smaller companies, but it’s one that Secureframe is able to solve. Where do you think your growth will be next year? SM: Our biggest growth goal is to double our revenue year-over-year. Tell us about your first paying customer and revenue expectations over the next year. SM: Our first paying customer was actually before we even had an MVP (minimum viable product) built for Secureframe. We were exploring a couple different ideas within security and I started asking people in my network if they would be interested in tools to automate some of the SOC 2 process. And a bunch of people said yes, but we didn't really know how serious they were. Our first customer called me back a month later and asked where the product was. I said, "Oh, I didn't know you were that serious about it!" So, I quit my job that week and started building the MVP for what is now Secureframe. We got the customer done with their SOC 2 and they were incredibly happy. And that was the impetus for why we decided to focus on this idea — clearly it was something people needed. We had 40+ companies on the waitlist by the time we actually had an MVP that we could utilize with all these customers. The moment we launched it, they started to pay us. Over the next year, we plan to double our revenue. What's your biggest threat? SM: I think if we don’t get ahead of it, AI could be one of the biggest threats to both software and cybersecurity. But if we get ahead of it, it will be one of the biggest opportunities. At Secureframe, we're utilizing AI where we think it'll really help our customers, which we believe is risk remediation and vendor management. We’re using it to make the whole compliance process even faster and easier. We also support a broader range of frameworks, including the NIST AI Risk Management Framework (NIST AI RMF) and ISO 42001, enabling teams to automate their compliance protocols. Get Interviewed by HackerNoon via the Startup Founder Template 10 Questions with Shrav Mehta , Founder and CEO at Secureframe via [ The Startup Founder Interview Template ]. Shrav Mehta Shrav Mehta Secureframe Secureframe The Startup Founder Interview Template HackerNoon: What is your company in 2–5 words? HackerNoon: What is your company in 2–5 words? Shrav Mehta: Security compliance automation software provider. Why is now the time for your company to exist? Why is now the time for your company to exist? SM: Several years ago, everything to do with compliance was completely manual. There were no APIs to integrate with. If you looked at HR systems like Gusto or Rippling for example, there were no APIs to pull the data that you needed as part of the compliance process. AWS didn't have a robust suite of APIs to pull evidence. But as technology and APIs evolved, automation became much more possible in the compliance process. Over time, that allowed Secureframe to automate so much of the compliance process that it’s now about three to four times faster than it was a few years ago. What do you love about your team, and why are you the ones to solve this problem? What do you love about your team, and why are you the ones to solve this problem? SM: When we were first building Secureframe, many of the big auditors told us that automating compliance was not really possible. They believed that the complex and nuanced nature of compliance tasks made them unsuitable for automation. However, my team and I thought otherwise. We realized that many of the manual tasks we were doing, such as screenshotting an AWS dashboard or a GitHub repo to pull down information, could be streamlined through automation. Despite the skepticism we faced, we were convinced that with the right approach and technology, many parts of the compliance process could indeed be automated. We recognized that the belief that it couldn't be done was more of a preconceived notion rather than a fact. Drawing from our experiences at previous startups, we knew that other companies were facing similar challenges and were actively seeking automated solutions to simplify their compliance efforts. This further motivated us to develop Secureframe and provide the much-needed automation in the compliance space. If you weren’t building your startup, what would you be doing? If you weren’t building your startup, what would you be doing? SM: I would definitely be interested in building something in cybersecurity. Cybersecurity and AI are probably the two fastest-growing spaces in software technology today. Cyber threats will continue to evolve and get more complex. There will always be bad actors out there and you will always need good cybersecurity products and tooling to fight those bad actors. I think there are an infinite number of opportunities in cybersecurity. Secureframe is where I'm focused right now, but if I were to do anything else, I would almost certainly work on something at the intersection of cybersecurity and AI. At the moment, how do you measure success? What are your metrics? At the moment, how do you measure success? What are your metrics? SM: Every company has one key metric that they're evaluated on. For most venture-backed companies, it's revenue-focused. For Secureframe, the number one metric we look at is ARR (annual recurring revenue). The next big one is NDR (net dollar retention), which is the number of our existing customers that are growing and expanding. Our third most important metric is NPS (net promoter score), which measures the happiness of our customers. And the fourth most important metric is CAC (customer acquisition cost) payback period. For example, if I had $1 billion to spend on marketing, I'm sure I could increase our growth rate a lot, but there would be no constraint. So, we aim to spend marketing and sales money in the most efficient way possible in order to generate more revenue. That’s one reason why CAC payback period matters, because it puts an efficiency cap on your resources. In a few sentences, what do you offer to whom? In a few sentences, what do you offer to whom? SM: Secureframe's platform helps organizations achieve and maintain compliance with standards like SOC 2 , ISO 27001 , HIPAA , and NIST frameworks to name a few. We automate risk assessments and monitor third-party vendors' compliance status, ensuring they adhere to necessary security and privacy standards. Our platform also streamlines internal risk management processes, including identifying vulnerabilities, implementing controls, and continuously monitoring for nonconformities. We assist companies in preparing for audits and our customers range from startups to large global enterprises, with our platform flexibly adapting to their specific compliance needs. SOC 2 ISO 27001 HIPAA NIST frameworks What’s most exciting about your traction to date? What’s most exciting about your traction to date? SM: The thing we're really excited about is the traction we're seeing with enterprise customers. Most enterprises still have the same problems with security and compliance that they’ve always had — the process is too slow and very manual, and they need deeper levels of automation. But there are so many frameworks and regulations that they need to comply with. The problem is just much bigger than it is for smaller companies, but it’s one that Secureframe is able to solve. Where do you think your growth will be next year? Where do you think your growth will be next year? SM: Our biggest growth goal is to double our revenue year-over-year. Tell us about your first paying customer and revenue expectations over the next year. Tell us about your first paying customer and revenue expectations over the next year. SM: Our first paying customer was actually before we even had an MVP (minimum viable product) built for Secureframe. We were exploring a couple different ideas within security and I started asking people in my network if they would be interested in tools to automate some of the SOC 2 process. And a bunch of people said yes, but we didn't really know how serious they were. Our first customer called me back a month later and asked where the product was. I said, "Oh, I didn't know you were that serious about it!" So, I quit my job that week and started building the MVP for what is now Secureframe. We got the customer done with their SOC 2 and they were incredibly happy. And that was the impetus for why we decided to focus on this idea — clearly it was something people needed. We had 40+ companies on the waitlist by the time we actually had an MVP that we could utilize with all these customers. The moment we launched it, they started to pay us. Over the next year, we plan to double our revenue. What's your biggest threat? What's your biggest threat? SM: I think if we don’t get ahead of it, AI could be one of the biggest threats to both software and cybersecurity. But if we get ahead of it, it will be one of the biggest opportunities. At Secureframe, we're utilizing AI where we think it'll really help our customers, which we believe is risk remediation and vendor management . We’re using it to make the whole compliance process even faster and easier. We also support a broader range of frameworks, including the NIST AI Risk Management Framework ( NIST AI RMF ) and ISO 42001 , enabling teams to automate their compliance protocols. we're utilizing AI we're utilizing AI risk remediation risk remediation vendor management vendor management NIST AI RMF NIST AI RMF ISO 42001 ISO 42001 Get Interviewed by HackerNoon via the Startup Founder Template Get Interviewed by HackerNoon via the Startup Founder Template

"Our Biggest Growth Goal is to Double our Revenue Year-over-Year," says Secureframe CEO Shrav Mehta

সিকিউরফ্রেমের সিইও শ্রভ মেহতা বলেছেন, "আমাদের সবচেয়ে বড় প্রবৃদ্ধির লক্ষ্য হল আমাদের আয় বছরে দ্বিগুণ করা"

„Unser größtes Wachstumsziel ist die Verdoppelung unseres Umsatzes im Vergleich zum Vorjahr“, sagt SecureFrame-CEO Shrav Mehta

"Nuestro mayor objetivo de crecimiento es duplicar nuestros ingresos año tras año", afirma el director ejecutivo de SecureFrame, Shrav Mehta.

« Notre plus grand objectif de croissance est de doubler notre chiffre d'affaires d'une année sur l'autre », déclare Shrav Mehta, PDG de SecureFrame.

सिक्योरफ्रेम के सीईओ श्राव मेहता कहते हैं, "हमारा सबसे बड़ा विकास लक्ष्य साल-दर-साल अपने राजस्व को दोगुना करना है।"

「当社の最大の成長目標は、前年比で収益を2倍にすることです」とSecureFrameのCEO、シュラブ・メータ氏は語る。

SecureFrame CEO인 Shrav Mehta는 "우리의 가장 큰 성장 목표는 전년 대비 수익을 두 배로 늘리는 것입니다."라고 말합니다.

“Nossa maior meta de crescimento é dobrar nossa receita ano após ano”, afirma Shrav Mehta, CEO da SecureFrame

«Наша главная цель роста — удвоить выручку по сравнению с прошлым годом», — говорит генеральный директор SecureFrame Шрав Мехта.

SecureFrame CEO'su Shrav Mehta, "En Büyük Büyüme Hedefimiz Gelirimizi Her Yıl İkiye Katlamak" diyor

Giám đốc điều hành SecureFrame Shrav Mehta cho biết: “Mục tiêu tăng trưởng lớn nhất của chúng tôi là tăng gấp đôi doanh thu so với cùng kỳ năm trước”.

SecureFrame 首席执行官 Shrav Mehta 表示：“我们最大的增长目标是实现收入同比翻一番。”

Every time I think of the word “followers”, I’m reminded of the assembly of the crowd gathered in the Roman Republic after Julius Caesar was stabbed to death by his own senators. In the Shakespearean play, the crowd is wickedly fickle — going from supporting Caesar’s cause to rejoicing over his killing to eventually turning their backs on the conspirators after Antony’s rousing speech. Today, audience building can feel a lot like trying to sway such a group of fickle humans. However - before you misunderstand - I’m not saying “fickle” in the demeaning sense of the word. But rather to highlight the general lack of trust people have in brands. Why the lack of trust? According to Copyblogger’s Brian Clark, content that persuades and moves people to action has these four elements: , , and . storytelling empathy, relatability service How many brands score 10/10 on all four? Very few. On the other hand, individual creators or “personal brands” tap into these elements with personal stories and manage to overpower the algorithms. It comes naturally to them because their entire brand is built on productizing their life experiences. And guess what? That’s what people have always gravitated towards. 👀 This is also what makes the influencer culture so fascinating. Consumers distrust brands but are willing to trust someone who’s been paid by the brands to parrot the same thing they’ve been saying. Just goes on to show the arbitrary nature of how trust is established. But of course, not all influencers are the same. Where brands are getting it wrong? We’re living in an attention-deficit economy today, where content production far exceeds content consumption. And the attention span isn’t getting any bigger. Yes, I’m referring to the now infamous research from 2015 about how the average human attention span is only 8.25 seconds! Yet most branded content out there is just SEO content. How do I know this? I run a content writing agency in one of the most saturated spaces today: . That’s how. B2B SaaS The end goal of SEO content is to drive leads and traffic, not build a loyal following. While, yes, SEO content has been effective in the past and helped big names like HubSpot build an audience. But in the last decade, the returns haven’t been as impressive as the investment. SEO is also not inexpensive. It does require significant cost when you’re just starting out. This is why many founders and executives have hopped on the personal branding wagon and started posting on social media. And giants like . Not only does it cost virtually nothing, but with consistent activity, they’re able to build a brand audience by extension. Cisco are training their employees to be LinkedIn influencers The Tools of the Trade: Why Brands Fail at Audience Building To understand what makes audience building so challenging, let’s consider the most common tools of audience building: and content social media. What Sticks Out Content: In most cases, brands that miss the mark with their content lack the following three elements: While most brands today are investing in content, only a handful are investing in original research or access to original research. As a result, most of their content is recycled and regurgitated, lacking the authenticity audience likes. Authenticity: Even if you’re operating in a seemingly “boring” industry, you cannot create dry, stiff content focused only on providing information. Brands that excel at audience building have a well-defined, easily distinguishable voice, which helps it in standing out. Voice: In the B2B space, the power of delightful, fun content is still vastly underrated, as many brands continue to publish boring content. This is a pity because research has shown entertaining content to be a successful method of captivating the audience. Delight: 👀 Please note, when I say “boring” content, I’m referring to the style and delivery of the content, not its subject matter. Social Media: The Playground Social media levels the playing field for all. SEO, on the other hand, has always been a game of numbers, where the bigger fishes get the biggest advantage. This is because search engines aren’t as democratic as social algorithms. It might not stand true for all social networks ( ) but for most, there is equity. With access to the same tools and features, individual creators (and smaller companies) can compete with bigger brands. They can attract eyeballs as well as a following by posting value-driven content with little to no cost attached. Hello, Musk-led ! Twitter How Can Brands Win Loyalty and Fans Growing an audience takes time. But if you do it consistently, you can enjoy the incremental benefits of loyal supporters, advocates, and even fans. Here’s how. If you’re going to publish the same content as everyone, while taking the same angle as everyone else — you’ll fail at attracting the right people, building an audience is a far cry. So, unless you’ve got something fresh to share or a different angle on a topic, it’s better to change the topic itself. Change the perspective. Is the content you publish insightful? Does it have that sticky quality? Or inspire a different type of thinking? The audience loves a glitch in the matrix, something divergent. And if you can deliver it, you might just bag a loyal follower. Spark conversations, not just conversions. Even if your content speaks to the audience's needs, after a while, it’ll start to sound monotonous if there’s no element of surprise. By introducing diversity in content through different formats like videos, infographics, interview features, etc., you can keep your content stack interesting and your audience interested. Beat content fatigue with diversity. Frequent hard (or soft) sell-in content are massive red flags. You want to focus on providing helpful and actionable content, instead of pushing the reader into becoming a lead with every piece you publish. Don’t be pushy. Remember, time is a currency people spend most consciously today. If you want to rise above the noise and create sticky content, you need to stop imitation of successful examples and start inventing ideas of your own. Having a unique, recognizable brand personality is the way to the heart of the audience.

Why Audience Building is a Pain for Brands, Not Creators

Are you having a hard time changing some properties of some bootstrap classes with CSS? I understand it must be very frustrating and tiring to change tiny details here and there. But I can help you with a few tricks to get over it. Most web pages are styled using CSS and or other CSS frameworks. Bootstrap is the most popular of these frameworks. It consists of various classes that make developing responsive and mobile-first websites easier and faster. Bootstrap 4 is the latest version of Bootstrap. Responsive web design involves using HTML and CSS/Bootstrap to resize a website so they look good on all devices (phones, tablets, desktops or even TV screens): Although Bootstrap 4 unlike other versions is more advance and makes styling of a web page more effortless, it is quite limited and would need more css styling to make the best out of the web page. HOW CAN I CHANGE THE STYLING OF BOOTSTRAP CLASSES? Initially, overriding bootstrap classes can be very frustrating. This is common because of the preference given to these classes by the browser. Hence it all boils down to specificity. CSS specificity is the common reason why your CSS-rules don’t apply to certain elements, especially with Bootstrap. This will help you understand more about the specificity principle in CSS. https://www.w3schools.com/css/css_specificity.asp Based on the principle of specificity every selector possesses its numerical weight as follows; 0 point for universal selector (*), body and inherited values (zero specificity) 1 point for tag selectors and pseudo-elements (least specific) 10 points for pseudo-classes and classes (including Bootstrap classes; less specific) 100 points for #id (more specific) 1000 points for inline styling (most specific) Hence when there are two or more selector styles the browser will always choose the one with more weight. Also, the order of your stylesheets may contribute to the preference of styles when competing styles have same weights. 5 TRICKS FOR OVERRIDING BOOTSTRAP CLASSES 1) Ensure the to your stylesheet is directly after the Bootstrap in the of your HTML. <link> <link> <head> <link rel = "stylesheet" href= "https://stackpath.bootstrapcdn.com/bootstrap/ 4.4.1/css/bootstrap.min.css" integrity= "sha384Vkoo8x4CGsO3+Hhxv8T/Q5PaXtkKtu6ug5TOeNV6gBiFeWPGFN9MuhOf23Q9Ifjh" crossorigin= "anonymous" > <link rel = "stylesheet" href= "css/style.css" > 2) Avoid using {!important } declaration if possible. In most cases, some developers use this declaration but this is less flexible as you may need to change some styling later. 3) You may inspect Bootstrap sources, determine how exactly the specific style in which you want to override is defined. Then you may copy that selector and re-style. 4) In some cases from my experience, you may need to identify the particular selector used in Bootstrap and replace it with your selector. For example, having prior used as a Bootstrap class for background color you may remove it from the HTML and replace it with your class which you can style in your css file. This prevents having two conflicting styles for a single element. <class="bg-primary"> <class= "background_color"> 5) One of the easiest ways to override Bootstrap classes is to add an 'id' to its direct or indirect parent element, like this: this adds 100 points to the selector once prefixed to the #id and grants it more specificity. <div id="bg_color-overrides"> For instance ; } } } /* Bootstrap class styling with specificity score => 10 + 1 + 10 = 21  */ .jumbotron_fluid h1 bg-primary { color : dodgerblue; /* Ineffective regular CSS styling with specificity score => 1 */ h1 { color : red; /* Effective CSS styling using id with specificity score => 100 + 1 = 101 */ #bg_color-overrides h1 { color : red; DID YOU PICK UP A NEW TRICK? Congratulations !!!!!!!!!!!!!! I guess you did. With these few tricks you can override Bootstrap classes.   If you need more info visit this should guide on your quest. http://css-tricks.com/specifics-on-css-specificity/ Full Stack Web developer Author : Kossy Steve (kossyeze@gmail.com)

Overriding Bootstrap Classes Using CSS

“If an attacker was able to infiltrate a popular library like log4j, they would very quickly be running with privilege inside most data centers in the world.” — Jeff Williams, Contrast Security (2018) Why Today's Cybersecurity Threats Are More Threatening and How They May Differ From the Hurdles We Met in the Past Over the past two years, the rise of ransomware that goes It's the Tip of The Iceberg. The front-page headlines and revelations of harmful software supply chain attacks have raised cybersecurity to the top of many governments' and organizations' agendas. Meanwhile, even the general public has awakened to the new array of cyber-threats posed by nation-state actors and criminal organizations. By the time I was writing this article, Log4Shell had happened. So that becomes the best example of what I will share — why cyber-threats nowadays are more threatening. I need to tell you the nature of cybersecurity threats is different from the challenges we faced in the Past — from technological complexity to the growing interdependence. Attackers, therefore, seized opportunities faster, much faster than our mitigation. But first, let's talk about what is Log4Shell. Log4j 0-day RCE Vulnerability aka "Log4Shell" (CVE-2021–44228 & CVE-2021–45046) Companies worldwide are racing to limit the damage from discovered in years. A flaw in a program called Log4j, , forced nearly every company to investigate their software to determine if they were vulnerable. one of the most significant open-source software security vulnerabilities used in countless numbers of Java applications built over the last two decades A zero-day vulnerability ( ), publicly released on 9th December 2021 and known as Log4j or Log4Shell, is vigorously being targeted in the wild. As a result, CVE-2021–44228 CVE-2021–44228 has been assigned the highest "critical" severity rating with a risk score of 10/10. As I wrote the article, a second vulnerability was uncovered, logged as CVE-2021–45046. According to MITRE, the description of the new vulnerability, , says the fix to address in Apache Log4j 2.15.0 was "incomplete in certain non-default configurations." CVE 2021–45046 CVE-2021–44228 Updated Log4j CVEs Summary (CVSS score: 10.0) — A remote code execution vulnerability affecting Log4j versions from 2.0-beta9 to 2.14.1 (Fixed in version 2.15.0) CVE-2021–44228 (CVSS score: 9.0) — An information leak and remote code execution vulnerability affecting Log4j versions from 2.0-beta9 to 2.15.0, excluding 2.12.2 (Fixed in version 2.16.0) CVE-2021–45046 (CVSS score: 7.5) — A denial-of-service vulnerability affecting Log4j versions from 2.0-beta9 to 2.16.0 (Fixed in version 2.17.0) CVE-2021–45105 (CVSS score: 8.1) — An untrusted deserialization flaw affecting Log4j version 1.2 (No fix available; Upgrade to version 2.17.0) CVE-2021–4104 Why is this Vulnerability So Destructive? Most security holes require a certain degree of expertise to exploit. However, the effort required with this one, called "Log4Shell," is slight. Most software (and indeed all commercial software) maintains a log of all activity while the software is running, allowing developers and operators to review and figure out what went wrong when users are having trouble. That activity includes keystrokes from user input into web forms on a site. The Log4Shell bug allows an attacker to enter a carefully crafted string of characters in a web form that, once logged, controls the computer on which it is running to download malicious code. Depending on what data the application decides to log, this malicious string could be found in various areas, from an HTTP User-Agent against a web server to a chat room message in . Minecraft At that point, that computer was "hijacked." Malware designed to exploit the vulnerability . was starting to spread Sunday night Adversaries then further exploit affected systems, such as installing crypto-mining software, ransomware, and much more. The result of the exploitation can allow for complete control of the infected system. Additionally, this , thus increasing the overall severity, scale, and impact potential, hence the unusually high CVSS score. vulnerability is exploitable with or without authentication So far, according to and , attackers have exploited the flaw to: MITRE ZDNet Install crypto-miners on vulnerable systems; Steal system credentials (Credential theft); Deploy ransomware; Hide deeper within compromised networks (Persistance), and; Steal data. Recommendations At this time, the vulnerable versions of Log4j range from version 2.0 to 2.14.1. Additionally, there remain potential vulnerabilities in the deprecated 1. x versions. The reasonable solution is implementing the currently available patched version of Log4j that resolves this vulnerability, publicly known as . Log4j version 2.16.0 Also, cybersecurity solutions like , are trying to mitigate the problem by providing “virtual patches.” Endpoint Detection and Response (EDR) Web Application Firewall (WAF), and Intrusion Detection System (IPS) UPDATED — 20th Dec 2021 (CVE-2021–45105) Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j and . 2.17.0 2.12.3 Nature of Cybercrime When we looked at the cyber-criminals 20 years ago, they had to be very technical — the "real hackers" we saw in the movies wearing hoods and typing fast on the keyboards. Now the barriers to cybercrime entry are low, and . cybercrime is becoming a service Today's most lucrative cybercrime activity is ransomware, which fosters more dangerous threats and the need for more innovative cyber defenses. For example, (RaaS) gives non-technical criminals the to tap into cyber-extortion. However, given all the rapid changes in the threat landscape, the real challenge is understanding the risk. Ransomware-as-a-Service Another way hackers can profit from more sophisticated cybercrime is by providing Those in this field provide the services and infrastructure — including — which other bad actors leverage to do their dirty work. cybercrime "infrastructure-as-a-service." bulletproof hosting and botnet rentals Bulletproof hosting helps cybercriminals put web pages and servers on the Internet without worrying about takedowns by law enforcement. And cybercriminals can pay for botnet rentals that give them temporary access to a network of infected computers they can use for spam distribution or DDoS attacks, and much more. Complexity & Interdependency To be clear, it is not the first time we faced such a holiday-breaker. The last time we faced such a crisis was when the Shouldn't we learn from our mistakes? Heartbleed vulnerability was discovered in OpenSSL in 2014. Almost all the major enterprise tech companies and other key open-source projects. However, agreed to contribute to a fund that would maintain the security of OpenSSL there are two further compounding problems: Java has been one of the most famous enterprise software programming languages for a long time, and used in Java applications. Scale: Log4j is one of the most popular logging tools Log4j has also been used in various open-source software programs that often How software is built: serve as a foundation for other software. Open-source software has led to an explosion in enterprise software innovation over the last two decades. Still, there's an open secret in this world: Scores of famous and prominent open-source projects are maintained by a handful of people who aren't necessarily paid to do that work. The problem, however, is not a lack of money: There are so many open-source projects that have been used to build some of the most critical software in the world that is simply determining the ones that need support is an enormous challenge. More Attack Surface — IoT (Example) Even if some major tech players such as Microsoft have improved their security postures, . One particular contributor to this cause is Internet-of-Things (IoT) devices. today's attack surface is far more extensive than it was before One of the things that hackers can do to take devices offline is send malicious packets that crash the machine. Another thing is when they can execute code on the device, which opens up the to other kinds of targets. possibility of persistence on the network or moving laterally Unlike mainframe servers, desktop computers, laptops, and mobile devices, IoT are difficult to update from a security perspective. It is not a simple "to do or not to do" ideology, but limitations lead to challenges of securing IoT. Many IoT devices are designed to be small and have just enough power for a specific function. Thus, there is n As a result, patching is impossible for most IoT operating in the wild. ot enough memory, storage, or CPU capabilities to accommodate security updates. In August, Realtek has warned of four vulnerabilities in . According to the advisory, , including possibly any WiFi-connected devices with that chip design. three SDKs in its WiFi modules almost a million vulnerable devices may be in use VoIP devices, wireless routers, repeaters, IP cameras, smart lighting controls, As in the example of Realtek, the fix involves updating the firmware of the related products in which introduced multiple difficulties: Finding if the IoT devices in use contain the chipset Seeing if the device is under a vulnerable version Updating the firmware Updating firmware involves typically direct access to the devices. That is another challenge in most cases in which those IoT devices may locate in hard-to-reach locations (ceiling, inside the oil tank, inside another machine…). It's perhaps worth adding that , which means hackers can do the same. In other words, that's the scary monster under the bed. everyone can find affected hardware using the Shodan vulnerability search engine Back into BlackHat 2016, Log4Shell was Found. Lastly, there's also the reminder that we should pay more attention to security research. For example, in Black Hat USA 2016, Alvaro Muñoz and Oleksandr Mirosh . researched issues with JNDI Although not naming Log4j specifically, it is the flaw in the underlying interface that Log4j uses. Knowing that Log4Shell is an "I told you so" is, of course, little comfort now to all security professionals who are working at 110% looking to address the problem. However, knowing that it was found in 2016 highlights the importance of giving security teams access to relevant information from the research and the resources — time, money, and more — required to apply these lessons to an organization's own infrastructure and practices. Recommendation — Again, Zero Trust & Defence-in-Depth Proven security principles, such as , also have a substantial role to play. Many security teams understand these concepts well and wish to apply them to their organizations' software and solution deployments. defense-in-depth and Zero Trust Framework However, they are often met with resistance from other stakeholders or lack the resources to deploy them. As I mentioned previously, we are still on the journey of getting there. Hopefully, the increased adoption of automation— such as , mainly when used in modern pipelines built around CI/CD — makes it possible for security teams to cooperate with developers to build more secure solutions from the beginning and across multiple systems. infrastructure as code The Zero Trust principle also plays a vital role at the host, application, and network levels. For example, what actual privileges and capabilities do the process leveraging Log4j need at the host level. Increasingly, can act as a powerful combination to mitigate the impact of an exploited system. behavior monitoring (EDR, NDR, and XDR) alongside runtime protection Notably, at the network level. With Log4Shell being a two-stage attack — where the payload has to be downloaded from an attacker-controlled system — the ability to isolate the infected system is advantageous. Zero Trust access exemplifies itself via micro-segmentation Final Words — Time Bombs Inside Software Those early days when worms and viruses were poised to cripple significant portions of the web, we didn't do anything as an industry: We didn't implement better technologies, reduce our attack surface, or work on memory corruption issues in the codebase. No matter Log4j or Realtek Vulnerability — It's the Tip of The Iceberg. Much work is left to understand the real dangers behind the foundations of IT/OT/IoT connectivity. However, the more parties we can get involved in finding vulnerabilities, fixing them, and providing higher-level solutions, the faster we can transition to a more secure world. Please visit the link below for the most updated guidance on Log4j vulnerability mitigation: https://www.cisa.gov/uscert/apache-log4j-vulnerability-guidance Also published behind a paywall here .

Time Bombs Inside Software: 0-Day Log4Shell is Just the Tip of The Iceberg

Photo by on Unsplash Drew Beamer What We’ll be Building: We will be building a machine learning model that will predict whether a candidate will or will not be hired based on his or her credentials. This is part one out of a three-part series we will be developing. This part is only concerned with developing the machine learning model. Introduction Prediction algorithms have evolved into a profitable source of solutions to our modern-day challenges as a result of thorough development processes, phases, and time. These machine learning algorithms have been a tremendous boost in dealing with various challenges in our timeline. The human resources (HR) department inside organizations and businesses definitely will appreciate these improvements. With a machine learning model trained to identify worthy candidates for a job, a huge chunk of errors and losses can be avoided by an organization. Machine learning prediction algorithms have come to stay and with more data, algorithms, and strategies being developed and refined I believe the future of business is a lot brighter. Prerequisite To properly digest this tutorial, a good understanding of the following tools is required. Python Anaconda What is a Predictive Machine Learning Algorithm? Firstly, let's discuss what machine learning is. To simply state, machine learning is a sub-field in the area of artificial intelligence saddled with the responsibility of making a machine intelligent through training on datasets. . This procedure is based upon some mathematical formulas and equations. These mathematical-based algorithms are geared to learn patterns and statistics from a well-defined dataset. Secondly, an algorithm is a step-by-step computational instruction designed to solve a problem Lastly, prediction is the ability to forecast outcomes. It's kind of what a prophet will do, however, while a prophet predicts by inspirations, a machine learning algorithm predicts by historic data. Building a Predictive Machine Learning Model To build a machine learning model, a machine learning algorithm must be used to learn the statistics and patterns buried within the dataset. Choosing a Development Environment To proceed with building a machine learning model, the appropriate development environment must be put in place. Like before the building of a house, a good environment that will allow your machine learning code to run is required. Choosing a machine learning development environment is predicated on your familiarity with a machine learning programing language. The two most popular programming languages for doing this is and . Python R For this article, we'll be using the Python programing language, however, choosing a programing language alone is not enough, a development environment is also needed for this task. Anaconda does this very well. Anaconda is a data science and machine learning development package. It comes shipped with all the necessary libraries, programs, and configurations that will get you developing your model in a few minutes. For installation guidance, visit their and documentation page, or you can visit my for the installation procedure. website Git Repo To set up the environment using the following steps: 1. Head to [Anaconda](https://www.anaconda.com/products/individual) Site
2. On the page download Anaconda for your operating system.
3. Install the Anaconda package to your computer.
4. Visit [https://downgit.github.io/](https://downgit.github.io/).
5. Paste `https://github.com/Daltonic/predictive/tree/main/model` in the field thereon and click on the download button.
6. Unzip **model.zip** and place contents in a unique folder. You should have something like this. You should have a structure such as the one in the image below. Next, Open Anaconda Navigator and lunch Spyder from the options. You should have a structure such as the one in the image below. Good, let’s proceed to import the libraries we will need. Importing Libraries There are different kinds of Python libraries available on the web and each has its use and area of applicability. For what we're building, we will just need three libraries namely , , and . Pandas Numpy Scikit-learn # Importing Libraries
import pandas as pd
import numpy as np Now, create a folder called and within it create another folder called and save the code on the Spyder Editor in the folder you last created . “machine-learning” “predictive” (predictive) The rest of the libraries we will be using will be imported as we go. Let’s proceed to import the dataset for this model. Copy the file named within the file to the folder called . See the image below for guidance. hireable.csv model.zip “predictive” Once you have it in the folder named predictive, proceed by pasting the code snippet below in the opened Spyder Editor. # Importing Dataset
dataset = pd.read_csv('hirable.csv') Here we used the Pandas library to read our CSV file into the program. By checking the variable explorer, here is how our dataset currently looks. We don’t need all the columns, we only need are the following columns. gender degree_p mba_p workex etest_p status We will proceed by doing some clean-up on the dataset. Paste the code snippet below in your Spyder code editor to have your data cleaned up. Cleaning up the Dataset # Cleaning up dataset
dataset = dataset.drop([
    "sl_no",
    "ssc_p",
    "ssc_b",
    "hsc_p",
    "hsc_b",
    "hsc_s",
    "specialisation",
    "salary",
    "degree_t"
], axis=1)
dataset = dataset.rename(columns = {'degree_p': 'bsc', 'mba_p': 'msc'})
dataset['gender'] = dataset.gender.replace(['M', 'F'], [1, 2])
dataset['workex'] = dataset.workex.replace(['Yes', 'No'], [1, 0])
dataset['status'] = dataset.status.replace(['Placed', 'Not Placed'], [1, 0]) The above codes will drop most of the unnecessary columns, rename some hard-to-read columns and apply the suiting values to each row of the column. The and scores are not in the format required for this model. We want to use systems and not percentages for those two columns. Let’s create a function to downscale these numbers to the appropriate values using the snippet below. BSc MSc CGPA # Downscalling Method For BSc & MSc grades
def downscale(score):
    return score/10/2
degrees = ['bsc', 'msc']
for col in degrees:
    dataset[col] = downscale(dataset[col]) Great work, now let’s proceed to separate the dataset into dependent and independent variables. Separating Dataset into Variables This is a crucial step in developing a predictive machine learning model. We want to see how can tell us about . The objective in separating the dataset into and variables is to see the relationship and how affects the outcome of a, b, c, d z X(n…) Y X(n…) Y. While is the independent variable containing one or many columns of data, is an independent variable and it contains one column which is the outcome. X (n…) Y The above explanation can be implemented in Python using the Pandas package as seen in the code snippet below. # Separating into dependent and independent variables
X = dataset.drop(['status'], axis=1)
y = dataset.status Now we have X and Y variables containing the following columns. gender bsc workex etest_p msc Terrific, we have successfully done the separation, let’s go a step further to splitting these variables into training and testing sets. Splitting Variables into Training and Testing Sets This step is very important if we must build and train our model to learn from our dataset. We split data into training and testing sets so that our model can learn the statistics and patterns. Afterward, it will be subjected to testing by feeding it with the test dataset. This will tell us the extent of learning our model has attained from the training dataset. We will be using the to achieve this. The split will be in the ratio of , where of the dataset will be for training and will be for testing. See the codes below. Scikit-learn library splitter method 80% - 20% 80% 20% # Splitting dataset into trainig and testing
from sklearn.model_selection import train_test_split
X_train, X_test, y_train, y_test = train_test_split(X, y,train_size=0.8,random_state=1) What’s happening here is that is an entire module and it contains classes and methods. We use the method found in the module to split our variables. sklearn train_test_split model_selection Fitting Training Variables to a Machine Learning Algorithm Here is the part we give breath to our machine learning model. We are using the machine learning algorithm called “ ” of the sklearn library. RandomForestClassifier Without explaining much of the math behind this algorithm, this algorithm will learn from the training dataset and be able to perform classification and prediction based on the intelligence it has gathered from the training dataset. Observe the code snippet below. # Fitting with random forest model
from sklearn.ensemble import RandomForestClassifier
model=RandomForestClassifier(n_estimators=100)
model.fit(X_train,y_train) Impressive, we are almost done with building our model, let’s test this just created model and see how it’s performing. Model Prediction and Testing We can’t be so sure of the performance of our predictive machine learning model until it undergoes some testing. We will be using the and method of the library to check the accuracy report of our model just after we have tested it. The code block below implements this operation. classification_report metrics sklearn # Prediction and testing
y_pred=model.predict(X_test)

# Report and Accuracy Score
from sklearn import metrics
from sklearn.metrics import classification_report
print("Accuracy:",metrics.accuracy_score(y_test, y_pred))
print("Classification Report RF:\n",classification_report(y_test,y_pred)) By running the above code block, you should have a score similar to mine, see the image below. Our model has an accuracy score of about It ****was able to predict instances of of variable and instances of for variable . 86%. 76% truly negative values Y 92% truly positive values Y We can also proceed further to test it on an entirely new dataset with the following codes. # Model testing on new data
# [[gender, bsc, workex, etest_p, msc]]

# Sample 1
sample = np.array([[0, 2.9, 1, 78.50, 3.7]])
model.predict(sample)

# Sample 2
sample = np.array([[0, 2.9, 1, 78.50, 3.7]])
model.predict(sample) The above code block will produce the result showcased in the image below. As you can see from the above outputs, the first candidate when subjected to the model, predicted that he wouldn’t be hired due to his credentials, whereas the second candidate was hired. Now let’s finish up by saving our model for other usages. Saving Your Model To preserve your model for future use such as deploying to a production server we must save the model to a file. To store your model in a file, we use a package called . The below code snippet describes how to implement it. “Pickle” # Saving model
import pickle
pickle.dump(model, open('hireable.pkl', 'wb')) You can use the codes below to load up your data. This is not important for this tutorial but it will be vital for part two of this article which is to develop an API for communicating with this model. loaded_model = pickle.load(open('hireable.pkl', 'rb'))
result = loaded_model.score(X_test, y_test)
print(result) Congratulations!!! You have just completed one out of three-part series on building a machine learning predictive site with React and Python. You can get the source code for this project on my Git Repo . here Conclusion To conclude, handling the process of hiring an employee manually can be tedious, time-consuming, and error-prone. However, with predictive machine learning models trained to handle this sort of task, the job of hiring a new employee will be greatly simplified. As time goes, more companies and businesses will increasingly utilize more predictive machine learning models to solve their business problems such as the model we just built. About Author Gospel Darlington is a remote web developer, prolific with technologies such as , , , and . He takes a huge interest in the development of high-grade and responsive web applications. Fullstack VueJs Angular ReactJs API development Gospel Darlington currently works as a that teach other developers how to integrate software products into their personal projects. freelancer developing apps and writing tutorials He spends his free time on how to be successful in life. His hobbies include inventing new recipes, book writing, songwriting, and singing. You can reach me on , , , , or for any discussion. coaching young people Website LinkedIn Twitter Facebook GitHub Also published here.

Model Development: Build a Predictive Machine Learning Site With React and Python (Part 1)

Golang: A Beginner' Guide To Getting Started

Disclaimer This is a story about how I’ve published a cry for help on my less than a week ago and somehow found myself coordinating a group of 350 PhDs and AI specialists that are working 24/7 to help humanity fight coronavirus. Linkedin without any compensation If this doesn’t fascinate you as a phenomenon, then please stop reading and get back to watching Netflix. This is a story about how 350 people are refusing to watch TV and scroll Facebook feeds, they are making a real difference and impact, right now. It’s a story of how global community is coming together and helping spread the word, be it an investor from a top VC fund or a person that got laid off and has nothing to do: So… why are we doing this? We are all in this together and we are living through unique time when every single country is equal, when every single layer of society is susceptible to the common enemy. Yes, Tom Hanks is as equal as a middle-eastern dictator, Justin Trudeau is as equal as Trump and yes, you are as equal as 1% of the wealthiest. Suddenly nationalism doesn’t matter, doesn’t matter if you support capitalism or socialism, if you are democrat or republican, if you are a legal or illegal immigrant, it just doesn’t matter. Both the epidemic itself and the resulting economic crisis are global problems. They can be solved effectively only by global co-operation. First and foremost, in order to defeat the virus we need to share information globally. That’s the big advantage of humans over viruses. © Yuval Harrari Though some people are still skeptical and are strong believers in the conspiracy, comparing it to ordinary flu by the numbers of deaths and say that people were dying from many other diseases and no one ever cared. And yes, people were dying from many different diseases every day and it didn’t seem like everyone was dropping what they were doing and was immediately jumping into research to help with diabetes/HIV/etc. (footnote: why didn’t we care? why shouldn’t we care??) So what’s different now? It’s quite simple and I don’t need any flatten curve graphs to explain this. Even though everyone seems to and pretends that’s a cure/silver bullet to solve the current crisis. For those believers, here’s a not so controversial advice, it’s not a solution. love those graphs (for fans of “Idiocracy” ) movie It’s an attempt of our brains to keep us sane and pretend we are safe assuming everyone is a responsible, diligent and disciplined individual that understands highly complex long terms effects and 2nd/3rd order consequences of every single action that is taken (thank you, Ray Dalio). google trends search for flatten the curve See? No one cares about things like virality, it’s too complex and harder to understand/model than two basic curves that literally scream at you “we know how to solve this, it’s actually very easy, see the graph, don’t you see it? it actually moves and… it’s got some green electrolytes!” Even google doesn’t care about virality, it actually explains what virality is in terms of internet memes… c’mon guys? And it’s really all about virality. And also novelty, complexity and lack of our ability to explain this emerging common enemy. There is literally ZERO understanding. Everything that you hear in the news is an educated guess combined with statistically irrelevant data. Trump made 33 false claims about the coronavirus crisis in the first two weeks of March And you know, I don’t actually blame governments, this is a product of the broken system that we are observing as we sit at home quarantining ourselves to boredom. And god bless the US government because it actually acknowledges it and is really trying to fix this mess. And that’s exactly why WhiteHouse in cooperation with Allen Institute of AI (backed by Microsoft co-founder) decided to reach out to us. Not me personally, but to the whole world of AI researchers like me, to seek help and get that precious brainpower of ours. Tech firms publish massive CORD-19 dataset to help fight the coronavirus - SiliconANGLE What happened next is history. I can’t explain it, I can’t model it and I certainly wasn’t ready for it. Still not ready as I’m carving out a few mins out of another 20h workday to finish this article. Timeline to impress you with some numbers… Day 1: I talked to 10 people, had 15 calls. Discovered covid-19 Kaggle challenge and my main learning was that there are so many hardcore machine learning engineers that are willing to help but they have no clue what to do. I decided to help shape that structure and bridge the gap between general questions like “What are the risk factors of covid-19” and technical formulation of the machine learning problem. Day 2: I talked to 30 people, had 40+ calls. Realized I can’t do it anymore and I’m not the smartest person to help. Decided to create a trello board and slack and actually project manage this impressive chaos. Day 3: I talked to 60 people, stopped counting calls. Realized that the core focus should be something interactive and something that would produce visual results. We’ve decided to score 10 existing tasks to focus on the top 3 based on our subjective reasoning and immediate impact. Day 4: the group had 150 members. Something crazy started happening, more self-organization started to emerge, some non-technical people started helping me manage others, we’ve started realizing that we have some new form of organization that is actually getting stuff done, quite effectively. Someone would formulate a task, go to bed and wake up to a completed task by some random stranger from Australia, how much more powerful can this become? Day 5: the group had 200 members We bought the domain and quickly mocked up a website to expose ourselves as a group, not just a random collective of couple hundred geeks. Who knew all possible domains including “corona” are all taken by domain hoarders… Day 6: the group had 250 members We’ve prepared some external communication pieces because people started wondering what exactly are we and what’s the point. As you can imagine not the easiest task when most of the team are highly intelligent but super introverted individuals. But we made it happen, . check it out Day 7: we are now 350 members strong. Some structure is emerging, we are tackling 4 tasks that we’ve identified as most feasible to help with and we now have individual teams working on those. We now have communications team that is integrating medical experts, we are working with both independent researchers and organizations, and we are now the largest independent organization with the strongest pool of highly technical and highly motivated talent that is tackling COVID-19 data analysis. Wait, what’s going on? is this a cult? don’t you have a job? It definitely feels like a cult, how else do you explain people spending so much time together solving things they have no clue about and trying to think beyond their typical 9–5 responsibility. Ignoring families, ignoring their kids, not sleeping and grinding through unstructured, highly complex and often depressing data on statistics of mortality... But here’s a thing, we are , we are those and we , much faster than any other company or team. People from NASA/Intel/Amazon are joining us and sometimes I question myself if this is all a weird dream of mine or something? but it’s real and it seems like the most intelligent and proactive people are self-organizing around us. believers crazy ones get things done People are even asking us to give them materials to request dedicated volunteering time from their organization. Honestly, we have no clue how to do that yet, but we will. And of course, nothing is perfect. There is a lot of frustration, with the lack of structure and process, the inability of other companies/organizations to move as fast as we need to and simply because no one has ever built such a fast moving structure that is fully distributed across the globe, across hundreds of different disciplines, professional and cultural backgrounds. And the one that is solving extremely complex problems in a short timeframe. Priorities, organizational issues, timezone management, communication protocols… It’s taking us a week to ask for computational resources from Amazon/Google and other giants and they are trying their best but are unable to move as fast (pls help us here if you can). - Is it just for AI geeks? Not really. We’ve got people of diverse backgrounds and skillsets. And we need more, way MORE. - Is it just for geeks in general then? Not really. We’ve got professors of nuclear physics (pretty cool huh). We’ve got psycholinguists?! We’ve got impact investors… We’ve got all kinds of PhDs, you name it! - But do you have any medical experts or are you just coding? - So are you saying anyone can help? That’s exactly how it is. And even more importantly, we are currently . We are literally 3–6 people that manage 300+ full time, as you can imagine we barely sleep and have any rest, but we are feeding off the energy and motivation keeps coming. severely understaffed with non-technical talent - Soo… you didn’t answer the main question, don’t you have a job? Yes, we all have jobs. For now. The right question to ask is if YOU will have a job soon. Because the current economic crisis suggests we won’t. No matter how skilled you are, no matter which field you are working in. It’s no longer just restaurant workers, uber drivers or cruise ship employees. It’s all of us and everyone is affected. And if you haven’t been affected by the wave of layoffs, you certainly have a friend who has been. It sucks. anonymous data from Blind app It all started 2 weeks ago when entrepreneurs and business owners entered the cash preservation stage in attempts to save their businesses. And it all spiraled. The wheels of economic machine started to spin in a negative direction. Unfortunately, many were not prepared at all. anonymous data from various entrepreneur communities supporting each other in tough times And this will keep spiraling until all of us will realize, there is no magical trillion dollar package that will save us, you can’t flatten that curve, this money has to come from somewhere… That’s why we are doing it, because we realize the consequences of passively watching the world falling apart. If anything, it’s a perfect time to rebuild it and make things right. A new world, new opportunities & new models Even though it’s going to be tough for a bit, we are seeing something amazing emerging out of this crisis. Self-organization is taken to a completely new level that we’ve never seen before. Some are even comparing it to the war times when researchers like Alan Turing were working 24/7 to crack the codes for intelligence purposes. It took us less than a week to go from 10 to 300 people. And similar things are happening everywhere across the world. If someone would ask me how much it would take to employ such talent a few months ago, I would say around $100m and next to an impossible chance of gathering such a team even in months of active recruiting. That’s a pretty big number, but does it match up to the potential impact? It doesn’t, if you compare it to $2 trillion of damage the US government alone is about to take on… 2,000,000,000,000 dollars > 100,000,000 dollars What’s next? Now that you know what we are doing, you may be wondering how can you help us if we are so smart and have so many people already? and what’s the point of this article at all? The truth is — we do need help. YOUR Here are the tasks we are currently working on: - Help us understand how geography affects virality. - What do we know about COVID-19 risk factors? - What is known about transmission, incubation, and environmental stability? - What do we know about vaccines and therapeutics? Here are the things we need help with: CoronaWhy call to action document here If you feel like joining, go ahead and submit the contact form with “Join” purpose on our website: https://www.coronawhy.org/ Here’s a snippet of what you will experience: Also, what’s in it for you? - Get practical experience in a fully global distributed remote team (quite an important skill that is very relevant in the coming era) - Learn how AI/ML is helping in solving real world scenarios, not detecting cats and dogs - Solve a billion dollar problem, or a $2 trillion one - Get volunteer experience on your resume, once a lifetime experience on saving humanity from a deadly virus - Save lives! Save your family, friends and loved ones! And if you feel like this article deserves to be read — please help us and share it with your friends on other platforms. That’s a rare moment when AI guys are asking you to help with the same algorithms they are usually creating (what an irony), but that’s a story for another article! Let’s go! <iframe src= width= height= frameBorder= = allowFullScreen> <a href="https://giphy.com/gifs/page-idiocracy-vDZACy278sqT6">via GIPHY</a> "https://giphy.com/embed/vDZACy278sqT6" "480" "260" "0" class "giphy-embed" </ > iframe < > p </ > p PS: Please do share this article, even if there is 0.00001% chance anyone will see it, . The impact of these 10 seconds of your life will be paid back in all the sleepless nights research community can save. please do PPS: We got posted on ProductHunt, please jump in to support us. CoronaWhy - Globally distributed, fully remote COVID-19 AI task-force | Product Hunt

How 350+ PhDs and AI Researchers are Banding Together to Fight the Corona Outbreak

The Linux kernel is widely considered the pillar of some of the most popular projects among the open-source community. As the central module of the O.S, the system’s stability, performance, and security rely heavily on the kernel. For this reason, developers need to have a complete understanding of common software glitches and vulnerabilities that hit the Linux kernel. This helps to not only minimize the chances of exploits but also improve the overall quality of the software you build. Most vulnerabilities in the Linux Kernel are associated with flaws such as , uncontrolled format string, buffer overflow, integer overflow, and OS Command injection. Regardless of the weakness behind a vulnerability, there are three primary factors that determine its impact or severity. These are: SQL injection The presence of a vulnerability within the software Existence- The possibility of attackers gaining access to a vulnerability Access- The potentiality of attackers taking advantage of a vulnerability using specific techniques or tools. Exploit- By exploiting known , hackers may compromise a system by gaining root privileges, causing a system crash, or accessing the memory. In this article, we will walk you through three of the most common Linux Kernel vulnerabilities. We will also dive into how you can detect and mitigate these vulnerabilities vulnerabilities 1. CVE-2019-11477 Dubbed as TCP SACK PANIC, CVE-2019-11477 is caused by an integer overflow as the Linux networking subsystem processes TCP selective acknowledgment (SACK). While processing TCP SACK segments, the kernel's socket buffer data structure is fragmented. To efficiently process the SACK blocks, the kernel merges multiple socket buffers into one, which potentially overflows the variable holding the number of segments. An attacker could exploit this vulnerability by sending crafted SACK requests thereby causing a kernel panic condition. Exploitation of CVE-2019-11477 could affect the system’s availability, thus causing a denial of service. Worth a mention is that CVE-2019-11477 is closely related to two other vulnerabilities assigned CVE IDs: CVE-2019-11478 and CVE-2019-11479, both considered to have moderate severity. CVE-2019-11478 is related to TCP SACK while the latter is caused by a flaw when processing Maximum Segment Size (MSS). CVSS Score: 7.8 Affects Linux kernels 2.6.29 versions and above Vulnerability Type(s): Denial of Service A flaw in the Linux kernel allows attackers to send a specially-crafted sequence of SACKs requests which fragments the TCP retransmission queue. By exploiting the fragmented queue, an attacker could cause an expensive linked-list walk for SACK requests received for the same TCP connection. The result would be excessive system resource usage as the CPU attempts to reconstruct the list. CVE-2019-11478 – This vulnerability is caused by a flaw that allows hackers to send packets with low MSS value, thus leading to excessive resource consumption. The attacker forces the kernel to segment responses into several TCP segments, each containing only 8 bytes of data. This increases the bandwidth required to transmit the same amount of data, thus leading to excessive consumption of CPU resources and NIC processing power. While the impact of the attack may end after the adversary stops sending traffic, there is a significant reduction in system performance that results in a DoS for some users. CVE-2019-11479 – Resolving TCP SACK PANIC Vulnerabilities If your system is prone to these TCP SACK PANIC vulnerabilities, you need to take quick action by disabling the vulnerable component. Alternatively, you can use iptables to drop connections whose MSS size can successfully exploit the vulnerability. The second is more effective as it mitigates the three vulnerabilities. To prevent connections with low MSS, use the following commands for traditional iptables firewalling (Note: You need to disable net.ipv4.tcp_mtu_probing for this fix to work effectively). This drops all connection attempts whose MSS size ranges between 1 and 500. 2. CVE-2017-18017 CVSS Score: 10.0 Affected versions: Before 4.11, and 4.9x before 4.9.36 Vulnerability Type(s): Denial of Service, Memory Corruption A flaw caused by the Kernel’s failure to handle exceptions can lead to a denial-of-service condition. In the vulnerability, the function tcpmss_mangle_packet found within net/netfilter/xt_TCPMSS.c allows remote hackers to execute a DoS attack. Attackers can also perform unspecified actions by leveraging the existence of xt_TCPMSS in iptables actions. The function net/netfilter/xt_TCPMSS.c plays an important role in filtering network communication in that it defines the MSS that is allowed for accepting TCP headers. The impact of this kind of flaw could be potentially severe considering attackers can exploit the vulnerability remotely. Here is a code snippet that can be applied to mitigate this vulnerability: CVE-2017-18017 3. CVE-2018-5390 CVSS Score: 7.5 Affected Versions: Linux Kernel 6 and above Vulnerability Type(s): Denial of Service is a moderately severe vulnerability in the Linux Kernel also known as SegmentSmack. It occurs due to a flaw that exists in the way the Kernel handles specially crafted TCP packets. Remote attackers can exploit this flaw to trigger expensive calls to tcp_prune_ofo_queue() and tcp_collapse_ofo_queue() functions by sending modified packets within active TCP sessions. This causes CPU saturation and insufficient bandwidth to support incoming network traffic on the system, ultimately leading to a denial of service. However, for an attacker to maintain the DoS condition, they require continuous two-way sessions to an open port, which means attacks cannot be done using spoofed IP addresses. CVE-2018-5390 Resolving the SegmentSmack Other than installing an updated or fixed Linux Kernel, you can mitigate the vulnerability by changing the default 4MB and 3MB values of net.ipv4.ipfrag_low_thresh and net.ipv4.ipfrag_high_thresh  (as well as their IPv6 counterparts) to 192kB and 256kB respectively. The result will be a significant drop in CPU saturation during the attack. Here is a simple script that can be used to change or lower the default settings for both IPv4 and IPv6. #!/bin/shif [ "x$1" == "xlow" ]; then    echo Settinig limits low:    sysctl -w net.ipv4.ipfrag_low_thresh=196608    sysctl -w net.ipv4.ipfrag_high_thresh=262144    sysctl -w net.ipv6.ip6frag_low_thresh=196608    sysctl -w net.ipv6.ip6frag_high_thresh=262144    echoelif [ "x$1" == "xdef" ]; then    echo Settinig limits default:    sysctl -w net.ipv4.ipfrag_high_thresh=4194304    sysctl -w net.ipv4.ipfrag_low_thresh=3145728    sysctl -w net.ipv6.ip6frag_high_thresh=4194304    sysctl -w net.ipv6.ip6frag_low_thresh=3145728    echofiecho Current values:sysctl net.ipv4.ipfrag_low_threshsysctl net.ipv4.ipfrag_high_threshsysctl net.ipv6.ip6frag_low_threshsysctl net.ipv6.ip6frag_high_thresh Protect Yourself against Linux Kernel Vulnerabilities The most effective way to protect yourself against and associated exploits is continuously scanning your repositories. This way, it is easier to identify vulnerable open-source components in your project and provide necessary remediation on time. One of the best tools for the job is , a GitHub app that lets you scan unlimited private and public repos to detect vulnerabilities in real-time. If Bolt discovers vulnerabilities within your code, it auto-generates a new issue in the issue tracker. It also provides a detailed report showing the vulnerability’s CVSS score as well as suggested fixes. Here is a snapshot showing how GitHub developers use Bolt to harness the power of open source without compromising on security or agility: Linux Kernel vulnerabilities WhiteSource Bolt Other than using Bolt, it is crucial to ensure your software product versions are always up to date. This will help you stay protected as patches and fixes are often rolled out in newer versions.

How To Fix The Most Common Linux Kernel Vulnerabilities

RTOP, Datatypes, Let Bindings, Lexical Scoping, If-Else and Switch, Records, and Variants More than being a new language, (Reason for short) is a syntax and toolchain that is powered by . It gives OCaml a familiar syntax that is geared towards programmers, and also caters to the / workflow. ReasonML OCaml JavaScript NPM Yarn With the help of , Reason can compile into readable JavaScript code. It can also be compiled to a fast, bare-bone assembly. BuckleScript Reason is statically typed, providing us with a better clarity while evolving the code base. Instead of writing all the types all the time, the compiler itself can infer most of the types. This is of a where I will help you make sense of ReasonML and all of its syntax and semantics. I will go through everything from basic to declaring in ReasonML. part 1 3 part series datatypes functions Setup and RTOP Reason CLI Before we begin, make sure that you have installed the latest version of on your system. Reason CLI If you are using macOS, open a terminal and enter this command. npm install -g reason-cli@3.1.0-darwin This will install Reason CLI on your system, along with Reformat and Merlin. You will also get RTOP, an interactive command line tool. This tool will make things really easy for us. Using RTOP If you type in your command terminal, you will something like this: rtop If you type some basic math like , RTOP will get evaluate it and get you the result. 1 + 1; Reason # 1 + 1;- : int = 2 RTOP’s output is made up of three things. let binding: type definition = result If you don’t type the semicolon after , RTOP will not trigger the evaluation. 1 + 1 You might have noticed that there is list at the bottom of the terminal. This list will give us a possible set of modules and functions that we can use. When we out the value, we will see the value and the output of the evaluation. print Reason # print_int(42);42- : unit = () Datatypes and Operators Ints and Floats If you try to do using RTOP, you will get an error message because Reason has a special operator for working on float values. 1.1 + 2.2 In order to perform operations of float values, we need to add a next to the operator. So will become: . 1.1 + 2.2 Reason # 1.1 +. 2.2- : float = 3.30000000000000027 Comparing values To compare values, we can use several relational operators, or structural equality using . == Reason # 2 > 3;- : bool = falseReason # 2 == 3;- : bool = false You cannot directly compare an int value with a float value. To do so, we will need to first convert the int into a float. Reason # float_of_int(2) > 3.1;- : bool = false Reason comes with many such utility functions that can help us convert types. Reason # bool_of_string(“true”);- : bool = true; Boolean Since booleans can only be true or false, there isn’t much difference in Reason from what we usually do in JavaScript. Boolean operators are for , for , and for . ! NOT && AND || OR Strings Strings are also straight forward. They are only limited by the use of . Strings can be concatenated using . "" ++ Reason # "Hello" ++ "World"- : string = "HelloWorld" Reason also comes with a special data type for single-letter strings. Reason # 'a';- : char = 'a'; Null Passing null value in Reason is similar to how we do it in JavaScript. Null is defined with and has its own type called unit. () Reason # ();- : unit = () Let Bindings, Type Inference and Type Aliases Let Bindings Let bindings allow us to bind values to names in a way that is very similar to variable declaration in other languages. Using , we can bind a string value to a variable like this: let Reason # let name: string = "Rajat";let name: string = "Rajat"; The general pattern of binding look like this: let Reason # let <name>: <type> = <expression>; If you are coming from a JavaScript background, then you might wonder why we need to provide the . This is because Reason is statically typed, which is quite different from a language like JavaScript, which is dynamically typed. Statically typed languages requires us to declare or infer the types at compile time. type Type Inference We have seen how to declare our types. Now let’s take a look at how to infer them. Reason # let rajat = "Rajat";let rajat: string = "Rajat"; The Reason compiler infers that the type of value is a string. This is a great feature as it allows us to have full type safety without declaring the types all the time. This means that types are optional in Reason, but you also explicitly write them down if you want to. Immutability bindings are immutable. So if we bind a value to a variable, we cannot change it later on. let But, we can create a new binding of the same name. This new binding will shadow over the previous the binding, and the binding will now refer to the newly-assigned value. let Type Aliases After shadowing a binding, it has nothing to do anymore with the previous one. So we can even use a different type for the new binding. let Reason # type score = int;type score = int;Reason # let x: score = 10;let x: score = 10; Lexical Scoping Reason has Lexical Scoping. This sets the scope (range of functionality) of a variable so that it may only be referred from within the block of code in which it is defined. A variable declared like this is sometimes referred to as a private variable. First, I will create a local scope in Reason using RTOP. Reason # { 100; };- : int = 100 The scope can contain multiple imperative statements. The last statement will be automatically returned. Reason #{ print_endline("Rajat"); 100; };Rajat- : int = 100 Inside the scope, we can access bindings that are outside the current scope. But bindings defined defined inside a scope aren’t accessible from the outside. let Reason # 100;- : int = 100Reason # let x = 10;let x: int = 10;Reason # {100 + x; };- : int = 110Reason #{let y = 1;110 + y;};- : int = 111 We can also shadow a binding inside a scope, it won’t affect the bindings outside this local scope, even with different types. let let Reason # let rajat = "Rajat";let rajat: string = "Rajat";Reason #{let rajat = 100;rajat;};- : int = 2Reason # rajat;- : string = "Rajat" If-Else and Switch If-Else allows us to perform different expressions based on the provided condition. if-else Reason # let isHungry = true;let isHungry: bool = true;Reason # if (isHungry) {"Pizza!"} else {"Still Pizza!"};- : string = "Pizza" Here, is an expression and therefore can be reduced to a value. This means it can be bound to a binding. In languages like JavaScript, is a statement, not an expression. Trying to bind it to a name will throw a syntax error. if let if The fact that is an expression in Reason can be quite useful. But it also comes with its limitations. Every branch of needs to be evaluated to the same type, so we can’t do the following: if if-else Reason # let food = if (isHungry) {"Pizza"};Error: This expression has type string but an expression was expected of type unit So we can still use for things like printing a value as long as the last statment returns the type unit. does so. if print_endline Reason # if (isHungry) {print_endline("isHungry is set to true")};isHungry is set to true- : int = () Switch Switch accepts a value and matches it against the . The case of the matching, which has to be an expression, then is evaluated. In its simplest form, just matches for structural equality. pattern pattern Reason # let lamp =switch (1) {| 0 => "off"| 1 => "on"| _ => "off"};let lamp: string = "on";Reason # lamp;- : string = "on" If you don’t add the switch statement for , then Reason will keep throwing you warning for case , then , and so on. is like the case for switch in JavaScript. _ 2 3 _ default Pattern matching can be done with any type of data. For a string: switch ("Evie") {| "Altair" => "One"| "Ezio" => "Two"| "Connor" => "Three"| "Edward" => "Black Flag"| "Arno" => "Unity"| "Jacob" => "Syndicate"| _ => "Unknown"};_ : string = "Unknown" Records Records allow us to store various types of data into one structure and reference them by name. To create a record, we first have to define its structure. type super = {hero: string,alias: string,}; Once defined, we can create a record for a superhero like this: { hero: "Superman", alias: "Clark Kent" };- : super = {hero: "Superman", alias: "Clark Kent"} The type is inferred by default and we do not need to specify it. We can also access a particular field of a record like this: # let super = { hero: "Superman", alias: "Clark Kent"};let super: super = {hero: "Superman", alias: "Clark Kent"};# super.hero;- : string = "Superman" If you try to access a field that doesn’t exist for a record, Reason will throw you an error. Alternatively, you can leverage structuring in combination with the binding. We start with a binding, then describe how to map the fields, and place the record to be structured. let let # let {hero: heroName, alias: aliasName} = super;let heroName: string = "Superman";let aliasName: string = "Clark Kent"; We can also restructure a particular field of a record. # let {hero: heroName} = super;let heroName: string = "Superman"; Variants Variants allow us to express module options that are exclusive to a data structure. # type answer = Yes | No | Maybe; This is a variant that is referrring to a set of tags. Note that tags in variants need to be capitalized. We use to bind these tags: let # let isItRaining: Yes;let isItRaining: answer = Yes; Using variants, we can express anything with as many options as we want. Variant is most useful with the expression. It allows us to check every possible case of a variant. switch # let message =switch(isItRaining) {| Yes => "Better take an umbrella"| No => "Ok then"| Maybe => "So take an umbrella to be safe"};let message: string = "Better take an umbrella"; The same could be achieved using an expression. But by using a variant with a switch gives us a great number of type system assistants. For example, the compiler will give us a type error if we forget to cover a case. if-else Each tag of a variant can hold extra data. Say you want to create an app that acts as both, a Note as well as a To-do. The Note will only expect a string input, whereas the todo requires a string as well as a boolean input to indicate if the task is completed or not. # type item = Note(string) | Todo(string, bool);# let myItem = Todo("write article", false); We can use destructuring to do this. This way, we can give the parameters’ names and use them each after the arrow. # switch (myItem) {| Note(text) => text| Todo(text, checked) => text ++ " is done: " ++ string_of_bool(checked)};- : string = "write article: false" We can give them names, we don’t necessarily have to. We can also match against exact values of the tag. We can add a pattern that matches exactly against a redesigned website with the boolean set to . false # switch(myItem) {| Note(text) => text| Todo("redesign website", false) => "Please first fix the app"| Todo(text, checked) => text ++ " is done: " ++ string_of_bool(checked)}; To Be Continued… This concludes the of 3 of this series. For click here: Part 1 Part 2, _Illegal States, Option Type, Functions, Tuples, Lists, Arrays, and Equality_hackernoon.com Get Reason-able with ReasonML — Part 2 I am Rajat S. Aspiring Coder who has a long way to go. A Die-Hard DC Comics Fan who loves Marvel Movies. Known for multi tasking. Thanks for reading, and hopefully this was helpful! Please 👏 if you liked this post and follow me here and/or on to stay updated about new posts from me! Twitter

Get Reason-able with ReasonML — Part 1

This space is amazing. First, we stole the greatest creation of wealth from the rich, then distribute it almost evenly to people regardless of ethnicity, age, gender, or intellectual level. Next, we stole the tech bros from Silicon Valley and the finance bros from Wall Street. And now, we are stealing words from Merriam-Webster’s dictionary and re-issuing them with our own definition and spelling. So what the f*ck is “hodl” or “hodling”? Image by on — a pioneer who coined the word “hodl/hodling” GameKyuubi Bitcointalk A brief introduction of h or odl hodling. , according to . “Hodl is an enthusiastic misspelling of Hold , prompting bitcoin users to avoid the temptation of selling off their coins once price starts rising” Urban Dictionary _An enthusiastic misspelling of Hold, prompting bitcoin users to avoid the temptation of selling off their coins once…_www.urbandictionary.com Urban Dictionary: hodl Why you should hodl and not trade. Hodling does not require experience, but patience and faith in the . Whereas, trading requires knowledge in finance and experience. If Wall Street can’t beat this volatile market, what makes you think you can? Did you not just see that we jumped from $200 billion to $600 billion total market capital in exactly 30 days(From November 18 — December 18)? How can you buy low when everything just keeps climbing? Wouldn’t it better if you just hedl? I personally have made much more money in hodling than trading, with half the stress. blockchain technology Below is an example of why hodling would be a better option in this bullish and volatile market. Here is an outline from a social media post that was edited with today’s price (January 2, 2018). “If you took 5 of the cryptocurrencies that are still in the top 10 from Jan. 1, 2017 and compare them to Jan. 2, 2018 here is what you would have if you invested $1,000 in each on Jan 1st 2017… BTC — $963.00 to $16,460 — total $17,092ETH — $8.26 to $878— total $106,295XRP — $0.0065 to $2.41— total $370,769LTC — $4.37 to $255 — total $58,352DASH — $11.26 to $1,160 — total $103,019 …for a grand total of $655,527 for $5,000 invested.” I really have a hard time believing that someone can do better than this in trading without having a $1 million initial capital. Trading is just like any other profession that requires years of training. If you pretend to be one, you will get rekt. Tuur Demeester Who should hodl? You should hodl: If you are a believer of this blockchain technology. If you have patience. If you believe that the peak of this bubble is not even priced in yet. If you believe that we will match or possibly surpass the Internet bubble’s $3 trillion market capital. If you can afford to lose and risk it all. If you don’t need the money at this time. If you do not have the slightest idea of what you’re doing. If you don’t have the time to keep up with how fast this space is moving. Anthony Pompliano Long-term versus short-term. This is how I look at long-term and short-term investors. Long-term: looks at how much tokens will be worth 5 years from now. Difficulty level: Easy way to invest in crypto. Requires light reading and patience.Reward: $x-$,xxx,xxx+Psychological effect(s): Frustrating, boring.Risk score: 9.987/10 Short-term: tries to beat the volatile and irrational market.Difficulty level: God mode, requires no sleeping, trading experiences, staying up to date, etc.Reward: Instantly $xxx,xxx to $xx,xxx,xxx.Psychological effect(s): It fluctuates, adrenaline rush, residual effects of sleep deprivation, crypto high, etc.Risk score: 10/10 Photo by on John Noonan Unsplash How to hodl? Here’s how I do it. I just traded the last few of my bitcoins for $ETH, which I’ve bought for around $100 and held since 2013. I was able to hodl due to my positive attitude view towards blockchain technology. When I first heard about bitcoins, I thought of decentralized paypal. I instantly fell in love with the idea of not having anyone freeze my account when I sell things online due to charge backs and fraud claims from the other party. Then Ethereum came and it just strengthened my opinion about this technology. Today, I am still hodling some $ETH from which I’ve purchased from the initial coin offering and some I have diversified into other ICO projects that I personally believed in (check my “ ”). Due Diligence Checklist for Investing in Cryptocurrency My faith and wanting to be part this of revolution is what makes me want to hodl onto my investment longer. I want to see what Bitcoin, Ethereum and other potential disruptive dApps develop and grow 5 years from now. I want to see what life would be like with a matured blockchain ecosystem. Other than the financial motive that comes with investing in blockchain long term, I want to see the impact it will have on our daily lives. Michael Goldstein “But..but…” hodl that thought, because I have more things to say. Hodling does not require experience or skills, traders do. Stick to what you know, you’re not a trader, you will get rekt. Ask yourself what this coin/token is going to be worth 5 yrs from now, not what’s it going to be worth next week or next month. It will give you new perspective about the future of bitcoin and other cryptocurrencies. Hodling to me is something more than just a chant to encourage people to not panic and sell during the bear market. Hodling is a strategy that I have used for the last few years and has continued to benefit me more than trading (I am not a trader, my background is medicine, not finance). We are at the mania phase right now of this market. Maybe in a few days or a couple weeks, this bullish market will experience fatigue and the hype will not be enough to sustain it. What do you do? Do you panic and sell? What if it goes up? Do you trade for a loss? If not, and it keeps going up, do you buy back at the top? How about just letting your investment grow by hodling? “Are you here for the long haul? or for the next 6 months?” — Jimmy Song Did you come here to trade? or did you come here to invest your money in the growth of this blockchain technology? BONUS (because it’s funny): ############################################ I am the founder of Wes Post m, a community driven publication for blockchain and cryptocurency. www.wespost.co Follow me on https://twitter.com/cryptonization https://medium.com/wespostdotcom https://www.facebook.com/wespostdotcom/ https://twitter.com/wespostdotcom _251 Followers, 23 Following, 78 Posts - See Instagram photos and videos from Wes Post (@wespostdotcom)_www.instagram.com Wes Post (@wespostdotcom) * Instagram photos and videos

Stories, News & Mentions about SCORE10

Score10’s Stories on HackerNoon