Sticky

sticky

Nir’s Note: This guest post is by Janet Choi, Senior Manager of Product Marketing and Content at Customer.io Meditation, like any healthy habit, takes repetition to stick. But while the folks behind , a meditation and mindfulness app, knew their product’s core value was helping people to learn and build a meditation practice — initially they didn’t put too much thought into the practice part of it all. Calm That changed when they dug into their behavior data and discovered that users who had taken pains to schedule a daily reminder in the app’s settings were much more likely to stick around. When they proactively prompted new users to set a daily reminder after completing their first meditation session, Calm saw a — and according to their analytics platform , this boost impacted weekly and monthly retention as well. 3x increase in daily retention Amplitude Calm increased the success of their product by making it easier for their users to remember to use the app for its core product value. If you make web or mobile products, you’re actually in the business of task management. You’re counting on your product to become a recurring part of your customers’ lives. In order to accomplish that, you have to motivate your users to build a new habit. Sometimes software companies forget that what they’re building isn’t just a product that people find valuable. Part of what you’re building is how people will find and experience that value. It’s easy to overlook, because it seems like enough of a challenge to build a great product that really helps users with their needs. But humans are a bit absurd. We don’t get around to fulfilling all our goals, checking off all our to-do’s, or following up on our resolutions — these are the people you’re working with! So how do you engage and retain these absurd people? Let’s look at one key to making new habits that stick. Behind the Habit: Motivational Triggers Habits don’t begin with action. They begin with a trigger to action. Behavioral design expert Nir Eyal illustrates how you form habits, or “manufacture desire” with his . You guide users through a certain sequence of experiences, from trigger to action, to reward, to investment. And repetition matters here, as Eyal explains: “the more often users run through them, the more likely they are to self-trigger.” Note how product usage — the action in Eyal’s Hook Model — is step three, not one or even two. Hook Model Regular reminders like those from Calm are triggers, the first step to building a habit. But triggers aren’t just external. No matter how many external triggers you provide to people, they’re not going to take action if they really don’t want to in the first place. There’s also a crucial trigger that must exist within the user. internal , the drive arising from the gratification of doing the task itself, comes from within. When designing triggers, you’re considering not only how to get the user to the product — which is external — but also how to connect to the internal goal of the user and what they really want. Intrinsic motivation provides the fuel, and that’s where you should be aiming with the sparks of your external triggers. Intrinsic motivation This customer-centric component is vital, because there’s so much to change people’s behavior from an already-established groove. Onboarding expert Samuel Hulick reminds us: inertia to overcome Remember that people are “switching” to your product whether they are coming to you from a direct competitor or not…. They have their “old way” of doing things and it’s your onboarding’s job to get them to experience the good life that your product offers. So the success of your external triggers rely on going deeper than shallow notifications and nudges. It’s not about the reminder or the product, by themselves. Nobody is intrinsically motivated to complete their profiles or come back to the product itself — they’re motivated by what they can do and get out of it. None of this works without connecting back to the user’s intentions and goals. Email Reminders that Trigger Product Engagement The superficial takeaway from the Hook Model is to try to with lots of annoying triggers. Instead, your goal is to design for in order to overcome inertia and spark that intrinsic motivation. nag your customers into submission relevance and persuasion While some external email triggers can literally be reminder messages, other types of lifecycle email that nudge, notify, teach, and entertain are also types of reminders, keeping your brand or product offering top of mind. Let’s look at a few examples of emails that serve as motivational triggers. Deliver value in the message itself is a team management software that keep track of a company’s pulse with weekly check-ins. In each Friday check-in, you can set goals for the coming week, which helps keep you accountable and measure your progress. Every Wednesday, you get a very simple reminder about your goals. 15Five This is a great example of a trigger to build and maintain 15Five engagement. It’s reminding you of the goals that you, yourself, set (hello intrinsic motivation) — prompting you to action. Now with this mid-week check-in, I get a chance to consider my progress and course-correct instead of Friday coming around and realizing I never got around to my stated goals. The smart move here is that the action 15Five wants you to take is user-centric: review goals. Even if you don’t click on the “View Your 15Five” button to go into the app, you’re getting value out of the message because they’re not forcing you to log into the product to view those goals. Instead, the email reminder is acting like an extension of the product. your Amp up the anticipation What about building habits for businesses with physical products, like subscription boxes and services? The main actions you want your customers to take involve interacting with physical products. However, that doesn’t mean you can’t design stronger triggers to engagement. , the monthly beauty product subscription service, sends a preview into what you can expect in your upcoming Glam Bag. Ipsy The eventual action Ipsy wants its customers to take are to enjoy the products from its monthly Glam Bag. While the contents of the bag are curated by Ipsy and a bit of a surprise, Ipsy realizes that there’s . So they amp up the excitement with a sneak peek, which increases the customer’s gratification upon receiving the subscription and enjoyment of the whole Ipsy experience. pleasure in the anticipation Get people back on the horse The video hosting platform reaches out to new users to trigger the key action of uploading your first video: Wistia In most cases, new users never get to the “Action” step of the Hook Model because they never return after their first session. That’s why triggers are so key. Lives get busy, and sometimes you need to prompt new users to do something to get to their . aha moment Reminders to complete a particular task aren’t just for new users either. Here’s a recurring reminder from the newsletter tool, : Revue They’re connecting back to the user’s goal — send an effective newsletter — and providing a timely path back to finish that task. Smart touches to spark the user’s internal motivation here include providing quick metrics for the previous issue sent and a tip on social sharing for making the next issue successful. The result of sending effective external triggers back to your product? A business’s dream scenario: people actually want your emails. uses a very similar approach to Calm, as both meditation and learning a language take practice, practice, practice. Duolingo Duolingo’s daily reminder emails provide a quick nudge to keep you on track, and these reminders are a value-add feature that users can choose to set up. “Emails and notifications have been extremely effective in bringing people back,” declares . The proof isn’t just in the retention rates. People actually expect them to arrive in their inbox as part of their Duolingo , such that when they don’t. Gina Gotthilf, Duolingo’s VP of Growth and Marketing Duolingo users actually find these reminder emails valuable. user experience they miss them The success of your product relies on the success of your behavioral design. Guidance to value and benefit and paving the way to repeat meaningful engagement will motivate users to interact with your product, again and again. Draw on the perspective of the user, escape the insularity of company-centric interactions, and realize there’s a consequential world outside the pixels of your product. It’s your turn! What software products have become a routine part of your lives? Did they have effective triggers? Share with us in the comments! Nir’s Note: This guest post is by Janet Choi, Senior Manager of Product Marketing and Content at Customer.io Originally published at www.nirandfar.com on September 11, 2017. _Meditation, like any healthy habit, takes repetition to stick. But while the folks behind Calm, a meditation and…_www.nirandfar.com How to Trigger Product Usage that Sticks If you found this post interesting, it would mean a lot to me if you could click on the “claps” icon below to let me know. That would really make my day — thanks! Nir Eyal is the author of Hooked: How to Build Habit-Forming Products and blogs about the psychology of products at NirAndFar.com .For more insights on changing behavior, join his free newsletter and receive a free workbook.

How to Trigger Sticky Product Usage

Last week, we described the concept behind : you forward a request to the same upstream because there's context data associated with the session on that node. However, if necessary, you should replicate the data to other upstreams because this one might go down. In this post, we are going to illustrate it with a demo. sticky sessions Content Overview The overall design The heart of the application Configuring Spring Session with Hazelcast Configuring Spring Security Putting our design to the test Conclusion The overall design Design options are limitless. I'll keep myself to a familiar stack, the JVM. Also, as mentioned in the previous post, one should only implement sticky sessions with session replication. The final design consists of two components: an instance with sticky sessions configured and two JVM nodes running the same application with session replication. Apache APISIX The application uses the following: Dependency Description Spring Boot Eases the usage of Spring libraries Spring MVC Allows offering HTTP endpoints Thymeleaf View technology Spring Session Offers an abstraction over session replication Hazelcast (embedded) Implements session replication Spring Security Binds an identity to a user session The design looks like the following: and are two instances of the same app; I didn't want to overcrowd the diagram with redundant data. app1 app2 The heart of the application The heart of the application is a session-scoped bean that wraps a counter, which can only be incremented: @Component
@SessionScope
public class Counter implements Serializable {              //1

    private int value = 0;

    public int getValue() {
        return value;
    }

    public void incrementValue() {
        value++;
    }
} Necessary for Hazelcast serialization to work We can use this bean in the controller: @Controller
public class IndexController {

    private final Counter counter;

    public IndexController(Counter counter) {               //1
        this.counter = counter;
    }

    @GetMapping("/")
    public String index(Model model) {                      //2
        counter.incrementValue();
        model.addAttribute("counter", counter.getValue());
        return "index";
    }
} Inject the session-scoped bean in the singleton controller thanks to Spring's magic When we send a request to the root, increment the counter value and pass it to the model GET Finally, we display the bean's value on the Thymeleaf page: <!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org" lang="en">
<body>
<div th:text="${counter}">3</div> Configuring Spring Session with Hazelcast Spring Session offers a filter that wraps the original to override the method. This method returns a specific implementation backed by the implementation configured with Spring Session, in our case, HttpServletRequest getSession() Session Hazelcast. We need only a few tweaks to configure Spring Session with Hazelcast. First, annotate the Spring Boot application class with the relevant annotation: @SpringBootApplication
@EnableHazelcastHttpSession
public class SessionApplication {
    ...
} Hazelcast requires a specific configuration as well. We can use XML, YAML, or code. Since it's a demo, I can choose whatever I want, so let's code it. Spring Boot requires either an Hazelcast object or a configuration object. The latter is enough: @Bean
public Config hazelcastConfig() {
  var config = new Config();
  var networkConfig = config.getNetworkConfig();
  networkConfig.setPort(0);                                                      //1
  networkConfig.getJoin().getAutoDetectionConfig().setEnabled(true);              //2
  var attributeConfig = new AttributeConfig()                                     //3
          .setName(HazelcastIndexedSessionRepository.PRINCIPAL_NAME_ATTRIBUTE)
          .setExtractorClassName(PrincipalNameExtractor.class.getName());
  config.getMapConfig(HazelcastIndexedSessionRepository.DEFAULT_SESSION_MAP_NAME) //3
          .addAttributeConfig(attributeConfig)
          .addIndexConfig(new IndexConfig(
            IndexType.HASH,
            HazelcastIndexedSessionRepository.PRINCIPAL_NAME_ATTRIBUTE
  ));
  var serializerConfig = new SerializerConfig();
  serializerConfig.setImplementation(new HazelcastSessionSerializer())            //3
                  .setTypeClass(MapSession.class);
  config.getSerializationConfig().addSerializerConfig(serializerConfig);
  return config;
} Choose a random port to avoid port conflict Allow Hazelcast to search for other instances and automagically form a cluster. It's going to be necessary when deployed as per our design Copy-pasted from the Spring Session documentation Configuring Spring Security Most Spring Session examples somehow use Spring Security, and though it's not strictly necessary, it makes the design easier. I want to explain why first. One can think about sessions as a gigantic hash table. In regular applications, the key is the cookie value, the value, and another hash table of session data. However, the is specific to the node. The app will give a different if one uses another node. Since the key is different, there's no way to access the session data, even if the session data is shared across nodes. To prevent this loss, we need to come up with a different key. Spring Security allows using a principal (or the login name) as the session data key. JSESSIONID JSESSIONID JSESSIONID Here's how I set up a basic Spring Security configuration: @Bean
public SecurityFilterChain securityFilterChain(UserDetailsService service, HttpSecurity http) throws Exception {
  return http.userDetailsService(service)                                    //1
             .authorizeHttpRequests(authorize -> authorize.requestMatchers(
                 PathRequest.toStaticResources().atCommonLocations())        //2
                            .permitAll()                                     //2
                            .anyRequest().authenticated()                    //3
             ).formLogin(form -> form.permitAll()
                                     .defaultSuccessUrl("/")                 //4
             ).build();
} The default in-memory user details service doesn't allow custom user details classes. I had to provide my own. Allow everybody to access static resources at "common" locations All other requests must be authenticated Allow everybody to access the authentication form Redirect to the root if successful, which maps the above controller Putting our design to the test Besides the counter, I want to display two additional pieces of data: the hostname and the logged-in user. For the hostname, I add the following method to the controller: @ModelAttribute("hostname")
private String hostname() throws UnknownHostException {
    return InetAddress.getLocalHost().getHostName();
} Displaying the logged-in user requires an additional dependency: <dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-springsecurity6</artifactId>
</dependency> On the page, it's straightforward: <!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/extras/spring-security">  
<body>
<td sec:authentication="principal.label">Me</td>                     Add the namespace. It's not necessary but may help the IDE to help you sec Require the underlying implementation to have a method UserDetail getLabel() Last but not least, we need to configure Apache APISIX with sticky sessions, as we saw last week: routes:
  - uri: /*
    upstream:
      nodes:
        "webapp1:8080": 1
        "webapp2:8080": 1
      type: chash
      hash_on: cookie
      key: cookie_JSESSIONID
#END Here's the design implemented on Docker Compose: services:
  apisix:
    image: apache/apisix:3.3.0-debian
    volumes:
      - ./apisix/config.yml:/usr/local/apisix/conf/config.yaml:ro
      - ./apisix/apisix.yml:/usr/local/apisix/conf/apisix.yaml:ro    #1
    ports:
      - "9080:9080"                                                  #2
    depends_on:
      - webapp1
      - webapp2
  webapp1:
    build: ./webapp
    hostname: webapp1                                                #3
  webapp2:
    build: ./webapp
    hostname: webapp2                                                #3 Use the previous configuration file Only expose the API Gateway to the outside world Set the hostname to display it on the page We can log in using one of the two hard-coded accounts. I'm using , with password and label . Notice that Apache APISIX sets me on a node and keeps using the same if I refresh. john john John Doe We can try to log in with the other account ( / ) from a private window and check the counter starts from 0. jane jane Now comes the fun part. Let's stop the node which should be hosting the session data, here and refresh the page: webapp2 docker compose stop webapp2 We can see exciting things in the logs. Apache APISIX can no longer find the , so it forwards the request to the other upstream that it knows, . webapp2 webapp1 The request is still authenticated; it goes through Spring Security The framework gets the principal out of the request It queries Spring Session And gets the correct counter value that Hazelcast replicated from the other node The only side-effect is an increased latency because of Apache APISIX timeout. It's 5 seconds by default, but you can configure it to a lower value if needed. When we start again, everything works as expected again. webapp2 Conclusion In this post, I described a possible setup for sticky sessions with Apache APISIX and replication involving the Spring ecosystem and Hazelcast. Many other options are available depending on your stack and framework of choices. The complete source code for this post can be found on . GitHub To go further: Spring Session and Spring Security with Hazelcast Spring Session Hazelcast Originally published at on July 2nd, 2023 A Java Geek

Demo: Sticky Sessions with Apache APISIX for Improved Load Balancing

Sticky sessions, also known as session affinity, is a mechanism by which a routing component, that acts as a facade, always routes a request to the same underlying upstream node. In this post, I'll describe the reason behind sticky sessions, available alternatives, and how to implement them via Apache APISIX. Why sticky sessions? Sticky sessions became popular when we stored the state on the upstream node, not the database. I'll use the example of a simplified e-commerce shop to explain further. The basic foundations of a small e-commerce site can consist of a web application and a database. If the business is successful, it will grow, and you'll need to scale this architecture at some point. Once you cannot scale vertically (bigger machines), you must scale horizontally (more nodes). With additional apps node, you'll also need a load balancer mechanism in front of the web app nodes to distribute the load among them. Going to the database every time is an expensive operation. It's ok for data that is accessed infrequently. However, we want to display the cart's content for every request. A couple of alternatives are available to speed things up. If we assume that the web app uses Server-Side Rendering, the classical solution is to keep cart-related data in memory on the web app node. However, if we store user X's cart on node 1, we need to ensure that we forward every request of user X to the same node. Otherwise, they will feel as if they lost their cart's content. Sticky sessions, or session affinity, is the mechanism that consistently routes the same user to the same node. Limitation of sticky sessions Before going further, I must explain a significant limitation of sticky sessions. If the webapp node that stores the data goes down for any reason, the data are irremediably lost. For the e-commerce scenario above, it means users will lose their cart occasionally, which is unacceptable from a business point-of-view. For this reason, sticky sessions must go hand-in-hand with : data stored on a node must be copied and kept in synch with all other nodes. session replication While session replication exists in all tech stacks, there's no related specification. I'm familiar with the JVM, so here are a couple of options: Tomcat offers out-of-the-box session replication offers a clustered in-memory solution that you can integrate at different levels Hazelcast is an abstraction layer upon specific solutions Spring Session When data is replicated on all nodes (or a remote cluster), you may think you no longer need sticky sessions. It's true if one accounts only for availability and not for performance. It's about data locality: fetching data on the current node than from somewhere else via the network is faster. Sticky sessions on Apache APISIX Sticky sessions are a must-have for any Load Balancer, Reverse Proxy, and worth their salt. However, I must admit that Apache APISIX's documentation needs an easy entry point into the subject. API Gateway binds a to an . An upstream consists of one or more nodes. When a request matches the route, Apache APISIX must choose among all available nodes to forward the request to. By default, the algorithm is weighted round-robin. Round-robin uses one node after the other, and after the last one, get back to the first one. With a weighted round-robin, the weight affects how many requests Apache APISIX forwards to a node before it switches to the next one. Apache APISIX route upstream However, other algorithms are available: Consistent hashing Exponentially Weighted Moving Average Chart Least connection A custom-made one Consistent hashing allows forwarding to the same node depending on some value: an NGINX variable, an header, a cookie, etc. HTTP Remember that HTTP is a stateless protocol, so application servers set a cookie on the first response to track the user across HTTP requests. It's what we call a "session". We need to know the underlying session cookie name. Different application servers hand out different cookies: for JVM-based servers JSESSIONID for PHP PHPSESSID for ASPSESSIONID ASP.Net etc. I shall use a regular Tomcat, so the session cookie is . Henceforth, the Apache APISIX documentation for two nodes is the following: JSESSIONID routes:
  - uri: /*
    upstream:
      nodes:
        "tomcat1:8080": 1            #1
        "tomcat2:8080": 1            #1
      type: chash                    #2
      hash_on: cookie                #3
      key: cookie_JSESSIONID         #4 Define the upstream nodes Choose the consistent hashing algorithm Hash on cookie Define which cookie to hash on Conclusion In this post, we detailed sticky sessions, that you should always use session replication with sticky sessions, and how to implement sticky sessions on Apache APISIX. To go further: Load Balancing Upstream configuration The illusion of statelessness Originally published at on June 25th, 2023 A Java Geek

Implementing Sticky sessions via Apache APISIX

Shiny Side Up, Sticky Side Down: A Collection of Poems

This snippet allows you to make (almost) any header sticky on the page which hides when you scroll down, but pops up again when you scroll up. And as a bonus a step-by-step guide on how to implement this in Oxygen Builder. It’s a simple, yet very fancy, way to prevent your header from taking up space which can be used for displaying your content. This snippet contains a small piece of Javascript and a couple of lines of CSS, and in return, you’ll get the following: See the Pen . Sticky Header - Scroll Up Show If you look at the source of the above example it may look like a lot to handle, so let’s break it down. And don’t worry about the HTML or LESS, the important parts are just a single class in the HTML and a couple of lines of (plain) CSS. HTML This is the easiest part; add a single class to the element you want to make sticky! That’s it, no complex HTML structure or the need to redesign your website to have a simple script be able to do its work. 
<header class="jd-sticky">
</header>


<div class="jd-sticky">
</div>


<nav class="jd-sticky">
</nav> Just add .jd-sticky to whatever element you want to have sticky, and continue the next steps to have it work. CSS The second step is to add a class to the element you want to make sticky, which in this case is the header. /**
 * Sticky CSS
 */
/* add padding-top to match height of the header */
body {
    padding-top: 70px;
}
/* on mobile the header is twice as hight, and so should the padding be */
@media (max-width: 768px) {
    body {
        padding-top: 140px;
    }
}
/* make header fixed to the top */
.jd-sticky {
    position: fixed;
    top: 0;
    /* and a smooth transition, so it won't just pop in and out the screen */
    transition: top 700ms linear;
} Two things are happening here; first, we add a padding top to the body, so there will always be some room for the header to be displayed. The reason is because of the second part of the CSS; we make the header stick to the top of the page with position:fixed, which puts the whole element over the rest of the content. Of course, you’ll need to change the padding (both for desktop and tablet/mobile) based on the size of your header element. With just this small CSS snippet you will already have a sticky header, but we obviously want a bit more. Javascript The last step is to add some javascript that will handle the showing and hiding of the header when scrolling up and down. /**
 * Sticky JS
 */
/* set the element you want to make sticky */
const headerElem = document.querySelector('.jd-sticky');
/* set the offset on which the hide effect has to wait */
const scrollOffset = 200;

/* DO NOT MODIFY BELOW */
/* get the current page position */
let prevScrollpos = window.pageYOffset;

/* monitor when the page is being scrolled */
window.addEventListener('scroll', () => {
    /* check if the scroll offset is passed */
    if (window.pageYOffset > scrollOffset) {
        /* get the new page position after scrolling */
        let currentScrollPos = window.pageYOffset;
        /* check the new page position with the old position */
        if (prevScrollpos > currentScrollPos) {
            /* if scrolling UP, show the sticky element */
            headerElem.style.top = '0';
        } else {
            /* if scrolling DOWN, hide the sticky element */
            headerElem.style.top = '-100%';
        }
        /* set the page position, so it can be checked the next time */
        prevScrollpos = currentScrollPos; 
    }
}); The Javascript is very simple but very effective. It takes the element which needs to be affected, in this case .jd-sticky, and will change the top position depending on your scroll behavior. And that’s all folks! Just a single class added to your HTML and a couple of lines of CSS and Javascript, and you’ll have an easy sticky header with scroll effects. Oxygen Since we at Jacht.digital use Oxygen Builder a lot and know it can be a bit challenging to add custom styles and scripts, here is a step-by-step guide on how to do it yourself. It doesn’t matter what your current website looks like, so in this example we simply took one of the default presets in Oxygen Builder. It is important that the whole block, in this case, the header, can be selected as one. As with the implementation without Oxygen Builder, all you have to do now is add the .jd-sticky class to the header element. This can be done by selecting the element from the Structure list and adding the class name manually in the right sidebar. Make sure you didn’t select a breakpoint or state, otherwise it may only work in those specific cases. Now it’s time for the CSS and Javascript, which can be added easily with a code block. In this example, we added the code block component “somewhere” in the header element, so it’s easier to find back. However, as long as it’s always available when you show the header (so anywhere in any template or reusable part which is shown together with the header) you’ll be fine. Here we add the CSS in ‘Advanced’ -> ‘CSS’ and make the changes when needed. And we add the Javascript in ‘Advanced’ -> ‘JavaScript’. Keep in mind that Oxygen Builder is not very smart when it comes to loading javascript in the editor, so if you just copy&paste the code it will most likely show an error message that variables already exist. To fix this all you have to do is place the code inside the following block: (function() {
    // rest of code
})(); Now save the template and you’re done! Also published . here

How to Implement a Sticky Header in Oxygen Builder

Do you want to learn how to sell your SaaS brand? The key is understanding what customers are looking for. You'll want to keep the following 4 points in mind when creating your sales strategy: 1) Make your online experience super easy to navigate Avoid giving customers a difficult time when they're trying to purchase your product. Provide clear and direct information on each page of your website for customers who are interested in products or features that you offer. Keep the design simple, but make it interesting enough so that it stands out from other brands in its industry. Ensure all pages load quickly since slow loading times can cause frustration with users who have limited patience for this type of thing. When thinking about how well designed your site is consider what would happen if someone were to visit without any prior knowledge of SaaS services at all: Would everything be easily apparent? Or would there need to be an extended period before understanding finally it easy for customers to buy 2) Offer a free trial or demo, so that they can get their hands on your product before making any purchase decisions This is an ideal way to test the product before customers invest their money in it. You can offer a demo or free trial for any products that you sell, including subscriptions and one-time purchases. Allowing people to trial your helps them feel confident with their decision-making process since they'll get accustomed to using your product first hand before purchasing anything. Will this benefit all of your potential customers? Not necessarily; some may not be interested in trying out demos at all. However, there are still many who will appreciate having access like this especially if the product has complex features hidden behind several layers of menus. Offering something like this shows more interest towards improving which goes over well for most SaaS software customer satisfaction 3) Provide customer support 24/7; don't make them wait around for help (or pay extra if they do!) This is something that customers have come to expect from all major brands. Customers who are familiar with will know this as a standard, and they'll be less likely to choose a brand if it doesn't offer the same level of customer support 24/365. SaaS services Most people won't have time during work hours or outside those times for them to wait around for assistance. If you're not open late at night then consider offering an email service where users can contact your team members directly through their inboxes instead - instant messaging tools like these allow customers to get help whenever they need it most rather than having them waiting until someone gets back into the office again which could mean days before anything happens! Providing 4) Include detailed instructions and tutorials with every purchase of your product, so that newcomers won't need outside assistance. It's also worth mentioning that these should be available in whatever language the purchaser prefers! When you sell a product, there may be various features that customers aren't familiar with. It's always good to provide basic information on the website about what your SaaS brand does and how it can benefit them so that they're able to start using it more efficiently right out of the box. For users who are unfamiliar with any aspects of your software then consider producing detailed tutorials or videos for these specific areas in order to ensure everyone is comfortable when beginning use from scratch - don't leave anyone behind! You'll want to include several different languages as well because this way no one will have trouble understanding either if English isn't their native language. Providing written instructions along with video content also allows customers to choose whatever The format they prefer, so it doesn't matter if they aren't tech-savvy or have never used a computer before. You can also offer Skype or email services so that users who prefer one method over another will still be able to get help from your team. It's also wise to put a lot of time into creating easy navigation that leads customers wherever they need to go without getting confused or lost. Allow customers to contact your sales team at any time, via phone or email. This will help them make sure their purchase is right for them before they commit. You can also use social media to reach out and interact with potential buyers! How Is SaaS Going To Change The World? SaaS isn't going anywhere as a result of automation's ascent. We may face some resistance, We're not using as many leads as we should, but it's because our sales team has figured out how to generate more leads. Even though we have a steady supply of leads, there's always a demand for what we have to offer.

4 UX-Enhancing SaaS Features To Make Your Software More Sticky

It’s easier to write about the engineering of space tech than it is about the complex and nuanced areas of national and international laws. I am not an attorney or a legal scholar. I parse on occasion about space. In February 2021, for example, the Dubai International Financial Centre -DIFC Courts announced a to focus on commercial disputes. The DIFC Courts and the Dubai Future Foundation - DFF followed the announcement shortly after creating an international working group for legal scholarship and thought leadership. The working group seeks the creation of a Space Dispute Guide for commercial space-related activities. some of the conversations among legal circles Courts of Space Initiative It surprises me that although most legal discussions diverge on the actual issues, they converge on the need for urgency. National and international legal frameworks do not advance at the same pace as space technologies and commercial enterprises. Fundamental legal questions continue to intersect and remain unaddressed. These legal gaps are especially evident for in-orbit satellite servicing, in-situ resource utilization - ISRU, removal of space debris, space traffic management, deep-space robotic exploration, and many other areas for space travel, research, and exploration. There’s a noticeable stickiness in space jurisprudence at the international and national levels across the globe. This stickiness pales compared to the type of legal frameworks that currently facilitate and accelerate public-private alliances in other deep-tech industries. I cannot help but ask myself, why isn’t there a renewed sense of commitment across the world to address the legal issues about space business and exploration? Fortunately, I had the opportunity to sync up with two accomplished experts this month in space law who offered insights about the cost of sticky space laws in their geographies. This article sums up our conversations. I hope that by reading it, you can also notice some of the gray areas and ultimately the upside of sound legal frameworks to help us embrace our future in outer space. is an attorney, legal scholar, writer, commentator, and analyst with a doctorate in law from the Universidad Complutense de Madrid, focusing on space law. Originally from Madrid, Elisa serves as President of the (Spanish Association of Aeronautics and Space Law). She is also Co-President of the International Aeronautics and Space Law Division at the (Illustrious Bar Association of Madrid), whose creation dates back to 1596. Elisa González Ferreiro Asociación Española de Derecho Aeronáutico y Espacial - AEDAE Ilustre Colegio de Abogados de Madrid Elisa has a visceral understanding of the nuts and bolts of space law as a frequent speaker and scholar. , including being a founding member of the European Space Agency - ESA and one of its top significant contributors and supporters of space exploration missions and Earth observation programs. Elisa undertook her doctoral dissertation about the international legal aspects of the International Space Station as it was undergoing construction. Spain has a long history in space activities Elisa González. Madrid, Spain. April 2021. is an attorney, legal scholar, and policy analyst with a master’s degree in International Trade and Investment Law. Calling Bulawayo, Zimbabwe’s second-largest city, as home and base, Ruvimbo works as a Consultant for the recently established Zimbabwe National & Geospatial Space Agency - ZINGSA and the United Nations Economic Commission for Africa - UNECA. She has been awarded prominently for her leadership in the emerging African space economy. Ruvimbo was part of the first African team and , which dealt with planetary defense issues and liability for damages caused in outer space. Ruvimbo Samanga winner of the 2018 International Manfred Lachs Space Law Moot Competition Ruvimbo is also currently a Research Fellow at the Open Lunar Foundation. She co-hosts the podcast and blog . She volunteers at the and the Subcommittee of New Technical Regulations. newmoon IAF Space Traffic Management Technical Committee TC.26 Ruvimbo Samanga. Bulawayo, Zimbabwe. April 2021. What are the challenges and sticky legal situations in your respective countries? Elisa: Many countries have their national space frameworks and policies, especially a National Space Law, with laws, regulations, and licenses that support national exploration and usage of outer space, including public and private actors. The principal concern among legal scholars and practicing attorneys in Spain right now is the suitability of our national legal framework for activities in outer space and having a national space agency. Space activities are channeled by different ministries and inter-ministerial commissions. The Spanish government can conduct activities in outer space. Still, there is no national framework to regulate local and foreign commercial stakeholders seeking to conduct space-related activities in the national territory. We don’t have a National Space Law for space activities and we don’t have clarity about which Ministry could grant licenses and contracts. I participated, for example, in a draft bill at the Spanish Ministerio de Fomento (Ministry of Development). Although the draft was met early on with interest, it didn’t pick up as it could. It is unfortunate because mainland Spain and the Canary Islands are both situated nearby bodies of water and may offer competitive geographic locations for suborbital spaceflights and small satellite launches. Based on the recent release of data about the national budget in Spain, I trust that we will see progress towards a National Space Law in due course. Ruvimbo: Many of the first-generation space laws were drafted with two countries in mind, mainly the United States and the former Soviet Union. And the stakeholders were primarily governments even for many decades after. These treaties and laws could not envision or anticipate private actors, space tourists, lunar mining, etc. In Africa, the power of enabling national space policy is left out from many legal discussions. In particular, why it’s essential to start the road towards a space program and space policy, especially one that speaks to the private sector and education. How do we make sure that we’re upskilling and reskilling the population and creating a critical mass of individuals that benefit and contribute to this new industry? I favor the countries that begin with a policy because it informs internal and external stakeholders. As a startup entrepreneur, I would like to know the specific needs of the space agency, for example, geographic information services, and how my startup can provide innovation to those services. We don’t cater to deep space exploration in our policy issues. There are few African countries interested in lunar or planetary exploration. This type of exploration will have spin-off benefits that we might miss out on if not taken seriously. What are some of the areas in the space industry that are under looked by the legal community? Elisa: Legal scholars bring to the table a profound analysis of what national frameworks should include to resolve and anticipate conflicts while still respecting international frameworks such as that of the United Nations Outer Space Treaty. Space debris is becoming a huge legal problem. From the Inter-Agency Space Debris Coordination Committee - IADC, the UN Committee on the Peaceful Uses of Outer Space - COPUOS, the European Code of Conduct, we have international mandates, which should be incorporated more readily into national frameworks. States and commercial stakeholders worldwide could be more conscious of the best practices and conduct for a sustainable space economy. Planetary protection is also profoundly overlooked among legal scholars. This principle of safety and awareness should guide interplanetary missions to prevent harm to extraterrestrial life, biological contamination on the target planet, or upon return on Earth. The best practices from the Committee on Space Research - COSPAR, for example, are not legally binding. Planetary defense is also sorely missing in legal circles. A serious asteroid or comet impact can have disastrous consequences on several nation-states at once. National legal frameworks should contemplate more seriously the regulations and ramifications of massive civilian evacuations. I've noticed that mining rights on the Moon and permanent settlements are still considered a far away scenario among certain legal professionals in Spain and worldwide. There will come a time when the Moon will start getting busy with business and research. In this same vein, I can't entirely agree with those professionals who regard the Moon Treaty of 1979 as the foundation for discussing the common heritage of humankind. There is no internationally accepted definition of the common heritage of humanity. The concept of common heritage that applies the seabed and ocean floor cannot be extrapolated to outer space. How can we speak of an international regime that divides resources if we find ourselves with a company investing its capital upfront in conduct such enterprise? The Outer Space Treaty already demarcates that space is open for exploration and use by nations. Ruvimbo: I noticed that the satellite industry is becoming better integrated into the policy and legal frameworks at a global level. People are looking more towards human and robotic space exploration in deep space. There are so many issues that we haven't yet tackled. One of the main ones is ownership of property in outer space, space mining, in situ resource utilization - ISRU. To what extent do you own any material you derive or part of the Moon that you land on? Even the infrastructure you use, is there a duty to share it with other spacefaring states? At the moment, we don't really know how ownership and property rights are going to work in outer space, which presents us with a significant challenge in the coming ten years. The current discourse with property rights looks at delineating first what property rights are, tangible vs. intangible. From that, who owns these rights? We have an exciting industry with a global commons that belongs to everyone. But you also have individuals investing money, figuring out and exploring this commons, and conducting research beneficial to all of us. There's the interplay between respecting global sovereignty and deriving property, innovation, finances, prestige. You have intellectual property rights where you have a right to derive income from your innovations and inventions, but the Outer Space Treaty doesn't delineate whether you can or cannot derive income from the Moon. This terrain is unregulated. As long as it is unregulated, anything goes. We're now in a decision quagmire of whether we need a whole new body of laws that will then germinate into second or third-generation space laws, or we simply take the first-generation space laws as they are. The best we can do is find as many analogy regimes and best practices from a multitude of regimes as we can. The law of the seas is one often that we use. The seas are both a global commons and where countries also have clear sovereignty over their maritime boundaries. Some scholars have veered away the law of the seas precisely for this very same reason, though. It promotes appropriation to a certain extent, and it's also been used to justify cultural protection of heritage sites on the Moon, which is another murky area that we're trying to figure out. It's really difficult. What is the future of space law, and what are some of its misconceptions? Elisa: I see a greater sense of urgency in Spanish academia to educate young students in international space law. I recall sitting in my international law class and being told by my instructor to skip the textbook pages about space law. This dismissal of space law disturbed me deeply. I read the lesson anyways, and I fell in love with it since my early days at school. Space law is a dynamic field that will continue to change as technologies and applications change. It keeps you on your toes. I advocate in my different roles of the pivotal role of legal frameworks for space activities and how in Spain, for example, it could be a game-changer. We just launched a course about aeronautics and space law , including a commercial focus. Activities in outer space are becoming part of our modern lives. In addition to scientists and engineers, we need to prepare the new generations of young lawyers, politicians, economists, advocates to pay attention to this. Ruvimbo: Many people who hear about space law or the space industry assume that it’s highly technical and outside of our scope of understanding. I found out that I didn’t require all that much new knowledge. Space law is the application of terrestrial law to a more technical field. With minor technical adjustments, you’re dealing with the everyday practical dealings of what attorneys focus on: contractual negotiations, intellectual property, dispute resolution, and the management of the legal and political issues that one might encounter with the stakeholders in other sectors. If you’re in the private sector, different laws apply to you, and a space lawyer can assist you with that. In Africa, a lot of the work for space lawyers is analyzing the political terrain and looking at policy, as well as creating a regulatory environment that supports emergent space programs. You find that space lawyers have gone beyond that in other spacefaring nations by beginning to actively influence global policy, commercial policy, and human exploration in spaceflight policy. In the next five to ten years, space law will be one of the top legal careers, especially in the growing satellite market. In Africa, policy analysts will be the career of the next five to ten years because it’s an emerging market. After all, they need a lot of policy building and capacity building. In the global space industry, we’ll need many alternative dispute resolution mechanisms and experts because we’re moving to the more commercial use of outer space. It makes sense to conduct business quicker. Commercial disputes and arbitration will never fall short, whether it’s contractual negotiations, intellectual property, or any other kind of liability. Key takeaway: We're already at a tipping point Legal scholars, practicing attorneys, and policymakers agree on the challenge to define and resolve many of the new conflicts in the growing space economy. Elisa and Ruvimbo pointed out some of the grey legal areas that remain under the radar due to outdated treaties and frameworks. We're already at a tipping point in our space era. As public-private alliances and commercially-driven space missions sprint towards a stronger spacefaring generation, space laws cannot continue to be sticky. Adaptable space legal frameworks could facilitate business operations in ways that foster collective interest at the local, national, and international levels. Flexible frameworks could also anticipate some of the thorny issues stakeholders will experience in the next few years. I hope that this conversation continues to pique your curiosity. I will continue to be on the lookout for the bold and visionary legal initiatives. // is the artist featured at the top with his work titled Big (2018). Based in the city of Lagos in Nigeria, John has created sci-fi and space concept art for approximately seven years to date. John Zino On his creative process, John offered the following: This work is one of my favorites. I was inspired by some of the popular video games I played back in the days. I also got some inspiration from the African goddesses, such as  Ọ̀ṣun  (Oshun). I always imagined her to be huge.

Sticky Space Laws: Why Versatile Legal Frameworks Can Accelerate Our Spacefaring Era

While creating user interfaces, we often encounter the problem that there is more data in our tables than can be fitted in the visible viewport. To achieve an excellent user experience on components like Gannt charts, data tables and spreadsheets, we often use the sticky CSS property on the header elements. This is a simple task when doing it only on one edge of the table. But what if we want to display a huge table and therefore need sticky headers on more edges simultaneously? This is the exact problem we faced while building our ReactGrid and in this article we want to share the solution we have found. In this guide, we will show you how to create the layout to achieve a native scroll behavior with sticky headers like those shown above . without using any JavaScript What are the benefits of the proposed solution? native support from modern browsers, excellent user experience (intuitiveness, swiftness), additional elements in the scrollable view do not affect the UX, no JavaScript, only CSS and HTML, works perfectly on touch devices, avoids using z-index not to affect other elements on the website (needs z-index style values in Firefox with this solution). You will learn how to place elements in the DOM and style them to achieve fully functional scrollable sticky panes using flexbox step by step. It’s working and has been tested on the following browsers (remember, Firefox needs z-index style values). Placing Elements in the DOM using FlexBox The first and most important aspect is the correct order of the elements in the DOM because elements that appear later in the DOM will overlay other elements. Let’s imagine that we want to create a layout with sticky headers on each edge. Therefore we need to divide our surface into 9 panes. Of course, the same procedure also applies to a smaller number of sticky edges. We place everything in two DIV tags. The first with CSS property to have a scrollable view. The second with the following CSS properties: overflow: auto position: relative; display: flex; flex-wrap: wrap; justify-content: flex-start; align-items: flex-start. The graphic above illustrates the proper DOM order of the elements. The first element should be the one in the center of the layout, let’s call it “middle-center-pane”. It’s the only DIV element which has a relative position in its CSS styles. The next elements, in order from the least to the most important, are bottom-center-pane, middle-right-pane, top-center-pane and midlle-left-pane. These elements have sticky positions in CSS styles. The same situation applies to the elements located in the corners of the view. We placed them in the order: bottom-right-pane, bottom-left-pane, top-right-pane, top-left-pane. < = > div class "scrollable-element" < = > div class "panes-wrapper" < = > div class "middle-center-pane" </ > div < = > div class "bottom-center-pane" </ > div < = > div class "middle-right-pane" </ > div < = > div class "top-center-pane" </ > div < = > div class "middle-left-pane" </ > div < = > div class "bottom-right-pane" </ > div < = > div class "bottom-left-pane" </ > div < = > div class "top-right-pane" </ > div < = > div class "top-left-pane" </ > div </ > div </ > div Now we know in which order the panes should be placed to achieve the correct overlay behavior. However, we need more. For example, our top-left-pane is the last element in the DOM and will be rendered as the last one on the screen. What we need to do is to change the visual order of the elements. This can be achieved by using the CSS property. order Let’s use the illustration above and place an arrow to help us sort the elements in the right order. We need to go from the top left corner to the bottom right corner. This will make it easier for us to create a table to define the CSS flex order property for our sticky header elements. We have created a solid basis to achieve the desired behavior. The panes are positioned in the right order and their overlay behavior is as expected. Now we need to set additional required CSS values for them. For our sticky header elements we should set and the proper and CSS values. position: sticky top, right, left bottom Now we can set the size of the panes. First, we set the width and the height of the “scrollable-element”. Of course, it needs to be smaller than the content, to display some scrollbars. Then, the width and the height of the “panes-wrapper” should be the sums of the widths and heights of containing panes. If you have reached this step, your result might already be working as expected, but you have probably noticed that the bottom panes are covered by the top panes while scrolling. The same behavior also happens to the left and right panes. To avoid this overlay we need to add some margins to the panes, so that the bottom and top panes, and also the left and right panes push each other away. At the beginning of the article it was mentioned that if you want to be compatible with Mozilla Firefox browser you need to set z-index CSS style to some elements. The table below shows the required z-index values. Summary & example application If you set all properties as shown in this article, you will be able to achieve the expected result. We also prepared a quick example which allows you to look at the whole implementation. Feel free to use our experience and save time while trying to achieve a satisfactory outcome or try our ReactGrid . Have fun :) Previously published at https://reactgrid.com/blog/how-to-build-a-table-with-concurrent-sticky-headers/

How To Build a Table With Sticky Headers in Pure CSS

PH: Danny Meneses from Pexels. If you just started learning HTML/CSS, you can easily get caught by the outstanding improvements that we get every day, like flexbox or grid... or a framework why not. But, even if you learned how to put 1 or 2 rules and already using bootstrap, to name a popular one is good to know how things work. Today, taking my daily walk down memory lane, I remembered the first HTML task I built using... bootstrap and how, in my precarious knowledge, position sticky saved me. I will not stop on position static, relative, fixed, and absolute. For this article's purpose, it will be harder for me not to make myself a rabbit hole and start talking too much about , among other concepts that entirely make these rules, and in the end, defines how everything looks. stacking context (still worth a small appearance) Position Sticky This position will mutate between and properties, considering where your viewport is right now. relative fixed { : sticky; : ;
} .sticky position top 50px When you apply sticky, two things are happening. The normal flow of the document slightly changes since now this element will not be static, and therefore new rules like the one you see top:50px; can be applied and tell the DOM where o to render it. when The intriguing part of sticky is that " " That is pretty much what is doing. When you start scrolling and get to get to that 50px. The element will switch to fixed right in that place. mutate between relative and fixed. Let's see an example. fiddle Now I encourage you to go to the fiddle and add to the empty class. position: relative; .relative What you will see in any case is the text suddenly overlapping the navbar. Z-index index ft. Stacking Context Sometimes because of this, these kinds of problems appear, and you can patch it with Z-index. Stacking Context, is the three-dimensional conceptualization of HTML that it traduces to "What will it render first?". If things are position in the same place, whatever is rendering last is what you will see. And this goes hand in hand with Z-index in the case that you don't know, will let you position your element on this conceptualization. The stacking context will usually change every time you are not using a "static element" in one or another way. Having this little crumble of knowledge, we can deduce that this happens with position relative, and that is why we are having a problem. { : ; : - ;
} /* Cheap / Quick solution */ .z-index /* To"go up" */ z-index 100 /* To "go down" */ z-index 100 Or you know, use position static if that will work for your case. Alright, let's break more stuff. The Family Problem We are going to start with this If it were not for the height of the header, it would appear to be the same. fiddle . Go ahead and move the navbar inside the header. If you do, you will see this. Our navbar is going anywhere outside of that header. Sticky will only "stick" to its container block, and only if this one is a scrolling-container. The navbar is indeed sticking to the header, and that is why the text stills moves. After his nearest scrolling ancestor that happens to be containing it ends, so will the " " flip and change back to relative. fixed switch Of course, every other element inside his container that has a static position or z-index lesser than this sticky element will completely ignore his presence. We will get the overlap effect if they are fighting for the same place that we might be expecting. If you were wondering what I had to do on that task, was this I remember my solution went more or less as you can see on there. fiddle . To conclude If you are a beginner with programming, it may be daunting to read the official documentation for answers but, if the documentation is good enough, you'll have everything you need. These will not be the case for every documentation you read. I had awful experiences. is not the case. This one

How CSS Position Sticky Really Works: Tips For Beginners

Did you ever hear of Sticky Keys Exploit? You probably did, since it has been known for ages. It was used as an exploit many times, fought in many windows versions, and it has never been killed. That’s why I’m calling it the “War Veteran”, although it never retired… In short, it’s a Windows privilege escalation exploit that allows you to get a command prompt window with administrative privileges. From there you could, change the user password and log in, for example. But I will explain to you in more detail ahead. The exploit Sticky Keys is an operating system GUI accessibility. It was designed to help people with specific disabilities. Putting it simply, it allows modifier keys ( , etc.) to remain pressed for some time. Ctrl Shift, Let me quickly tell you its story. Sticky keys was born in the Mac OS System 6 in the '80s. Windows implemented its version some years later in Windows 95, far from knowing it would be exploited in the future. It happened for the first time on Windows XP and more than 15 years later, it’s threatening to side with other Windows iconic exploits. But how does the exploit work? Well, there are some variations to this, but the most common begins with a Windows Startup Repair, be it from the host OS or an installation device. From there you would get a Cmd window, and if all goes well, you should have enough privileges to make changes inside the folder. System32 All you have to do then is to replace the Cmd (cmd.exe) executable with the Sticky Keys ( ) one (all in the same folder). You could then boot normally into the OS and from the lock screen, once you press shift key 5 times, a Cmd window pops up. From there you can change the user password, or exploit the machine in any other way you wanted. sethc.exe Sounds good? It probably does, but it's so old that it makes you wonder: Does it really still work? Were there any efforts to fix the "vulnerability"? Well, first mistake. Sticky Keys is not a vulnerability. One definition of vulnerability, given by NIST: “Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.” In this case, it's not a system vulnerability that is being exploited, but the exploit itself. It can be exploited through the user’s lack of security measures, so it ends being a user responsibility. And it's more like an OS native characteristic. Now you could ask: but the exploit still works without the need for user improper configuration, right? Certainly! But perhaps it falls short of importance for the fact it requires physical access to use it. So, back to the question, I think that to some extent, there’s a chance that Windows doesn’t want to fully fix this problem. First, the fact that it's not a vulnerability breaks the need for fixes. But there's also a chance that this was left on purpose as a way to break into the machine when needed. After all, there are some other tools capable of achieving the exact same thing. The truth is, I've been following this vulnerability for some time, and if you did it too, you would tell that little or no changes were made for long periods. I found and keep finding a lot of material on this vulnerability, from blog posts to YouTube tutorials teaching how to use the exploit. I also found that people keep asking for ways to protect against this, and they even use Microsoft forums. Moreover, you can also find some telling how this vulnerability has been “documented all over” or where people even then were asking for a solution. old tutorials old posts But after all, it appears Microsoft has taken a few measures to protect users against this exploit. I gathered some (there may be others): Windows firewall preventing sethc.exe to run Cmd. SFC restoring sethc.exe file back to it’s original. Forbidding file modifications on the “System32” folder. Removing "sethc" from the “System32” folder when accessing through the recovery mode. Password protecting Cmd access in the troubleshooting mode. Given these measures and because I didn't find any recent post, I wanted to be sure that this vulnerability was still exploitable on the latest Windows 10 version. Let me show you how it went because everyone likes demonstrations. And before you tell me you saw this a hundred times, I tell you that this one had unexpected turns... Demonstration I’m not going to go through every step since there’s already a lot of demonstrations and on this exploit. And my purpose right now is only showing you the present limitations I encountered and the workarounds I found to exploit it. tutorials I started by trying to exploit directly through the native OS troubleshooting mode, and I immediately crashed on the first wall, the password-protected Cmd. I retried the same using a Windows installation image but again hitting the same problem: After thinking for some time on a solution, I found that this could be a recent limitation since my installation image was the most recent. So I retried the process using an older Windows version and Voilà: I had a Cmd… A few commands later and I also had replaced sticky keys… All I had to now was restart Windows, hit shift key 5 times, and my Cmd window opened. Here some people said to have found limitations because the firewall would detect the exploit. This could probably be bypassed by using the first command-line window to disable the firewall, but I had no problem with this. The real problem appeared then. It wasn’t supposed to request me any other permissions to change the user password since I was doing it with admin privileges, but still, Windows was refusing it. I guess this is a result of some configuration that I made earlier that deny access to the admin. I tried some things to get around this problem, but I couldn't find a solution until I remembered... What about the admin account? So I checked for the admin account, activated it and was able to change its password. net Administrator
net Administrator /Active: net Administrator * user user Yes user In the end, I didn’t get access to access to the user I wanted (guinea-pig), but I got to access the Admin account - . From there I verified that I still had the permission to do pretty much everything, including accessing any personal file from the user account. even better Just for fun, and to show you there’s some other stuff you can do after you get access to an admin account. From a terminal, I executed the following command: REG ADD HKLM\software\microsoft\windows\currentversion\run /v nc /d “C:\windows\system32\nc.exe -ldp 443 -e cmd.exe This created a persistent Cmd Shell giving me remote access to the user account through port 443, as soon as the computer booted again. Of course this only works because netcat was installed on the victim’s computer, if not, it's nothing I couldn't do using other attack vectors. For instance, having my hands dirty already, I could simply have netcat executable in a flash drive, and copy it to the victim's computer. Protecting yourself Guinea-pig user wasn’t the best example of protection and it’s not your fault that this is exploitable, but now that you know this, any breach you happen to have using this exploit — will be all on you. even though very unlikely — There are some ways I found to protect your Windows machine: Disabling sticky keys keyboard activation ( you can still activate it through a button on the login screen). Disabling startup repair ( and insecure) sounds awful BIOS password ( ). good option Some of these solutions will work, some better than others and with different setup difficulties. But wouldn't you prefer a simpler and more secure way? Device Encryption. That's your answer. It's the first and easiest step you can take to protect against this. This way an attacker would first have to know your password to decrypt the device before being able to use any exploit. There are different ways you can achieve this encryption in Windows machines. In case you don’t know any, I suggest . BitLocker If BitLocker happens to be disabled in your country or somehow is not available in your machine, just look for encryption alternatives. As a last resort, go for some of the methods that were previously listed. But be aware that there are variations of this that can be used to exploit other accessibility shortcuts. If it's still a no, you can go for the BIOS password. It’s a good solution too. But know there's more to device encryption. The benefits go way beyond the simple protection against this physical access flaw. Device encryption will make your computer inaccessible without the password, which means that even with physical access to your computer or hard drive it’s very hard to access your data. What's your opinion on this? Are you doing something to protect yourself?

Stories, News & Mentions about STICKY

Sticky’s Stories on HackerNoon