SureInis in the Internet First Insurance Platforms Industry

SureIn

surein

3 Quick Ways to Optimize RecyclerView

RecyclerView অপ্টিমাইজ করার 3টি দ্রুত উপায়

3 schnelle Möglichkeiten zur Optimierung von RecyclerView

Tres formas rápidas de optimizar RecyclerView

3 façons rapides d'optimiser RecyclerView

रीसाइक्लरव्यू को अनुकूलित करने के 3 त्वरित तरीके

RecyclerView を最適化する 3 つの簡単な方法

RecyclerView를 최적화하는 3가지 빠른 방법

3 maneiras rápidas de otimizar o RecyclerView

3 быстрых способа оптимизировать RecyclerView

RecyclerView'ı Optimize Etmenin 3 Hızlı Yolu

3 cách nhanh chóng để tối ưu hóa RecyclerView

优化 RecyclerView 的 3 种快速方法

How to Improve User Experience and Reduce Costs: Here's Why You Should Use Caching

কীভাবে ব্যবহারকারীর অভিজ্ঞতা উন্নত করা যায় এবং খরচ কমানো যায়: এখানে কেন আপনার ক্যাশিং ব্যবহার করা উচিত

So verbessern Sie die Benutzererfahrung und senken die Kosten: Darum sollten Sie Caching verwenden

Cómo mejorar la experiencia del usuario y reducir costos: aquí le explicamos por qué debería utilizar el almacenamiento en caché

Comment améliorer l'expérience utilisateur et réduire les coûts : voici pourquoi vous devriez utiliser la mise en cache

उपयोगकर्ता अनुभव को कैसे बेहतर बनाएं और लागत कम करें: आपको कैशिंग का उपयोग क्यों करना चाहिए

ユーザーエクスペリエンスを向上させてコストを削減する方法: キャッシュを使用する理由

사용자 경험을 개선하고 비용을 절감하는 방법: 캐싱을 사용해야 하는 이유는 다음과 같습니다.

Como melhorar a experiência do usuário e reduzir custos: veja por que você deve usar o cache

Как улучшить пользовательский опыт и сократить расходы: вот почему вам следует использовать кеширование

Kullanıcı Deneyimi Nasıl İyileştirilir ve Maliyetler Nasıl Azaltılır: İşte Önbelleğe Alma Neden Kullanmalısınız?

Cách cải thiện trải nghiệm người dùng và giảm chi phí: Đây là lý do bạn nên sử dụng bộ nhớ đệm

如何改善用户体验并降低成本：这就是您应该使用缓存的原因

In the previous article in this series, we looked at how we could automate deploys to Heroku using Heroku Flow for our CI/CD. That setup had two Heroku apps for staging and production but only used a single main branch. The staging app was automatically deployed when you committed to the main branch, and the production app was manually deployed by clicking the “Promote to production” button in the Heroku pipeline. That strategy assumes that you’re doing “trunk-based development,” in which you commit to a single main branch in your code repo. However, some engineering teams still follow a branching strategy called Gitflow, which involves using a dev branch and a main branch. Feature branches are merged into the dev branch to deploy code to a staging environment and on a regular cadence, the dev branch is merged into the main branch to release the code to the production environment. In this article, we’ll consider how we can configure Heroku Flow to meet our CI/CD needs when following the Gitflow branching strategy. We’ll use our Heroku Pipeline to deploy our app to our staging environment when we push to the dev branch and deploy our app to our production environment when we push it to the main branch. Ready to go with the flow? Getting Started If you’d like to follow along throughout this tutorial, you’ll need a Heroku account and a GitHub account. You can create a Heroku account here, and you can create a GitHub account here. The demo app shown in this article is deployed to Heroku, and the code is hosted on GitHub. Running Our App Locally You can run the app locally by forking the repo in GitHub, installing dependencies, and running the start command. In your terminal, do the following after forking the repo: $ cd heroku-flow-gitflow-demo
$ npm install
$ npm start After starting the app, visit http://localhost:5001/ in your browser, and you’ll see the app running locally: Creating Our Heroku Pipeline Now that we have the app running locally let’s get it deployed to Heroku so that it can be accessed anywhere, not just on your machine. We’re going to create a Heroku pipeline that includes two apps: a staging app and a production app. To create a new Heroku pipeline, navigate to your Heroku dashboard, click the “New” button in the top-right corner of the screen, and then choose “Create new pipeline” from the menu. In the dialog that appears, give your pipeline a name, choose an owner (yourself), and connect your GitHub repo. If this is your first time connecting your GitHub account to Heroku, a second popup will appear in which you can confirm giving Heroku access to GitHub. After connecting to GitHub, click “Create pipeline” to finish the process. With that, you’ve created a Heroku pipeline. Nice work! Creating Our Staging and Production Apps As we mentioned, we’ll use two environments for our app: a staging environment and a production environment. The staging environment is where code is deployed for acceptance testing and any additional QA. The production environment is where code is released to actual users. Let’s add a staging app and a production app to our pipeline. Both of these apps will be based on the same GitHub repo. To add a staging app, click the “Add app” button in the Staging section. Next, click “Create new app” to open a side panel. In the side panel, give your app a name, choose an owner (yourself), and choose a region (I left mine in the United States). Then click “Create app” to confirm your changes. Congrats, you’ve just created a staging app! Now let’s do the same thing, but this time for our production app. When you’re done configuring your production app, you should see both apps in your pipeline: Configuring Automatic Deploys We want our app to be deployed to our staging environment any time we commit to our repo’s dev branch. To do this, click the dropdown button for the staging app and choose “Configure automatic deploys” from the menu. In the dialog that appears, make sure the dev branch is targeted, and check the box to “Wait for CI to pass before deploy.” In a later step, we’ll configure Heroku CI so that we can run tests in a CI pipeline. We don’t want to deploy our app to our staging environment unless CI is passing. Now let’s do the same thing for the production app, but this time choosing to deploy our production app whenever we commit code to the main branch. Enabling Heroku CI If we’re going to require CI to pass, we had better have something configured for CI! Navigate to the “Tests” tab and then click the “Enable Heroku CI” button. Our demo app is built with Node and runs unit tests with Jest. The tests are run through the npm test script. Heroku CI allows you to configure more complicated CI setups using an app.json file, but in our case because the test setup is fairly basic, Heroku CI can figure out which command to run without any additional configuration on our part. Pretty neat! Enabling Review Apps For the last part of our pipeline setup, let’s enable review apps. Review apps are temporary apps which get deployed for every pull request (PR) created in GitHub. They’re incredibly helpful when you want your code reviewer to manually review your changes. With a review app in place, the reviewer can simply open the review app rather than having to pull down the code onto their machine to run the app locally. To enable review apps, click the “Enable Review Apps” button on the pipeline page. In the dialog that appears, check all three boxes. The first box enables review apps to be automatically created for each PR.
The second box ensures that the review app isn’t created until CI passes.
The third box sets a time limit on how long a stale review app should exist until it is destroyed. Review apps use Heroku resources just like your regular apps, so you don’t want these temporary apps sitting around unused and costing you or your company more money. When you’re done with your configuration, click “Enable Review Apps” to finalize your changes. Seeing It All in Action Alright, you made it! Let’s review what we’ve done so far. We created a Heroku pipeline.
We created a staging app and a production app for that pipeline.
We enabled automatic deploys from the dev branch to our staging app.
We enabled automatic deploys from the main branch to our production app.
We enabled Heroku CI to run tests for every PR.
We enabled the creation of Heroku review apps for every PR. Now, let’s see it all in action! Create a feature branch off of your dev branch with any code change you’d like, and then use that to create a PR in GitHub to merge that feature branch into dev. I made a very minor UI change, updating the heading text from “Heroku Flow Gitflow Demo” to “Heroku Flow Gitflow Branching”. Right after the PR is created, you’ll note that a new “check” gets created in GitHub for the Heroku CI pipeline. You can view the test output back in Heroku on your Tests tab: After the CI pipeline passes, you’ll note that another piece of info gets appended to your PR in GitHub. The review app is deployed, and GitHub shows a link to the review app. Click the “View deployment” button, and you’ll see a temporary Heroku app with your code changes. You can also find a link to the review app in your Heroku pipeline: Let’s assume that you’ve gotten a code review and that everything looks good. It’s time to merge your PR. After you’ve merged your PR, look back at the Heroku pipeline. You’ll see that Heroku automatically deployed the staging app since new code was committed to the dev branch. At this point in the software development lifecycle, there might be some final QA or acceptance testing of the app in the staging environment. Let’s assume that everything still looks good and that you’re ready to release this change to your users in production. You can create another PR to merge the dev branch into the main branch, or you can do this from your terminal by checking out the main branch and then running git merge dev and git push. Once you’ve committed these changes to the main branch, look at your Heroku pipeline again, and you’ll see that the production app was automatically deployed. And with that, your changes are now in production for all your users to see. Way to go! Conclusion If you’ve followed along this far, give yourself a pat on the back. Walking through these steps, we’ve configured everything we need for an enterprise-ready CI/CD solution for a team using the Gitflow branching strategy and multiple environments. It doesn’t matter if you prefer trunk-based development or Gitflow as your branching strategy — Heroku Flow can support either. Now not only can you host your apps on Heroku, but you can set up all of your CI/CD infrastructure on Heroku’s platform as well. In the previous article in this series, we looked at how we could automate deploys to Heroku using Heroku Flow for our CI/CD . That setup had two Heroku apps for staging and production but only used a single main branch. The staging app was automatically deployed when you committed to the main branch, and the production app was manually deployed by clicking the “Promote to production” button in the Heroku pipeline. using Heroku Flow for our CI/CD main main That strategy assumes that you’re doing “ trunk-based development ,” in which you commit to a single main branch in your code repo. trunk-based development main However, some engineering teams still follow a branching strategy called Gitflow , which involves using a dev branch and a main branch. Feature branches are merged into the dev branch to deploy code to a staging environment and on a regular cadence, the dev branch is merged into the main branch to release the code to the production environment. Gitflow dev main dev dev main In this article, we’ll consider how we can configure Heroku Flow to meet our CI/CD needs when following the Gitflow branching strategy. We’ll use our Heroku Pipeline to deploy our app to our staging environment when we push to the dev branch and deploy our app to our production environment when we push it to the main branch. Heroku Flow dev main Ready to go with the flow? Getting Started If you’d like to follow along throughout this tutorial, you’ll need a Heroku account and a GitHub account. You can create a Heroku account here , and you can create a GitHub account here . create a Heroku account here create a GitHub account here The demo app shown in this article is deployed to Heroku, and the code is hosted on GitHub . the code is hosted on GitHub Running Our App Locally You can run the app locally by forking the repo in GitHub, installing dependencies, and running the start command. In your terminal, do the following after forking the repo: $ cd heroku-flow-gitflow-demo
$ npm install
$ npm start $ cd heroku-flow-gitflow-demo
$ npm install
$ npm start After starting the app, visit http://localhost:5001/ in your browser, and you’ll see the app running locally: http://localhost:5001/ Creating Our Heroku Pipeline Now that we have the app running locally let’s get it deployed to Heroku so that it can be accessed anywhere, not just on your machine. We’re going to create a Heroku pipeline that includes two apps: a staging app and a production app. To create a new Heroku pipeline, navigate to your Heroku dashboard, click the “New” button in the top-right corner of the screen, and then choose “Create new pipeline” from the menu. In the dialog that appears, give your pipeline a name, choose an owner (yourself), and connect your GitHub repo. If this is your first time connecting your GitHub account to Heroku, a second popup will appear in which you can confirm giving Heroku access to GitHub. After connecting to GitHub, click “Create pipeline” to finish the process. With that, you’ve created a Heroku pipeline. Nice work! Creating Our Staging and Production Apps As we mentioned, we’ll use two environments for our app: a staging environment and a production environment. The staging environment is where code is deployed for acceptance testing and any additional QA. The production environment is where code is released to actual users. Let’s add a staging app and a production app to our pipeline. Both of these apps will be based on the same GitHub repo. To add a staging app, click the “Add app” button in the Staging section. Next, click “Create new app” to open a side panel. In the side panel, give your app a name, choose an owner (yourself), and choose a region (I left mine in the United States). Then click “Create app” to confirm your changes. Congrats, you’ve just created a staging app! Now let’s do the same thing, but this time for our production app. When you’re done configuring your production app, you should see both apps in your pipeline: Configuring Automatic Deploys We want our app to be deployed to our staging environment any time we commit to our repo’s dev branch. To do this, click the dropdown button for the staging app and choose “Configure automatic deploys” from the menu. dev In the dialog that appears, make sure the dev branch is targeted, and check the box to “Wait for CI to pass before deploy.” In a later step, we’ll configure Heroku CI so that we can run tests in a CI pipeline. We don’t want to deploy our app to our staging environment unless CI is passing. dev Now let’s do the same thing for the production app, but this time choosing to deploy our production app whenever we commit code to the main branch. main Enabling Heroku CI If we’re going to require CI to pass, we had better have something configured for CI! Navigate to the “Tests” tab and then click the “Enable Heroku CI” button. Our demo app is built with Node and runs unit tests with Jest. The tests are run through the npm test script. Heroku CI allows you to configure more complicated CI setups using an app.json file, but in our case because the test setup is fairly basic, Heroku CI can figure out which command to run without any additional configuration on our part. Pretty neat! npm test app.json Enabling Review Apps For the last part of our pipeline setup, let’s enable review apps. Review apps are temporary apps which get deployed for every pull request (PR) created in GitHub. They’re incredibly helpful when you want your code reviewer to manually review your changes. With a review app in place, the reviewer can simply open the review app rather than having to pull down the code onto their machine to run the app locally. To enable review apps, click the “Enable Review Apps” button on the pipeline page. In the dialog that appears, check all three boxes. The first box enables review apps to be automatically created for each PR. The second box ensures that the review app isn’t created until CI passes. The third box sets a time limit on how long a stale review app should exist until it is destroyed. Review apps use Heroku resources just like your regular apps, so you don’t want these temporary apps sitting around unused and costing you or your company more money. The first box enables review apps to be automatically created for each PR. The second box ensures that the review app isn’t created until CI passes. The third box sets a time limit on how long a stale review app should exist until it is destroyed. Review apps use Heroku resources just like your regular apps, so you don’t want these temporary apps sitting around unused and costing you or your company more money. When you’re done with your configuration, click “Enable Review Apps” to finalize your changes. Seeing It All in Action Alright, you made it! Let’s review what we’ve done so far. We created a Heroku pipeline. We created a staging app and a production app for that pipeline. We enabled automatic deploys from the dev branch to our staging app. We enabled automatic deploys from the main branch to our production app. We enabled Heroku CI to run tests for every PR. We enabled the creation of Heroku review apps for every PR. We created a Heroku pipeline. We created a staging app and a production app for that pipeline. We enabled automatic deploys from the dev branch to our staging app. dev We enabled automatic deploys from the main branch to our production app. main We enabled Heroku CI to run tests for every PR. We enabled the creation of Heroku review apps for every PR. Now, let’s see it all in action! Create a feature branch off of your dev branch with any code change you’d like, and then use that to create a PR in GitHub to merge that feature branch into dev . I made a very minor UI change, updating the heading text from “Heroku Flow Gitflow Demo” to “Heroku Flow Gitflow Branching”. dev dev Right after the PR is created, you’ll note that a new “check” gets created in GitHub for the Heroku CI pipeline. You can view the test output back in Heroku on your Tests tab: After the CI pipeline passes, you’ll note that another piece of info gets appended to your PR in GitHub. The review app is deployed, and GitHub shows a link to the review app. Click the “View deployment” button, and you’ll see a temporary Heroku app with your code changes. You can also find a link to the review app in your Heroku pipeline: Let’s assume that you’ve gotten a code review and that everything looks good. It’s time to merge your PR. After you’ve merged your PR, look back at the Heroku pipeline. You’ll see that Heroku automatically deployed the staging app since new code was committed to the dev branch. dev At this point in the software development lifecycle, there might be some final QA or acceptance testing of the app in the staging environment. Let’s assume that everything still looks good and that you’re ready to release this change to your users in production. You can create another PR to merge the dev branch into the main branch, or you can do this from your terminal by checking out the main branch and then running git merge dev and git push . dev main main git merge dev git push Once you’ve committed these changes to the main branch, look at your Heroku pipeline again, and you’ll see that the production app was automatically deployed. main And with that, your changes are now in production for all your users to see. Way to go! Conclusion If you’ve followed along this far, give yourself a pat on the back. Walking through these steps, we’ve configured everything we need for an enterprise-ready CI/CD solution for a team using the Gitflow branching strategy and multiple environments. It doesn’t matter if you prefer trunk-based development or Gitflow as your branching strategy — Heroku Flow can support either. Now not only can you host your apps on Heroku, but you can set up all of your CI/CD infrastructure on Heroku’s platform as well.

Go With the CI/CD Flow: Using Heroku Flow With Gitflow Branching

Product-Market Fit Tips for Startups: Insights From 20 Experts

How to Start a Career in Product Marketing: 10 Expert Tips (2024)

Calling All Writers: Learn What The Crypto-API Writing Contest Is All About From The CoinGecko Team

সমস্ত লেখকদের কল করা হচ্ছে: CoinGecko টিম থেকে ক্রিপ্টো-এপিআই লেখার প্রতিযোগিতাটি কী তা জানুন

Aufruf an alle Autoren: Erfahren Sie vom CoinGecko-Team, worum es beim Crypto-API-Schreibwettbewerb geht

Llamando a todos los escritores: aprenda de qué se trata el concurso de redacción Crypto-API del equipo CoinGecko

Appel à tous les écrivains : découvrez en quoi consiste le concours d'écriture Crypto-API auprès de l'équipe CoinGecko

सभी लेखकों को बुलावा: कॉइनगेको टीम से जानें क्रिप्टो-एपीआई लेखन प्रतियोगिता क्या है

ライターの皆さんへ: CoinGecko チームから暗号 API ライティング コンテストについて学びましょう

모든 작가에게 전화하기: CoinGecko 팀으로부터 Crypto-API 글쓰기 콘테스트의 모든 내용을 알아보세요

Ligando para todos os escritores: saiba do que se trata o concurso de redação de Crypto-API da equipe CoinGecko

Обращение ко всем писателям: узнайте, что такое конкурс авторов Crypto-API, от команды CoinGecko

Tüm Yazarlara Çağrı: CoinGecko Ekibinden Kripto API Yazma Yarışmasının Neyle İlgili Olduğunu Öğrenin

Kêu gọi tất cả người viết: Tìm hiểu nội dung cuộc thi viết về tiền điện tử-API từ nhóm CoinGecko

召集所有作家：从 CoinGecko 团队了解 Crypto-API 写作比赛的全部内容

In this article, we are going to talk about a system for performing authentication and authorization securely. To start off with lets understand, what is the difference between Authentication and Authorization. is the process of proving, you are, who you say you are, when accessing an application. Authentication is the process of defining and enforcing access policies - that is, what you can do once you’re authenticated. Authorization In this article, we will see: Why Authentication and Authorization matter How Authentication works How Authorization works Authentication System Design Conclusion Why Authentication and Authorization matter? Lets say we are in a meeting, and you are the leading the conversation. To ask for updates/status for something to the right  person, you need to identify (ie ) the person. Even to share some sensitive data with a person, you need to  authenticate the person correctly. And that is where authentication  comes in. Authenticate Now say, in the same meeting, a few decisions needs to be made. So for that, people who have the right for taking those decisions should be  the one taking the call, we cant just allow everyone to do everything.  Obviously some people are not catered enough to make some decisions, and  some for sure will try to make the worst out of it. So that brings , that gives certain people the rights permissions for certain activities. Authorization How Authentication works? To authenticate a person, we can assign a unique phrase to each person, and given the person tells the phrase correctly and their name.  We can say that ok, we have identified the person. This is the usual  usernames and passwords approach. When the right credentials are given, a  system considers the identity valid and grants access. This is known as  1FA or (SFA). Single-factor authentication SFA is considered fairly insecure. Why? Because users are notoriously bad at keeping their login information secure. Multi-factor  authentication (MFA) is a more secure alternative that requires users to  prove their identity in more than one way. Some such ways are: Single-use PIN numbers / OTP Authentication apps run by secure 3rd party (ex. Google/Microsoft Authenticator) Biometrics Once authenticated, the person would keep performing actions freely on the application. And the application is expected to have the person  recognized throughout their journey without forgetting them. Ideally, it  would be too much to ask the user to provide the password everytime  they move to a different page, or they do some activity. So we need a  way to keep the user authenticated after they have entered their  credentials and they have been authenticated once. This is called . Session Management 2 ways to keep the user authenticated: : When a user logins to a website on a browser, the server creates a session for that user and assigns a sessionid. This sessionid is stored by the server for reference and is sent back to the user to be stored in a cookie in the browser. Now each time the user would make a request the browser will send the sessionid along with the request. Which will help in authenticating the request. And, thus, preserving authentication while the user is on the site. Session-based authentication : For this, the server creates a encrypted token which is sent to the user and is saved by the browser only, as HttpOnly Cookies. All required information such as the user information, permissions and expiry of the token are encrypted within the token. The token is sent along for calls to the server. The server simply decrypts the token with the secret key and verifies the user. This token is refreshed at intervals. Token-based authentication The main differences between these two approaches would be that token-based authn is , cause the token neednot be stored on the server side. But for  session-based authentication, the token are needed to be stored on the  server side as well, which makes it . Which brings up complications, when the system is scaled or the number of users grows. Stateless Stateful For token-based authentication, we mostly use JWTs (JSON Web Tokens). How Authorization works? Once the user is authenticated, we would still need to ensure they’re only allowed to access resources that they have permissions to access.  Unauthorized access to sensitive data can be a disaster. By the  principle of least priviledge, companies would usually set up access  policies such that by default you have access to what is required for  you absolutely. And then in progression to that you have additional  access. Common ways to segment access are: : Users are assigned to a certain group/role that comes with set permissions. Examples: admin, member, owner. Role-based Access Control (RBAC) : Dynamically determines access privileges during authorization based on policies and rules. Policies are based on user roles, job functions, and organizational requirements. Policy-based Access Control (PBAC) : Users are permitted access according to attributes like title, certification, training, and/or environmental factors like location. Attribute-based Access Control (ABAC) : Each user or entity has individual permissions that can be turned on or off, similar to installing a new app on your phone and deciding which permissions to grant (location services, contacts, etc.) Access Control Lists (ACLs) ACL is frequently used at granular level than either ABAC or RBAC - for example, to grant individual users access to a certain file. ABAC and RBAC are generally instituted as company-wide policies. Authentication System Design Requirements Lets first start with defining the of the system: Functional requirements : Allow users to register by providing necessary information. Registration : Authenticate users based on their credentials. Login : Efficiently manage user sessions to ensure security. Session Management : Provide a secure process for users to recover their passwords. Password Recovery : Define roles and permissions for different user types. Access Control : Maintain detailed logs of authentication events for auditing. Audit Trail : Ensure low latency and quick response times. Performance A few that we are not going to consider for the scope of this article are: Non-functional requirements : Implement a robust MFA system. Multi-Factor Authentication (MFA) : Prioritize data security through encryption, secure storage, and secure communication. Security : Design the system to handle a growing number of users and transactions. Scalability : Minimize system downtime and ensure high availability. Reliability : Develop an intuitive user interface for a seamless experience. Usability Capacity Estimation Traffic Estimation First lets start with . Assuming an average traffic of 100,000 per month.We are estimating a 100k user traffic per month. Which translates to 0.04 request per second. We would need to respond to each request within  500ms 90% of the time, ie we require a p90 latency of 500ms. Traffic Estimation assumed_traffic_per_month = 100000 #requests
assumed_traffic_per_day = assumed_traffic_per_month / 30
                        ~= 3350 (assuming on higher end; 3333.33 to be precise)
estimated_time_per_request = 500 #ms; P90 of 500ms
traffic_per_second = (assumed_traffic_per_month) / (30*24*60*60) 
                   = 0.04 :  500ms (maximal acceptable latency, immaterial of the load on the system) The average capacity 1 instance can take, based on our calculations  is approximately 35ms to serve a request, assuming there are no heavy  processing happening for the particular request. Service Level Objective (SLO) Lets generate two more using the above metrics. derived metrics : Acceptable backlog per instance : Maximum number of requests(load) that can be accepted by an instance, without compromising SLO. Capacity : Backlog per instance : Total number of requests (load) that flows into a unit/instance based on current traffic. Demand Thus, SLO = 500ms
approx_response_time_for_one_request = 35 #ms
capacity = SLO/approx_response_time_for_one_request
         = 500 / 35
         ~= 20

load_on_one_instance = 0.04
instances_available = 1
demand = traffic_per_second / instances_available
       = 0.04 With the demand and capacity available, lets calculate total number of instances required. total_units_required = demand / capacity
                     = 0.04 / 20
                     = 0.002
                     ~= 1 Thus, we would be easily be able to handle 100k requests per month,  with 0.04 requestsper second, with 1 instance. Where each unit can  handle 20 requests per second without compromising SLO. Storage Estimation We would ideally need to store the user details for each user for authentication and authorization access.  Assuming, 5kb /user monthly_new_users = 500
monthly_additional_storage = 500 * 5kb
                           = 2500kb 
                           ~= 2GB So every month, assuming we will onboard 500 new users, we will require 2GB more storage. Incase we would like to keep authentication logs. Each authentication request is expected to take 2kb to store. auth_request_size = 2kb #assumption
monthly_storage = monthly_visitors * auth_request_size
                = 100,000 * 2KB
                ~= 200MB Thus, each month we would require an additional of 200MB, assuming a monthly traffic of 100k. Database Design Now that we have the capacity estimation done. Lets create the schemas of the database required to support the functional requirements. Lets quickly go over the tables. We are using 6 tables. Users - To store all the user information Credentials - To store the access/refresh credentials once the user has been authorized. Passwords - To store the user encrypted user passwords. PasswordRequests - To store the password change requests that comes for a particular user. Sessions - To store when the user had an active session and when was their last activity. ActivityApproval - To store approval requests for a activity performed by a particular user, that would be verified by admin. High-Level Design for the Authentication System System Endpoints Endpoint Description /login Authenticate user credentials. /logout End user session and revoke authentication tokens. /register Create a new user. /update/:userId Update user information. /delete/:userId Delete a user account. /grant/:userId/:permission Grant specific permissions to a user. /revoke/:userId/:permission Revoke permissions from a user. /check/:userId/:resource Check user’s access to a specific resource. /create/:userId Create a new user session. /expire/:sessionId Expire a user session. /validate/:sessionId Validate an active user session. Requirements Fulfilment Now, with all the things in place lets see how we can complete all the requirements. Registration - When a new user visits our application. We need to store user details so we can authorize/identify  the user next time they visit. Requirement - When a new user visits the application, and enters user details along with their email and password. That will  get captured in the database. The user details will be stored in the  User table. And the password will be stored in the credentials table in  an encrypted form. Fulfilled Login - When an existing user visits our application. We need to identify the user so we can authorize/identify  their actions and show them data that belongs to them. Requirement - When an existing user visits the application, and enters their details, email and password. We hash the  password and match the hash against the hash stored for the user in the  Credentials Table. If it matches then we have been able to identify the  user successfully. Else they need to enter the correct password that  they entered while registering. This process is called . Fulfilled Authentication Session Management - When a user has authenticated themselves, by entering their user and password. We need to make sure  that they stay logged in as they perform their future actions / try to  see sensitive data, without having them re-entering their password again  and again. Requirement - When the user authenticates successfully. The Authentication server will share 2 tokens with the client. A and a . The access_token can have encrypted data with it and it has a short  expiry time cause of security reasons. Once the client has the  access_token, it sends the access_token back along with every request  which helps in authenticating the request. When the access_token  expires, the client has to ask for a new access_token using the  refresh_token provided. This helps in maintaining a session. Fulfilled access_token refresh_token Password Recovery - When a user forgets their password, they would need to be able to reset their password securely. Requirement - When the user forgets their password, they can submit their email address in the forgot password page, and we  will generate a one time code and send the link to their email. When the  user clicks on this link with the code and email address. We will  securely be able to identify that the password recovery request is  authentic. And provide the user to set their new password. And thus  being able to recover the password. Fulfilled Access Control - When a user performs a certain action, we need to make sure that the user is authenticated to perform that  action and only then allow the action to happen. Requirement - We will maintain a list of actions, lets say 1-12, for simplicity. For each user we will maintain the  authenticated actions for that user. So now lets say the user tries to  perform an action #id 4. We will check if the user has the permissions  to perform action 4. If yes, we will go ahead and complete the request.  Else we show that the request isnt successful cause of lack of  permissions. Fulfilled Audit Trail - Incase of a security incident, we should be able to have enough logs to look through and have a plausible  reason as to what might have happened / or any leads as to what might  have been a possible cause of it. Requirement - For such scenarios, we can keep logs for every authentication action that happens on the server. (a). For each login request, we will keep a log as to  when the authentication happened, from where, ips and other relevant  details. (b). For each password recovery request, we will keep a  log as to when it was initiated, from where, ips, whether the request  was complete and other relevant details.        (c). Additionally, we will keep logs around each time a  user is authorized / unauthorized for an action and by who. These logs in all, should be able to indicate what might  have happened incase trying to understand some scenario. Fulfilled Performance - Requirement for performance as discussed in capacity estimation section, is 0.04 requests/second and 100k requests per month. Requirement - We have already handled the requirement with enough servers in the capacity estimation section. Fulfilled Conclusion In this article, we started by understanding what is the difference between Authentication and Authorization. Next, we created a Authentication and Authorization System. That is safe, secure, delivers performance while catering to industry standards and meeting all the desired requirements. Going forward i might update certain parts of the article to make it stay relevant as well as to cover more information and insights in building such a system.

Designing Functional Authentication and Authorization Systems

কার্যকরী প্রমাণীকরণ এবং অনুমোদন সিস্টেম ডিজাইন করা

Entwurf funktionaler Authentifizierungs- und Autorisierungssysteme

Diseño de sistemas funcionales de autenticación y autorización

Conception de systèmes d'authentification et d'autorisation fonctionnels

कार्यात्मक प्रमाणीकरण और प्राधिकरण प्रणालियों का डिजाइन

機能的な認証および認可システムの設計

기능적 인증 및 권한 부여 시스템 설계

Projetando sistemas funcionais de autenticação e autorização

Проектирование функциональных систем аутентификации и авторизации

İşlevsel Kimlik Doğrulama ve Yetkilendirme Sistemlerinin Tasarlanması

Thiết kế hệ thống xác thực và ủy quyền chức năng

设计功能性身份验证和授权系统

As a society, we've always been drawn to a good story. From ancient myths to modern-day blockbusters, the power of narrative has the ability to captivate, inspire, and transform. In the world of technology, where innovation is the name of the game, storytelling has become the secret weapon behind some of the most buzzed-about startups. And the unexpected heroes of this new era? None other than the creative directors, the ad agency alchemists turned tech founders who have traded in their storyboards for the chance to rewrite the future. Armed with a knack for storytelling and a flair for the dramatic, these former ad agency stars are trading in their Cannes Lions for the chance to launch the next big thing. But as the hype around projects like Humane's AI Pin reaches fever pitch, it's worth asking: are these visionaries revolutionizing the tech landscape, or are they just spinning tales? Take Humane's AI Pin, for example. This little device, dreamt up by former Apple creative directors Imran Chaudhri and Bethany Bongiorno, has made quite the splash with its promise of a screenless, AI-driven future. But let's be real - it's not just the tech that's got everyone talking. It's the story. The vision of a world where technology seamlessly integrates into our lives, as natural as breathing. That's the kind of narrative that gets investors reaching for their checkbooks, the media clamoring for a headline and secures millions in funding. And Humane is far from alone in this new world order. Just look at the rise and fall of Elizabeth Holmes and Theranos. Sure, the revolutionary blood-testing technology never quite materialized, but damn if Holmes didn't spin one hell of a story. With her Steve Jobs-esque turtlenecks and promises of disruption, she had Silicon Valley eating out of the palm of her hand. Or what about Adam Neumann and WeWork? The man could sell a vision like no other, painting a picture of a workplace revolution that would “elevate the world's consciousness” (and the company's valuation to a cool $47 billion). But here's the thing about stories - they're only as good as the reality they're built on. When the curtain gets pulled back and the wizard is revealed to be just a guy with a smoke machine, things can get ugly fast. Just ask the folks who bought into the Theranos dream or the WeWork hype. When the story doesn't match the substance, it's not just disappointment that follows - it's disaster. Moreover, storytelling is not just about hype. Used responsibly, it can be a powerful tool for education and inspiration. When Steve Jobs introduced the iPhone, he didn't just sell a product; he painted a picture of how it would transform our lives. That narrative resonated because it was grounded in a genuine, revolutionary product. So what's the lesson here for the creative directors turned tech visionaries? The use of narrative as a launchpad is not without its risks: with great storytelling power comes great responsibility.The ability to craft a compelling narrative is a gift, but it's one that needs to be used wisely. The best stories, the ones that truly change the game, are the ones that are grounded in something real. Something tangible. Something that doesn't just tickle the imagination but actually follows through on its promises. This is the tightrope that creative directors in the tech world must walk. As for Humane's AI Pin? Only time will tell if it can live up to the hype. But one thing's for sure - in the wild west of tech startups, the storytellers are the new sheriffs in town. They're the ones who can make us believe in a brighter future, a more connected world, a reality where anything is possible. And in a world that can often feel like it's spinning out of control, that's a pretty powerful thing. But as we watch these narratives unfold, it's on us to remember that not every story has a happy ending, like . We've got to approach each new tale with a healthy dose of wonder and a hearty helping of skepticism. Because in the end, the most compelling story isn't always the most true - but it might just be the one that changes everything. As a society, we've always been drawn to a good story. From ancient myths to modern-day blockbusters, the power of narrative has the ability to captivate, inspire, and transform. In the world of technology, where innovation is the name of the game, storytelling has become the secret weapon behind some of the most buzzed-about startups. And the unexpected heroes of this new era? None other than the creative directors, the ad agency alchemists turned tech founders who have traded in their storyboards for the chance to rewrite the future. Armed with a knack for storytelling and a flair for the dramatic, these former ad agency stars are trading in their Cannes Lions for the chance to launch the next big thing. But as the hype around projects like Humane's AI Pin reaches fever pitch, it's worth asking: are these visionaries revolutionizing the tech landscape, or are they just spinning tales? Take Humane's AI Pin, for example. This little device, dreamt up by former Apple creative directors Imran Chaudhri and Bethany Bongiorno, has made quite the splash with its promise of a screenless, AI-driven future. But let's be real - it's not just the tech that's got everyone talking. It's the story. The vision of a world where technology seamlessly integrates into our lives, as natural as breathing. That's the kind of narrative that gets investors reaching for their checkbooks, the media clamoring for a headline and secures millions in funding. And Humane is far from alone in this new world order. Just look at the rise and fall of Elizabeth Holmes and Theranos. Sure, the revolutionary blood-testing technology never quite materialized, but damn if Holmes didn't spin one hell of a story. With her Steve Jobs-esque turtlenecks and promises of disruption, she had Silicon Valley eating out of the palm of her hand. Or what about Adam Neumann and WeWork? The man could sell a vision like no other, painting a picture of a workplace revolution that would “elevate the world's consciousness” (and the company's valuation to a cool $47 billion). But here's the thing about stories - they're only as good as the reality they're built on. When the curtain gets pulled back and the wizard is revealed to be just a guy with a smoke machine, things can get ugly fast. Just ask the folks who bought into the Theranos dream or the WeWork hype. When the story doesn't match the substance, it's not just disappointment that follows - it's disaster. Moreover, storytelling is not just about hype. Used responsibly, it can be a powerful tool for education and inspiration. When Steve Jobs introduced the iPhone, he didn't just sell a product; he painted a picture of how it would transform our lives. That narrative resonated because it was grounded in a genuine, revolutionary product. So what's the lesson here for the creative directors turned tech visionaries? The use of narrative as a launchpad is not without its risks: with great storytelling power comes great responsibility.The ability to craft a compelling narrative is a gift, but it's one that needs to be used wisely. The best stories, the ones that truly change the game, are the ones that are grounded in something real. Something tangible. Something that doesn't just tickle the imagination but actually follows through on its promises. This is the tightrope that creative directors in the tech world must walk. As for Humane's AI Pin? Only time will tell if it can live up to the hype. But one thing's for sure - in the wild west of tech startups, the storytellers are the new sheriffs in town. They're the ones who can make us believe in a brighter future, a more connected world, a reality where anything is possible. And in a world that can often feel like it's spinning out of control, that's a pretty powerful thing. But as we watch these narratives unfold, it's on us to remember that not every story has a happy ending, like . We've got to approach each new tale with a healthy dose of wonder and a hearty helping of skepticism. Because in the end, the most compelling story isn't always the most true - but it might just be the one that changes everything.

Narrative as a Launchpad: How Creative Directors Propel Tech Ventures Like Humane's AI Pin

একটি লঞ্চপ্যাড হিসাবে আখ্যান: কিভাবে ক্রিয়েটিভ ডিরেক্টররা হিউম্যানের এআই পিনের মতো টেক ভেঞ্চারকে এগিয়ে দেয়

Erzählung als Startrampe: Wie Kreativdirektoren Technologieunternehmen wie Humanes KI vorantreiben Pin

La narrativa como plataforma de lanzamiento: cómo los directores creativos impulsan empresas tecnológicas como la IA de Humane

Le récit comme rampe de lancement : comment les directeurs créatifs propulsent les entreprises technologiques comme l'IA de Humane

लॉन्चपैड के रूप में कथा: कैसे क्रिएटिव डायरेक्टर्स ह्यूमेन के एआई पिन जैसे तकनीकी उपक्रमों को आगे बढ़ाते हैं

物語を発射台として: クリエイティブ ディレクターが Humane の AI Pin のようなテクノロジー ベンチャーを推進する方法

런치패드로서의 내러티브: 크리에이티브 디렉터가 Humane의 AI 핀과 같은 기술 벤처를 추진하는 방법

Narrativa como plataforma de lançamento: como os diretores criativos impulsionam empreendimentos tecnológicos como o AI Pin da Humane

Нарратив как стартовая площадка: как креативные директора продвигают технологические предприятия, как пин от Humane об искусственном интеллекте

Bir Başlatma Paneli Olarak Anlatı: Yaratıcı Yönetmenler, Humane'nin Yapay Zeka Pinini Benzeri Teknoloji Girişimlerini Nasıl İlerletir?

Tường thuật như một bệ phóng: Cách các Giám đốc Sáng tạo Thúc đẩy các dự án mạo hiểm công nghệ giống như Ghim AI của Humane

叙事作为启动板：创意总监如何推动 Humane 的 AI Pin 等科技企业的发展

This paper is available on arxiv under CC 4.0 license.
Authors:
(1) Oded Blumenthal, Software and Information Systems Engineering, Ben Gurion University, Israel;
(2) Guy Shani, Software and Information Systems Engineering, Ben Gurion University, Israel. Table of Links Introduction
Background
Related Work
POMCP for Stochastic Contingent Planning
Domain Independent Heuristics for POMCP
Empirical Evaluation
Conclusion and References 2 Background We now provide the required background on POMDPs, contingent planning, domain-independent heuristics, and the POMCP algorithm. 2.1 POMDPs Because the state of a POMDP is partially observable, the agent typically does not know what the true underlying state of the world is. Hence, it can maintain a belief state b, which is a distribution over S, i.e., b(s) is the likelihood that s is the current state. When a goal belief is reached, that is sums∈Gb(s) = 1, then the agent is sure that it is at a goal state, and the execution terminates. A solution to a POMDP, called a policy, is a function that assigns an action to every belief state. The optimal policy minimizes the expected cost, i.e., the expected number of steps before a goal belief has been reached. 2.2 POMCP The Partially Observable Monte-Carlo Planning (POMCP) online re-planning approach uses a Monte Carlo tree search (MCTS) approach to select the next action to execute [27]. At each re-planning episode POMCP constructs a tree, where the root node is the current belief state. Then, POMCP runs forward simulations, where a state is sampled from the current belief, and actions are chosen using an exploration strategy that initially selects actions that were not executed a sufficient amount of times, but gradually moves to select the seemingly best action. Observations in the simulations are selected based on the current state-action observation distribution. When reaching a leaf node, POMCP begins a so-called rollout. This rollout is designed to provide a value estimate for the leaf, based on some predefined rollout policy. The value of the leaf is updated using the outcome of the rollout, and then the values of the nodes along the branch that were visited during the simulation are updated given their descendants. Obviously, the values of all nodes in the tree are hence highly dependent on the values obtained by the rollout policy. POMCP is an anytime algorithm, that is, it continues to run simulations until a timeout, and then returns the action that seems best at the root of the search tree. POMCP was designed for large problems. Hence, POMCP does not maintain and update a belief state explicitly. Instead, POMCP uses a particle filter approach, where a set of states is sampled at the initial belief, and this set is progressed through the tree. 2.3 Contingent Planning under Partial Observability Preconditions allow us to restrict our attention only to applicable actions. An action is applicable in a belief b is all possible states in b satisfy the preconditions of the action. Obviously, one can avoid specifying preconditions for actions, allowing for actions that can always be executed, as is typically the case in flat POMDP representations. However, in domains with many actions, preconditions are a useful tool for drastically limiting the amount of actions that should be considered. 2.4 Regression-based Belief Maintenance Updating a belief can be costly. Alternatively, one can avoid the computation of new formulas representing the updated belief, by maintaining only the initial belief formula, and the history —the sequence of executed actions and sensed observations [5]. When the agent needs to query whether the preconditions of an action or the goal hold at the current node, the formula is regressed [20] through the action observation sequence back towards the initial belief. Then, one can apply SAT queries to check whether the query formula holds. We now briefly review the regression process for deterministic actions. This approach can be highly useful for larger POMDPs, complementing the particle filter approach used in POMCP. Regression maintains the equivalence of the formula [20, 5]. For any two formulas φ1 and φ2 we have: Hence, we can produce a regression over formulas, and compare the regressed formulas, making conclusions about the original formulas. The regression can be recursively applied to a sequence of actions and observations (history) h as follows: where ε is the empty sequence. This allows us to perform a regression of a formula through an entire plan, and analyze the required conditions for a plan to apply. In addition, the regression mechanism of [5] maintains a cached list of fluents F(n) that are known to hold at node n, given the action effects or observations. Following an actuation action a, F(a(n)) contains all fluents in F(n) that were not modified by a, as well as effects of a that are not conditioned on hidden fluents. For a sensing action revealing the value l, F(a(n,l)) = F(n) ∪ {l}. During future regression queries, when a value at a particular node becomes known, e.g. when regressing a later observation, it is added to F(n). All fluents p such that p ∈/ F(n)∧ ¬p ∈/ F(n) are said to be hidden at n. The cached list is useful for simplifying future regressed formulas. This paper is available on arxiv under CC 4.0 license. Authors: (1) Oded Blumenthal, Software and Information Systems Engineering, Ben Gurion University, Israel; (2) Guy Shani, Software and Information Systems Engineering, Ben Gurion University, Israel. This paper is available on arxiv under CC 4.0 license. Authors: Authors: (1) Oded Blumenthal, Software and Information Systems Engineering, Ben Gurion University, Israel; (2) Guy Shani, Software and Information Systems Engineering, Ben Gurion University, Israel. Table of Links Introduction Background Related Work POMCP for Stochastic Contingent Planning Domain Independent Heuristics for POMCP Empirical Evaluation Conclusion and References Introduction Introduction Background Background Related Work Related Work POMCP for Stochastic Contingent Planning POMCP for Stochastic Contingent Planning Domain Independent Heuristics for POMCP Domain Independent Heuristics for POMCP Empirical Evaluation Empirical Evaluation Conclusion and References Conclusion and References 2 Background We now provide the required background on POMDPs, contingent planning, domain-independent heuristics, and the POMCP algorithm. 2.1 POMDPs Because the state of a POMDP is partially observable, the agent typically does not know what the true underlying state of the world is. Hence, it can maintain a belief state b, which is a distribution over S, i.e., b(s) is the likelihood that s is the current state. When a goal belief is reached, that is sums∈Gb(s) = 1, then the agent is sure that it is at a goal state, and the execution terminates. A solution to a POMDP, called a policy, is a function that assigns an action to every belief state. The optimal policy minimizes the expected cost, i.e., the expected number of steps before a goal belief has been reached. 2.2 POMCP The Partially Observable Monte-Carlo Planning (POMCP) online re-planning approach uses a Monte Carlo tree search (MCTS) approach to select the next action to execute [27]. At each re-planning episode POMCP constructs a tree, where the root node is the current belief state. Then, POMCP runs forward simulations, where a state is sampled from the current belief, and actions are chosen using an exploration strategy that initially selects actions that were not executed a sufficient amount of times, but gradually moves to select the seemingly best action. Observations in the simulations are selected based on the current state-action observation distribution. When reaching a leaf node, POMCP begins a so-called rollout. This rollout is designed to provide a value estimate for the leaf, based on some predefined rollout policy. The value of the leaf is updated using the outcome of the rollout, and then the values of the nodes along the branch that were visited during the simulation are updated given their descendants. Obviously, the values of all nodes in the tree are hence highly dependent on the values obtained by the rollout policy. POMCP is an anytime algorithm, that is, it continues to run simulations until a timeout, and then returns the action that seems best at the root of the search tree. POMCP was designed for large problems. Hence, POMCP does not maintain and update a belief state explicitly. Instead, POMCP uses a particle filter approach, where a set of states is sampled at the initial belief, and this set is progressed through the tree. 2.3 Contingent Planning under Partial Observability Preconditions allow us to restrict our attention only to applicable actions. An action is applicable in a belief b is all possible states in b satisfy the preconditions of the action. Obviously, one can avoid specifying preconditions for actions, allowing for actions that can always be executed, as is typically the case in flat POMDP representations. However, in domains with many actions, preconditions are a useful tool for drastically limiting the amount of actions that should be considered. 2.4 Regression-based Belief Maintenance Updating a belief can be costly. Alternatively, one can avoid the computation of new formulas representing the updated belief, by maintaining only the initial belief formula, and the history —the sequence of executed actions and sensed observations [5]. When the agent needs to query whether the preconditions of an action or the goal hold at the current node, the formula is regressed [20] through the action observation sequence back towards the initial belief. Then, one can apply SAT queries to check whether the query formula holds. We now briefly review the regression process for deterministic actions. This approach can be highly useful for larger POMDPs, complementing the particle filter approach used in POMCP. Regression maintains the equivalence of the formula [20, 5]. For any two formulas φ1 and φ2 we have: Hence, we can produce a regression over formulas, and compare the regressed formulas, making conclusions about the original formulas. The regression can be recursively applied to a sequence of actions and observations (history) h as follows: where ε is the empty sequence. This allows us to perform a regression of a formula through an entire plan, and analyze the required conditions for a plan to apply. In addition, the regression mechanism of [5] maintains a cached list of fluents F(n) that are known to hold at node n, given the action effects or observations. Following an actuation action a, F(a(n)) contains all fluents in F(n) that were not modified by a, as well as effects of a that are not conditioned on hidden fluents. For a sensing action revealing the value l, F(a(n,l)) = F(n) ∪ {l}. During future regression queries, when a value at a particular node becomes known, e.g. when regressing a later observation, it is added to F(n). All fluents p such that p ∈/ F(n)∧ ¬p ∈/ F(n) are said to be hidden at n. The cached list is useful for simplifying future regressed formulas.

Rollout Heuristics for Online Stochastic Contingent Planning: Background

Introduction Late in 2023, I was considering writing an article about Acorn Labs' work simplifying Kubernetes containers. I even started it and wrote a few paragraphs, but then I got busy with other things. At the time, I was going to revisit it in February 2024, they made a couple of announcements; one was for Rubra, and the other was more of a personal project by one of the co-founders, Darren Shepherd, called GPTScript. This project was so exciting that a month later, Acorn announced they were changing their company focus to GPTScript (not sure what would happen to Rubra). I’ve been following all the developments on this project, closer than I typically do, because I find it absolutely amazing as enablement technology. It reminds me of the philosophy behind a product I worked with back in the 80s and 90s called MPEX from VESOFT, written by Eugen Volokh. What Darren has done with GPTScript is kind of hard to wrap your head around at first, especially for a programmer. I haven’t spent enough time with it yet to fully understand all the implications, but I have a lot of thoughts about it. In this article, I’ll walk through some basic introductions and examples and give you some thoughts about where you could take it. Getting Started I worked off the docs and various videos and examples; I gave this a go on my Windows 11 laptop. Let’s get this sucker installed: winget install gptscript-ai.gptscript
$env:OPENAI_API_KEY = 'your-api-key' The docs suggest running a “hello world” example at this point, but that isn’t very interesting, so let’s try the “bob” example. Also, note that there are many built-in examples you can get a list of by issuing the gptscript—-list-tools command and an online ‘examples’ directory. What does “bob.gpt” look like? This presents us with some obvious questions, like what this all means and how a value of ‘How are you doing?’ ended up in the ‘question’ argument. GPTScript operates around the notion of tools where a tool is described in a GPT file. Each file can be made up of more than one named tool, separated by three dashes. Borrowing from the docs, Tool parameters are key-value pairs defined at the beginning of a tool block before any instructional text. They are specified in the format key: value. The parser recognizes the following keys (case-insensitive and spaces are ignored): A tool starts with a preamble that defines the tool's name, description, args, available tools, and additional parameters. The preamble is followed by the tool's body, which contains the instructions for the tool. Comments in the preamble are lines starting with # and are ignored by the parser. Comments are not really encouraged as the text is typically more useful in the description, argument descriptions, or instructions. I’m still not sure why Bob was giving a default value for the argument. It would change if I gave it an argument, so that was a bit of a mystery. I decided to try the samples-readme.gpt script, which looks like this: Reading this, I understood that it would give me a summary of each gpt file in the examples directory. When I first tried it without an argument, it failed to find any input, so I tried with an example file as an argument, and it worked. Then I tried it with their larger example script for hacker-news-headlines, and instead, it did what I thought it should have done the first time. It created a readme.md file in the examples directory with a summary of each example. I’ve seen people in the community starting to generate some very cool tools that are being added to the GPTScript tools web page. I had a little bit of mixed results with my tests. Most things worked as expected, but I had a few things that didn’t, and I didn’t have the opportunity to dig deeper. That said, this is clearly powerful, and it is just scratching the surface. Summary As a lifelong programmer, this feels weird; it involves doing things in ways that seem like something is missing. This makes GPTScript fascinating and scary as if black magic is involved somehow. The natural language and loose feel of it take a little getting used to, but as you think about it, you start to realize how amazing this can be as an enablement technology. One of the first things that came to mind, but I didn’t test, was could this be used to drive OpenFoam? OpenFoam is open-source CFD software that is rather notorious for how difficult it is to use, which is why I never learned how to use it. What if I could just describe what I wanted to do with it, and it worked? Imagine doing this with any software with an API you could talk to. My mind starts to explode thinking about it. Acorn has created an online “tools” catalog that you can utilize, and they are iterating at an insane pace. This is really exciting. Check out my other What the Heck is… articles at the links below: What The Heck Is DuckDB?
What the Heck Is Malloy?
What the Heck is PRQL?
What the Heck is GlareDB?
What the Heck is SeaTunnel?
What the Heck is LanceDB?
What the heck is SDF?
What the Heck is Paimon?
What the Heck is Proton?
What the Heck is PuppyGraph? Introduction Introduction Late in 2023, I was considering writing an article about Acorn Labs ' work simplifying Kubernetes containers. I even started it and wrote a few paragraphs, but then I got busy with other things. At the time, I was going to revisit it in February 2024, they made a couple of announcements; one was for Rubra, and the other was more of a personal project by one of the co-founders, Darren Shepherd , called GPTScript . Acorn Labs Acorn Labs Darren Shepherd Darren Shepherd GPTScript GPTScript This project was so exciting that a month later, Acorn announced they were changing their company focus to GPTScript (not sure what would happen to Rubra). announced announced I’ve been following all the developments on this project, closer than I typically do, because I find it absolutely amazing as enablement technology. It reminds me of the philosophy behind a product I worked with back in the 80s and 90s called MPEX from VESOFT, written by Eugen Volokh. What Darren has done with GPTScript is kind of hard to wrap your head around at first, especially for a programmer. I haven’t spent enough time with it yet to fully understand all the implications, but I have a lot of thoughts about it. In this article, I’ll walk through some basic introductions and examples and give you some thoughts about where you could take it. Getting Started I worked off the docs and various videos and examples; I gave this a go on my Windows 11 laptop. Let’s get this sucker installed: docs docs winget install gptscript-ai.gptscript
$env:OPENAI_API_KEY = 'your-api-key' winget install gptscript-ai.gptscript
$env:OPENAI_API_KEY = 'your-api-key' The docs suggest running a “hello world” example at this point, but that isn’t very interesting, so let’s try the “bob” example. Also, note that there are many built-in examples you can get a list of by issuing the gptscript—-list-tools command and an online ‘ examples ’ directory. examples examples What does “bob.gpt” look like? This presents us with some obvious questions, like what this all means and how a value of ‘How are you doing?’ ended up in the ‘question’ argument. GPTScript operates around the notion of tools where a tool is described in a GPT file. Each file can be made up of more than one named tool, separated by three dashes. tools Borrowing from the docs, Tool parameters are key-value pairs defined at the beginning of a tool block before any instructional text. They are specified in the format key: value. The parser recognizes the following keys (case-insensitive and spaces are ignored): Tool parameters are key-value pairs defined at the beginning of a tool block before any instructional text. They are specified in the format key: value. The parser recognizes the following keys (case-insensitive and spaces are ignored): A tool starts with a preamble that defines the tool's name, description, args, available tools, and additional parameters. The preamble is followed by the tool's body, which contains the instructions for the tool. Comments in the preamble are lines starting with # and are ignored by the parser. Comments are not really encouraged as the text is typically more useful in the description, argument descriptions, or instructions. A tool starts with a preamble that defines the tool's name, description, args, available tools, and additional parameters. The preamble is followed by the tool's body, which contains the instructions for the tool. Comments in the preamble are lines starting with # and are ignored by the parser. Comments are not really encouraged as the text is typically more useful in the description, argument descriptions, or instructions. I’m still not sure why Bob was giving a default value for the argument. It would change if I gave it an argument, so that was a bit of a mystery. I decided to try the samples-readme.gpt script, which looks like this: Bob samples-readme.gpt Reading this, I understood that it would give me a summary of each gpt file in the examples directory. When I first tried it without an argument, it failed to find any input, so I tried with an example file as an argument, and it worked. Then I tried it with their larger example script for hacker-news-headlines , and instead, it did what I thought it should have done the first time. It created a readme.md file in the examples directory with a summary of each example. hacker-news-headlines readme.md I’ve seen people in the community starting to generate some very cool tools that are being added to the GPTScript tools web page. I had a little bit of mixed results with my tests. Most things worked as expected, but I had a few things that didn’t, and I didn’t have the opportunity to dig deeper. That said, this is clearly powerful, and it is just scratching the surface. Summary As a lifelong programmer, this feels weird; it involves doing things in ways that seem like something is missing. This makes GPTScript fascinating and scary as if black magic is involved somehow. The natural language and loose feel of it take a little getting used to, but as you think about it, you start to realize how amazing this can be as an enablement technology. One of the first things that came to mind, but I didn’t test, was could this be used to drive OpenFoam ? OpenFoam is open-source CFD software that is rather notorious for how difficult it is to use, which is why I never learned how to use it. What if I could just describe what I wanted to do with it, and it worked? Imagine doing this with any software with an API you could talk to. OpenFoam OpenFoam My mind starts to explode thinking about it. Acorn has created an online “ tools ” catalog that you can utilize, and they are iterating at an insane pace. This is really exciting. tools tools Check out my other What the Heck is… articles at the links below: What The Heck Is DuckDB? What the Heck Is Malloy? What the Heck is PRQL? What the Heck is GlareDB? What the Heck is SeaTunnel? What the Heck is LanceDB? What the heck is SDF? What the Heck is Paimon? What the Heck is Proton? What the Heck is PuppyGraph? What The Heck Is DuckDB? What The Heck Is DuckDB? What the Heck Is Malloy? What the Heck Is Malloy? What the Heck is PRQL? What the Heck is PRQL? What the Heck is GlareDB? What the Heck is GlareDB? What the Heck is SeaTunnel? What the Heck is SeaTunnel? What the Heck is LanceDB? What the Heck is LanceDB? What the heck is SDF? What the heck is SDF? What the Heck is Paimon? What the Heck is Paimon? What the Heck is Proton? What the Heck is Proton? What the Heck is PuppyGraph? What the Heck is PuppyGraph?

What the Heck Is GPTScript?

The Simple Storage Service (S3) protocol is a standard interface developed by Amazon Web Services (AWS) for storing and retrieving data in the cloud. It’s a key-value store, meaning that each piece of data (an object) is associated with a unique identifier (a key) that you use to access that data. The S3 protocol is crucial in cloud storage services for several reasons: ScalabilityS3 allows for virtually unlimited storage, making it ideal for applications that need to scale rapidly or handle large amounts of data.
Durability and AvailabilityS3 is designed for 99.999999999% (11 9’s) of durability, meaning the chances of losing data are extremely low. It also guarantees 99.99% availability, ensuring that your data is accessible when you need it.
SecurityS3 provides robust security features, including encryption for data at rest and in transit, access control policies, and logging capabilities.
InteroperabilityMany cloud storage providers, not just AWS, support the S3 protocol, making it a versatile choice for developers.
Cost-EffectiveWith S3, you only pay for the storage you use, making it a cost-effective solution for businesses of all sizes. In summary, the S3 protocol is a reliable, secure, and scalable solution for storing data in the cloud, making it a cornerstone of modern cloud-based applications. Setting Up Go Environment install AWS SDK into our project go get github.com/aws/aws-sdk-go-v2/aws
go get github.com/aws/aws-sdk-go-v2/config
go get github.com/aws/aws-sdk-go-v2/credentials
go get github.com/aws/aws-sdk-go-v2/feature/s3/manager
go get github.com/aws/aws-sdk-go-v2/service/s3 Simple project to upload file AWS SDK Wrapper package s3client

import (
 "context"
 "github.com/aws/aws-sdk-go-v2/aws"
 "github.com/aws/aws-sdk-go-v2/config"
 "github.com/aws/aws-sdk-go-v2/credentials"
 "github.com/aws/aws-sdk-go-v2/feature/s3/manager"
 "github.com/aws/aws-sdk-go-v2/service/s3"
 "io"
 "log"
 "sync"
)

var (
 uploader *manager.Uploader
 once     sync.Once
)

func setup() {
 endpoint := "http://s3-test-endpoint.com"
 accessKey := "XVXQ8Q3QGQ9QXQ8QXQ8Q"
 secretKey := "/XQ8Q3QGQ9QXQ8QXQ8QXQ/Q3QGQ9QXQ8QXQ8QXQ8"

 resolver := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {
  return aws.Endpoint{
   URL:               endpoint,
   HostnameImmutable: true,
   Source:            aws.EndpointSourceCustom,
  }, nil
 })
 awsConfig, err := config.LoadDefaultConfig(context.TODO(),
  config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(accessKey, secretKey, "")),
  config.WithEndpointResolverWithOptions(resolver),
  config.WithRegion("auto"),
 )
 if err != nil {
  log.Fatalf("failed to load config, %v", err)
 }

 uploader = manager.NewUploader(s3.NewFromConfig(awsConfig)) // Initialize S3 client
}

func UploadFile(ctx context.Context, bucket, filename string, file io.Reader) (string, error) {
 once.Do(setup)
 result, err := uploader.Upload(ctx, &s3.PutObjectInput{
  Bucket: aws.String(bucket),
  Key:    aws.String(filename),
  Body:   file,
  ACL:    "public-read",
 })
 if err != nil {
  log.Fatalf("failed to upload file, %v", err)
 }

 return result.Location, nil
} Why we need to wrap third-party library? The purpose wrapper is to simplify the library’s interface, adapt it to fit our application’s specific needs, or add additional functionality. In this case we simplifies the process of uploading a file to S3 by providing a single UploadFile function that handles the setup and upload process. This makes it easier for the rest of our application to upload files to S3, as it only needs to call s3client.UploadFile with the appropriate parameters. Anyway, let’s explain the code a little bit We need to setup our project to connect with the cloud storage services, in the setupfunction there is 2 key steps that we need to highlight. First, in resolver parameter we need to pass aws.EndpointSourceCustomto indicate we didn’t connect to AWS endpoint. Secondly,config.WithRegion("auto")when load default config. Then in UploadFile function we use once.Do(setup) to make sure setup function only called once. Main Function We will create simple server using chi, then create POST API to upload file to our S3 Cloud Storage. Also Hello World endpoint to make sure our server is working 😆. package main

import (
 "github.com/go-chi/chi/v5"
 "github.com/yudaph/s3-integration/s3client"
 "net/http"
)

func main() {
 r := chi.NewRouter()

 r.Get("/", func(w http.ResponseWriter, r *http.Request) {
  w.Write([]byte("Hello, World!"))
 })

 r.Post("/", HandleUpload)
 http.ListenAndServe(":8080", r)
}

func HandleUpload(w http.ResponseWriter, r *http.Request) {
 file, header, err := r.FormFile("image")
 if err != nil {
  http.Error(w, err.Error(), http.StatusBadRequest)
  return
 }
 defer file.Close()

 // TODO: Do Validation

 // Upload file to S3
 filename := "suffix_" + header.Filename
 url, err := s3client.UploadFile(r.Context(), "bucket-name", filename, file)
 if err != nil {
  http.Error(w, err.Error(), http.StatusInternalServerError)
  return
 }

 w.Write([]byte(url))
} Let’s explain the HandleUploadfunction: We will use r.FormFile("image") to get file from request, in other framework like mux and fiber we only get the header, so if we need to use header.Open() to get the file from header(CMIIW). Then do some validation, after that we simply call our wrapper function s3client.UploadFile to upload to our cloud storage. Conclusion In this article we learn about S3 protocol, how to Integrate with Non-AWS Cloud Storage Service that supports S3 protocol, and a little bit about wrapper. Hopefully, this article can be helpful. Don’t hesitate to give criticism and suggestions if you find any mistakes in this article. Let’s connect on https://www.linkedin.com/in/yudaph/ and https://github.com/yudaph Note: artikel berbahasa indonesia dapat ditemukan di https://medium.com/@yudaph/panduan-untuk-mengintegrasikan-dengan-layanan-cloud-storage-non-aws-yang-mendukung-protokol-s3-20624638911a The Simple Storage Service (S3) protocol is a standard interface developed by Amazon Web Services (AWS) for storing and retrieving data in the cloud. It’s a key-value store, meaning that each piece of data (an object) is associated with a unique identifier (a key) that you use to access that data. The S3 protocol is crucial in cloud storage services for several reasons: ScalabilityS3 allows for virtually unlimited storage, making it ideal for applications that need to scale rapidly or handle large amounts of data. Durability and AvailabilityS3 is designed for 99.999999999% (11 9’s) of durability, meaning the chances of losing data are extremely low. It also guarantees 99.99% availability, ensuring that your data is accessible when you need it. SecurityS3 provides robust security features, including encryption for data at rest and in transit, access control policies, and logging capabilities. InteroperabilityMany cloud storage providers, not just AWS, support the S3 protocol, making it a versatile choice for developers. Cost-EffectiveWith S3, you only pay for the storage you use, making it a cost-effective solution for businesses of all sizes. Scalability S3 allows for virtually unlimited storage, making it ideal for applications that need to scale rapidly or handle large amounts of data. Durability and Availability S3 is designed for 99.999999999% (11 9’s) of durability, meaning the chances of losing data are extremely low. It also guarantees 99.99% availability, ensuring that your data is accessible when you need it. Security S3 provides robust security features, including encryption for data at rest and in transit, access control policies, and logging capabilities. Interoperability Many cloud storage providers, not just AWS, support the S3 protocol, making it a versatile choice for developers. Cost-Effective With S3, you only pay for the storage you use, making it a cost-effective solution for businesses of all sizes. In summary, the S3 protocol is a reliable, secure, and scalable solution for storing data in the cloud, making it a cornerstone of modern cloud-based applications. Setting Up Go Environment install AWS SDK into our project go get github.com/aws/aws-sdk-go-v2/aws
go get github.com/aws/aws-sdk-go-v2/config
go get github.com/aws/aws-sdk-go-v2/credentials
go get github.com/aws/aws-sdk-go-v2/feature/s3/manager
go get github.com/aws/aws-sdk-go-v2/service/s3 go get github.com/aws/aws-sdk-go-v2/aws
go get github.com/aws/aws-sdk-go-v2/config
go get github.com/aws/aws-sdk-go-v2/credentials
go get github.com/aws/aws-sdk-go-v2/feature/s3/manager
go get github.com/aws/aws-sdk-go-v2/service/s3 Simple project to upload file AWS SDK Wrapper package s3client

import (
 "context"
 "github.com/aws/aws-sdk-go-v2/aws"
 "github.com/aws/aws-sdk-go-v2/config"
 "github.com/aws/aws-sdk-go-v2/credentials"
 "github.com/aws/aws-sdk-go-v2/feature/s3/manager"
 "github.com/aws/aws-sdk-go-v2/service/s3"
 "io"
 "log"
 "sync"
)

var (
 uploader *manager.Uploader
 once     sync.Once
)

func setup() {
 endpoint := "http://s3-test-endpoint.com"
 accessKey := "XVXQ8Q3QGQ9QXQ8QXQ8Q"
 secretKey := "/XQ8Q3QGQ9QXQ8QXQ8QXQ/Q3QGQ9QXQ8QXQ8QXQ8"

 resolver := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {
  return aws.Endpoint{
   URL:               endpoint,
   HostnameImmutable: true,
   Source:            aws.EndpointSourceCustom,
  }, nil
 })
 awsConfig, err := config.LoadDefaultConfig(context.TODO(),
  config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(accessKey, secretKey, "")),
  config.WithEndpointResolverWithOptions(resolver),
  config.WithRegion("auto"),
 )
 if err != nil {
  log.Fatalf("failed to load config, %v", err)
 }

 uploader = manager.NewUploader(s3.NewFromConfig(awsConfig)) // Initialize S3 client
}

func UploadFile(ctx context.Context, bucket, filename string, file io.Reader) (string, error) {
 once.Do(setup)
 result, err := uploader.Upload(ctx, &s3.PutObjectInput{
  Bucket: aws.String(bucket),
  Key:    aws.String(filename),
  Body:   file,
  ACL:    "public-read",
 })
 if err != nil {
  log.Fatalf("failed to upload file, %v", err)
 }

 return result.Location, nil
} package s3client

import (
 "context"
 "github.com/aws/aws-sdk-go-v2/aws"
 "github.com/aws/aws-sdk-go-v2/config"
 "github.com/aws/aws-sdk-go-v2/credentials"
 "github.com/aws/aws-sdk-go-v2/feature/s3/manager"
 "github.com/aws/aws-sdk-go-v2/service/s3"
 "io"
 "log"
 "sync"
)

var (
 uploader *manager.Uploader
 once     sync.Once
)

func setup() {
 endpoint := "http://s3-test-endpoint.com"
 accessKey := "XVXQ8Q3QGQ9QXQ8QXQ8Q"
 secretKey := "/XQ8Q3QGQ9QXQ8QXQ8QXQ/Q3QGQ9QXQ8QXQ8QXQ8"

 resolver := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {
  return aws.Endpoint{
   URL:               endpoint,
   HostnameImmutable: true,
   Source:            aws.EndpointSourceCustom,
  }, nil
 })
 awsConfig, err := config.LoadDefaultConfig(context.TODO(),
  config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(accessKey, secretKey, "")),
  config.WithEndpointResolverWithOptions(resolver),
  config.WithRegion("auto"),
 )
 if err != nil {
  log.Fatalf("failed to load config, %v", err)
 }

 uploader = manager.NewUploader(s3.NewFromConfig(awsConfig)) // Initialize S3 client
}

func UploadFile(ctx context.Context, bucket, filename string, file io.Reader) (string, error) {
 once.Do(setup)
 result, err := uploader.Upload(ctx, &s3.PutObjectInput{
  Bucket: aws.String(bucket),
  Key:    aws.String(filename),
  Body:   file,
  ACL:    "public-read",
 })
 if err != nil {
  log.Fatalf("failed to upload file, %v", err)
 }

 return result.Location, nil
} Why we need to wrap third-party library? The purpose wrapper is to simplify the library’s interface, adapt it to fit our application’s specific needs, or add additional functionality. In this case we simplifies the process of uploading a file to S3 by providing a single UploadFile function that handles the setup and upload process. This makes it easier for the rest of our application to upload files to S3, as it only needs to call s3client.UploadFile with the appropriate parameters. UploadFile s3client.UploadFile Anyway, let’s explain the code a little bit Anyway, let’s explain the code a little bit We need to setup our project to connect with the cloud storage services, in the setup function there is 2 key steps that we need to highlight. setup First, in resolver parameter we need to pass aws.EndpointSourceCustom to indicate we didn’t connect to AWS endpoint. resolver aws.EndpointSourceCustom Secondly, config.WithRegion("auto") when load default config. config.WithRegion("auto") Then in UploadFile function we use once.Do(setup) to make sure setup function only called once. UploadFile once.Do(setup) Main Function We will create simple server using chi , then create POST API to upload file to our S3 Cloud Storage. Also Hello World endpoint to make sure our server is working 😆. chi POST package main

import (
 "github.com/go-chi/chi/v5"
 "github.com/yudaph/s3-integration/s3client"
 "net/http"
)

func main() {
 r := chi.NewRouter()

 r.Get("/", func(w http.ResponseWriter, r *http.Request) {
  w.Write([]byte("Hello, World!"))
 })

 r.Post("/", HandleUpload)
 http.ListenAndServe(":8080", r)
}

func HandleUpload(w http.ResponseWriter, r *http.Request) {
 file, header, err := r.FormFile("image")
 if err != nil {
  http.Error(w, err.Error(), http.StatusBadRequest)
  return
 }
 defer file.Close()

 // TODO: Do Validation

 // Upload file to S3
 filename := "suffix_" + header.Filename
 url, err := s3client.UploadFile(r.Context(), "bucket-name", filename, file)
 if err != nil {
  http.Error(w, err.Error(), http.StatusInternalServerError)
  return
 }

 w.Write([]byte(url))
} package main

import (
 "github.com/go-chi/chi/v5"
 "github.com/yudaph/s3-integration/s3client"
 "net/http"
)

func main() {
 r := chi.NewRouter()

 r.Get("/", func(w http.ResponseWriter, r *http.Request) {
  w.Write([]byte("Hello, World!"))
 })

 r.Post("/", HandleUpload)
 http.ListenAndServe(":8080", r)
}

func HandleUpload(w http.ResponseWriter, r *http.Request) {
 file, header, err := r.FormFile("image")
 if err != nil {
  http.Error(w, err.Error(), http.StatusBadRequest)
  return
 }
 defer file.Close()

 // TODO: Do Validation

 // Upload file to S3
 filename := "suffix_" + header.Filename
 url, err := s3client.UploadFile(r.Context(), "bucket-name", filename, file)
 if err != nil {
  http.Error(w, err.Error(), http.StatusInternalServerError)
  return
 }

 w.Write([]byte(url))
} Let’s explain the HandleUpload function: HandleUpload We will use r.FormFile("image") to get file from request, in other framework like mux and fiber we only get the header , so if we need to use header.Open() to get the file from header (CMIIW). r.FormFile("image") mux fiber header header.Open() file header Then do some validation, after that we simply call our wrapper function s3client.UploadFile to upload to our cloud storage. s3client.UploadFile Conclusion In this article we learn about S3 protocol, how to Integrate with Non-AWS Cloud Storage Service that supports S3 protocol, and a little bit about wrapper. Hopefully, this article can be helpful. Don’t hesitate to give criticism and suggestions if you find any mistakes in this article. Let’s connect on https://www.linkedin.com/in/yudaph/ and https://github.com/yudaph https://www.linkedin.com/in/yudaph/ https://github.com/yudaph Note: artikel berbahasa indonesia dapat ditemukan di https://medium.com/@yudaph/panduan-untuk-mengintegrasikan-dengan-layanan-cloud-storage-non-aws-yang-mendukung-protokol-s3-20624638911a https://medium.com/@yudaph/panduan-untuk-mengintegrasikan-dengan-layanan-cloud-storage-non-aws-yang-mendukung-protokol-s3-20624638911a

Guide to Integrating With Non-AWS Cloud Storage Services Supporting the S3 Protocol using Golang 

Medical Software Testing 101: Advice to Consider for Upgrading Patient Experiences 

Governance, Risk, and Compliance (GRC) policies in digital business encompass integrated practices that ensure that your processes align with regulations, industry standards, and internal policies. Most commonly it refers to governance structures, risk management, and compliance measures. The regulatory part of the digital landscape evolves dynamically and leans towards tightening measures, at the same time, risks and error costs continue to rise. This is why creating a specific GRC strategy is essential for digital businesses. In this article, we will talk about key components and best practices for implementing a successful and suitable GRC strategy for a digital business. Key Components of an Effective GRC Strategy GRC is a complex and nuanced domain where the same strategy may work perfectly for one organization and be ruinous for another. However, there are common guidelines to follow, which allow for the creation of a successful GRC strategy that is tailored to your specific business needs. Establishing governance frameworks Governance frameworks play a vital role in defining responsibilities within your organization and empowering decision-makers at different levels. This typically involves clearly outlining roles and responsibilities, creating relevant documentation and company regulations, aligning these regulations with business goals and ensuring all employees are familiar with them. Identifying and Assessing Risks Risk management is a crucial aspect of a GRC strategy for various reasons. Conducting proper risk assessments and pondering their mitigation can save businesses significant costs by preventing potential accidents, rather than dealing with their consequences. For effectiveness, risk assessments need to focus on high-impact risks, and be conducted regularly and systematically. You can use AI tools to enhance risk analysis and assessment by identifying potential blind spots, gaps and increased human factor-related risks. This proactive approach helps in safeguarding the organization against potential threats and ensures resilience and sustainability. Implementing Compliance Programs Implementing compliance programs is about ensuring that the organization adheres to relevant laws, regulations, standards, and ethical practices. The important factor here is not to make these processes inflexible which renders them unable to accommodate frequent and ever changing legal requirements . It is recommended not only to consider the current regulations but also stay alert for forthcoming ones, preparing for them in advance and gradually, to ensure that any changes don't come as sudden disruptions for your company. Integrating GRC into Organizational Culture Integrating GRC into organizational culture is essential. Merely creating a GRC policy is insufficient if it isn’t integrated into daily routines and behaviors of employees at all levels of your organization. Only when GRC becomes a part of the organizational DNA does it become truly effective. The key point here is to understand how regulations translate into actual activities. Aligning GRC Efforts with Business Objectives A GRC strategy should never be detached from your company’s business goals, mission and values. In fact, it should actually support and add value to them. This alignment means that setting GRC priorities needs to be directly linked to key business objectives, ensuring resources are focused on areas of highest impact. 8 Steps to a Successful GRC Strategy Now, from theory to practice. The following steps aid us and our clients in developing a functional GRC strategy that doesn’t deplete the security budget, remains transparent for performance assessment and is scalable and flexible. Decide on the use of GRC Platform This is where it is absolutely crucial to do your homework. Research and compare off-the-shelf solutions that are available on the market from the point of view of whether or not they cover all your GRC needs and determine if additional complementary tools are needed. Sometimes, it is worth investing in a custom GRC solution that is tailored to fit your particular GRC demands rather than try and make do with generic solutions that may leave certain areas uncovered. Consult with compliance and GRC experts and involve your solution architects in the decision-making process to select the best option. Create a GRC Project Roadmap Set your priorities and present them in the form of defined milestones and timelines. Make sure they are realistic and are broken down into manageable phases. Then assign responsibilities for the tasks on the timeline you’ve created. Make them transparent and avoid situations where too many cooks can spoil the broth. Communicate the plan to everyone involved. Perform a Gap Analysis This stage involved identifying the existing GRC processes and evaluating them against your roadmap objectives. Then compare your current practices against industry standards, regulatory requirements, and best practices. Once you’ve identified the gaps, prioritize them based on their risk and impact on your business, and plan actions to address them. Determine and Align Stakeholder Expectations Stakeholder engagement is essential for carrying out effective GRC policies. Make sure it starts at the earliest stages. If you have to (and you probably will), plan meetings to discuss and align on the GRC strategy's goals, priorities, and outcomes. Don’t stop there, you need to keep the stakeholders in the loop of all the GRC-related developments, gather and analyze their feedback and ensure their active participation in decision-making. Define the Objectives Use the SMART objectives-setting technique. SMART stands for Specific, Measurable, Achievable, Relevant, and Time-bound and this abbreviation perfectly reflects the qualities that should define your GRC tasks. Incorporating regular reviews and feedback loops into GRC objectives is crucial for ensuring their effectiveness. Conduct a Comprehensive Organizational Risk Assessment Use a structured framework to conduct risk assessment activities. Another great tip here would be to maximize the use of existing resources such as leveraging the cross-functional expertise within your team. You may already have a compliance expert within your organization potentially working on other projects. Keep a comprehensive log or a documentation of all identified risks with set priorities and mitigation options. Standardization Standardization is key to maintaining consistency and effectiveness in your GRC policies. By standardizing procedures, training, and onboarding processes, you ensure that rules are interpreted uniformly across the organization. Develop a comprehensive set of GRC training materials and procedures making it mandatory for employees to be familiar with them.  Consider incorporating GRC clauses into employment contracts to reinforce compliance. Additionally, adopt and implement industry best practices tailored to your business structure. Conduct regular training and workshops to increase awareness of your GRC policies and keep employees updated on its developments. Management and Revision The process of refining your GRC policies is ongoing. This ensures its scalability, flexibility and alignment with industry standards. So, monitor it, conduct performance checks, gather feedback and identify improvement areas on a regular basis. Best Practices in Creating a Working GRC Policies Besides understanding the steps for creating and implementing GRC policies tailored to your business, here are some tips to ensure its effective execution. Starting small, simple, and focused No need to roll-out a huge-scale system that will complicate matters for your company. Start small, try out, build on it and expand gradually. Keep the focus on high-impact factors. Leadership commitment Cultivate initiative within your leadership by openly communicating GRC principles throughout the organization. Emphasize that these principles are fundamental to the company’s long-term success and reputation. Prioritize risk and compliance activities At an enterprise level, this is what quantifies the value achieved at each stage of your GRC policy implementation. Engage your employees This is where you can get creative. It could be interactive training sessions on ethical decision-making, workshops on identifying and mitigating risks in your workers’ operations, and forums for discussing compliance challenges. Do not forget to encourage feedback and show you value it. Introduce proper incentives You can revise your company’s performance appraisal system to include GRC-related metrics. Your employees can be rewarded not just for achieving business targets but also for demonstrating adherence to compliance standards, ethical behavior, and effective risk management in their tasks. Conclusion Well-planned and implemented GRC strategy is crucial for success in today's digital business landscape. By establishing a robust operational framework, organizations can achieve regulatory compliance, effectively manage risks, improve efficiency, safeguard their reputation, and make informed strategic decisions. Furthermore, fostering a culture of GRC awareness among stakeholders promotes a sense of collective responsibility and accountability, encouraging an environment of cohesion and resilience. Governance, Risk, and Compliance (GRC) policies in digital business encompass integrated practices that ensure that your processes align with regulations, industry standards, and internal policies. Most commonly it refers to governance structures, risk management, and compliance measures. The regulatory part of the digital landscape evolves dynamically and leans towards tightening measures, at the same time, risks and error costs continue to rise. This is why creating a specific GRC strategy is essential for digital businesses. In this article, we will talk about key components and best practices for implementing a successful and suitable GRC strategy for a digital business. Key Components of an Effective GRC Strategy GRC is a complex and nuanced domain where the same strategy may work perfectly for one organization and be ruinous for another. However, there are common guidelines to follow, which allow for the creation of a successful GRC strategy that is tailored to your specific business needs. Establishing governance frameworks Establishing governance frameworks Establishing governance frameworks Governance frameworks play a vital role in defining responsibilities within your organization and empowering decision-makers at different levels. This typically involves clearly outlining roles and responsibilities, creating relevant documentation and company regulations, aligning these regulations with business goals and ensuring all employees are familiar with them. Identifying and Assessing Risks Identifying and Assessing Risks Identifying and Assessing Risks Identifying and Assessing Risks Risk management is a crucial aspect of a GRC strategy for various reasons. Conducting proper risk assessments and pondering their mitigation can save businesses significant costs by preventing potential accidents, rather than dealing with their consequences. For effectiveness, risk assessments need to focus on high-impact risks, and be conducted regularly and systematically. You can use AI tools to enhance risk analysis and assessment by identifying potential blind spots, gaps and increased human factor-related risks. This proactive approach helps in safeguarding the organization against potential threats and ensures resilience and sustainability. Implementing Compliance Programs Implementing Compliance Programs Implementing Compliance Programs Implementing compliance programs is about ensuring that the organization adheres to relevant laws, regulations, standards, and ethical practices. The important factor here is not to make these processes inflexible which renders them unable to accommodate frequent and ever changing legal requirements . It is recommended not only to consider the current regulations but also stay alert for forthcoming ones, preparing for them in advance and gradually, to ensure that any changes don't come as sudden disruptions for your company. Integrating GRC into Organizational Culture Integrating GRC into Organizational Culture Integrating GRC into Organizational Culture Integrating GRC into organizational culture is essential. Merely creating a GRC policy is insufficient if it isn’t integrated into daily routines and behaviors of employees at all levels of your organization. Only when GRC becomes a part of the organizational DNA does it become truly effective. The key point here is to understand how regulations translate into actual activities. Aligning GRC Efforts with Business Objectives Aligning GRC Efforts with Business Objectives Aligning GRC Efforts with Business Objectives A GRC strategy should never be detached from your company’s business goals, mission and values. In fact, it should actually support and add value to them. This alignment means that setting GRC priorities needs to be directly linked to key business objectives, ensuring resources are focused on areas of highest impact. 8 Steps to a Successful GRC Strategy Now, from theory to practice. The following steps aid us and our clients in developing a functional GRC strategy that doesn’t deplete the security budget, remains transparent for performance assessment and is scalable and flexible. Decide on the use of GRC Platform Decide on the use of GRC Platform Decide on the use of GRC Platform This is where it is absolutely crucial to do your homework. Research and compare off-the-shelf solutions that are available on the market from the point of view of whether or not they cover all your GRC needs and determine if additional complementary tools are needed. Sometimes, it is worth investing in a custom GRC solution that is tailored to fit your particular GRC demands rather than try and make do with generic solutions that may leave certain areas uncovered. Consult with compliance and GRC experts and involve your solution architects in the decision-making process to select the best option. Create a GRC Project Roadmap Create a GRC Project Roadmap Create a GRC Project Roadmap Set your priorities and present them in the form of defined milestones and timelines. Make sure they are realistic and are broken down into manageable phases. Then assign responsibilities for the tasks on the timeline you’ve created. Make them transparent and avoid situations where too many cooks can spoil the broth. Communicate the plan to everyone involved. Perform a Gap Analysis Perform a Gap Analysis Perform a Gap Analysis This stage involved identifying the existing GRC processes and evaluating them against your roadmap objectives. Then compare your current practices against industry standards, regulatory requirements, and best practices. Once you’ve identified the gaps, prioritize them based on their risk and impact on your business, and plan actions to address them. Determine and Align Stakeholder Expectations Determine and Align Stakeholder Expectations Determine and Align Stakeholder Expectations Stakeholder engagement is essential for carrying out effective GRC policies. Make sure it starts at the earliest stages. If you have to (and you probably will), plan meetings to discuss and align on the GRC strategy's goals, priorities, and outcomes. Don’t stop there, you need to keep the stakeholders in the loop of all the GRC-related developments, gather and analyze their feedback and ensure their active participation in decision-making. Define the Objectives Define the Objectives Define the Objectives Use the SMART objectives-setting technique. SMART stands for Specific, Measurable, Achievable, Relevant, and Time-bound and this abbreviation perfectly reflects the qualities that should define your GRC tasks. Incorporating regular reviews and feedback loops into GRC objectives is crucial for ensuring their effectiveness. Conduct a Comprehensive Organizational Risk Assessment Conduct a Comprehensive Organizational Risk Assessment Conduct a Comprehensive Organizational Risk Assessment Use a structured framework to conduct risk assessment activities. Another great tip here would be to maximize the use of existing resources such as leveraging the cross-functional expertise within your team. You may already have a compliance expert within your organization potentially working on other projects. Keep a comprehensive log or a documentation of all identified risks with set priorities and mitigation options. Standardization Standardization Standardization Standardization is key to maintaining consistency and effectiveness in your GRC policies. By standardizing procedures, training, and onboarding processes, you ensure that rules are interpreted uniformly across the organization. Develop a comprehensive set of GRC training materials and procedures making it mandatory for employees to be familiar with them.  Consider incorporating GRC clauses into employment contracts to reinforce compliance. Additionally, adopt and implement industry best practices tailored to your business structure. Conduct regular training and workshops to increase awareness of your GRC policies and keep employees updated on its developments. Management and Revision Management and Revision Management and Revision The process of refining your GRC policies is ongoing. This ensures its scalability, flexibility and alignment with industry standards. So, monitor it, conduct performance checks, gather feedback and identify improvement areas on a regular basis. Best Practices in Creating a Working GRC Policies Besides understanding the steps for creating and implementing GRC policies tailored to your business, here are some tips to ensure its effective execution. Starting small, simple, and focused Starting small, simple, and focused Starting small, simple, and focused No need to roll-out a huge-scale system that will complicate matters for your company. Start small, try out, build on it and expand gradually. Keep the focus on high-impact factors. Leadership commitment Leadership commitment Leadership commitment Cultivate initiative within your leadership by openly communicating GRC principles throughout the organization. Emphasize that these principles are fundamental to the company’s long-term success and reputation. Prioritize risk and compliance activities Prioritize risk and compliance activities Prioritize risk and compliance activities At an enterprise level, this is what quantifies the value achieved at each stage of your GRC policy implementation. Engage your employees Engage your employees Engage your employees This is where you can get creative. It could be interactive training sessions on ethical decision-making, workshops on identifying and mitigating risks in your workers’ operations, and forums for discussing compliance challenges. Do not forget to encourage feedback and show you value it. Introduce proper incentives Introduce proper incentives Introduce proper incentives You can revise your company’s performance appraisal system to include GRC-related metrics. Your employees can be rewarded not just for achieving business targets but also for demonstrating adherence to compliance standards, ethical behavior, and effective risk management in their tasks. Conclusion Well-planned and implemented GRC strategy is crucial for success in today's digital business landscape. By establishing a robust operational framework, organizations can achieve regulatory compliance, effectively manage risks, improve efficiency, safeguard their reputation, and make informed strategic decisions. Furthermore, fostering a culture of GRC awareness among stakeholders promotes a sense of collective responsibility and accountability, encouraging an environment of cohesion and resilience.

How to Correctly Plan and Implement A GRC Strategy in Your Digital Business

Sydney Bencriscutto on His Journey From Music Artist to Options Trader to eCommerce Success

Hello guys, if you are preparing for software engineer interviews or software developer interviews, then you may know how difficult it is to prepare for system design interviews given its open-ended nature and vastness, but at the same time, you cannot ignore it. In the Software Engineering world, if you are applying for a Senior Engineer/Lead/Architect or a more senior role, System Design is the most sought-after skill, and hence, one of the most important rounds in the whole process. If you mess this up, nothing else would matter. If you get it right though, you’re looking at a raise of at least tens of thousands of dollars annually. So, how do you ace your system design round? Well, here’s what I did while preparing for my interviews with Facebook, Google, and Amazon, and it worked out rather well. I did end up creating a checklist for myself which got me through most of my rounds, so if you follow a similar path, you should be able to come up with something that works for you as well. By the way, if you are serious about cracking System design interviews on the first attempt, then joining a site like or , or a course like can really help. They cover essential System design concepts in a guided and structured way and help you prepare faster. ByteByteGo Exponent Grokking the System Design Interview on DesignGuru Before we get into the details though, What do the interviewers really expect from the candidates? what is a system design interview? What Should You Know Before Going for System Design Interviews? You should be able to design a system that satisfies the requirements given to you and scales well. Your design should be pluggable and not restrict the addition of new features. You should be able to compare various alternatives and choose the most optimal one. Things like, which database is the most important, which protocol should you use, or what’s the best approach to scale a system, etc. You should know the basics that are relevant from a system design standpoint like: Load balancers and API Gateway APIs Caches Databases Network Protocols Message queues CDNs High-level details about ML and Big data CAP Theorem Monitoring and analytics How to Prepare for System Design Interviews in 2024? Here’s how you can crack the System design round interview of any FAANG company (Facebook/META, Amazon, Apple, NetFlix, and Google) or get into FAANG There is a simple four-step process to ace any System Design round. Learn essential System Design Concepts Learn from the tech giants by reading their engineering blogs Solve common System Design questions Practice 1.  Learn Essential System Design Concepts Any will definitely require you to come up with a basic high-level design for whatever system you are trying to build. There are some components that will be needed for sure. Make a note of these components. system design interview Here are a few - 1. 1 Load Balancer You cannot have a distributed system without a load balancer to distribute the incoming requests among various nodes. This ensures proper resource utilization and that there is no single point of failure in your system. Here’s how does it. Nginx 1.2 Cache Most systems have some read-heavy interactions, some information that the user will access frequently but not update as much. It makes sense to cache this information in such a way that it can be easily fetched without the need for a DB lookup. Think low latency. Also, based on your use case, you might need to store more frequently accessed information or more recently accessed information. So, read up on various eviction policies. 1.3 Database Again, there can be no system without some form of data storage. Whether you want to store files, images, product information, financial transactions, or simply dump all the data from various user interactions to run analytics later. It all needs databases. So, read up on it. Find out what matters when you are selecting a database, read about / , query patterns, and how the CAP theorem might come into play while making tradeoffs. SQL NoSQL 1.4 Message Queues Sometimes, our system needs to perform some tasks that need to be done but not necessarily immediately, or their outcome does not affect the user’s journey. In such cases, rather than making a service call, and waiting for the response, it makes sense to just write the message to the queue, so that it can be executed later. What if you need to insert information in your database, and bulk insert could be more efficient? It would make sense to just keep track of these inserts in a message queue and perform 1 bulk insert instead of hundreds of 1-to-1 inserts to optimize your resources. 1.5 CDN When your users are distributed geographically, getting your content to them in a reasonable amount of time becomes a real challenge. CDNs allow us to maintain a copy of our data in various data centers located closer to the users’ location to reduce the latency. Here is a . short video about how Akamai does it 1.6 Analytics and Monitoring This is something that is needed in every system you create. This is a hidden requirement; no one calls it out in the requirement gathering, but every interviewer wants this. User logs in or logs out? Wishlisted an item? Payment failed? It is all the information for us! If anything of importance happens, fire an event, and save it in your messaging queue. You can perform real-time analytics on data, or just dump it in a to use later. Similarly, if an API call is regularly failing, or if your servers are about to run out of resources, wouldn’t you like to know of it beforehand? Hadoop cluster 1.7 Network Protocols Based on your requirements, based on the type of content you are sharing, you might need to make a decision on which network protocol to use. Read up on various network protocols, when are they relevant, what compromises you might need to make, etc. The first step is to know about all these concepts. And by knowing concepts, I don’t mean just some theoretical knowledge of what these are, but more practical hands-on experience about what should be used and when. You need to know things like: Which is the best alternative to choose from, given the use case? What are the tradeoffs that you need to consider while making these decisions? Best practices for certain use cases. To know most of these things, I recommend going through which covers all of the above with concrete examples from the real world. this course on System Design by CodeKarle 2. Learn From the Tech Giants (Read Their Engineering Blog) This is probably not going to help in the short term. But in the long term, to become an expert in , it’s best to look at the Tech blogs of various tech companies, and see how they are solving various technical problems. System Design This would paint a clear picture of the real problems that they face and how innovatively they solve them. Understanding these things would help you become better at system design and also keep you up to date with the latest innovations in tech. Some of the best blogs to follow are: Facebook engineering blog Netflix tech blog Uber engineering blog 3. Solve Frequently Asked System Design Questions An obvious way to get started with your interview prep! Knowing the basics is definitely important, but it won’t be enough! The most basic way to get started with your practice is to look at some frequently asked questions and their solutions. Most system design interviews revolve around some 5-6 commonly asked , and if you know the solutions to those, you are more than likely to clear this interview. System design questions The most common questions are: Tinyurl System Design Twitter System Design Facebook System Design Whatsapp System Design Airbnb System Design Uber System Design How to design Amazon Prime Video How to design Google Search How to design NetFlix How to Design a Distributed Message Queue How to design a Rate Limiter? How to design a distributed Queue? Difference between SQL and NoSQL? If you need resources to solve these questions, something which not only solves the question but also explains the underlying concepts and approach to solving system design questions, then this and some more problems, which has helped many people crack their interviews for companies like Google, Facebook, Microsoft, Amazon, etc. highly-rated course by CodeKarle discusses most of these case studies 4. Practice, Practice, and More Practice Practice, practice, practice! Did I say practice? There are a lot of resources out there. I have shared a few that discuss some of the most popular system design problems in detail. Once you go through a few of them, you will start noticing a pattern and will soon be able to come up with solutions on your own. Get a better understanding of how your systems are designed in your organization. How are the other teams doing things? The next best thing is to practice with a friend. Make sure you go through a few mock interviews before your actual interview to avoid some common but easily avoidable pitfalls. What factors do they take into consideration? Some most common mistakes that I have seen people make are: Not driving the interview Not asking questions Not structuring the interview properly Running out of time Not considering the requirements Not exploring all the alternate design options All these mistakes can be easily avoided by having a few mock interviews with someone who knows well. And time your interviews. The target must be to reach a solution within 40 minutes, including time for some discussion. System Design Best Books and Courses to Prepare for System Design Interviews in 2024 Now that we know which topics to prepare, which blogs to read, and which System design problem to solve, let's see which book you can read and which online courses you can join to prepare well for your System design interview in 2024. CodeKarle's System Design Interview Course on Udemy Mastering the System Design Interview by Frank Kane (Ex Amazon Hiring Manager) Software Design and Architecture Specialization [Coursera] Pragmatic System Design [Udemy Course] Web Application & Software Architecture 101 [Educative.io] System Design Interview — An Insider’s Guide by Alex Xu That's all about . We have discussed essential System Design Interview topics, concepts as well as popular System Design questions for practice. With this 4 step process, you’ll soon be ready to ace any of your system design interviews! Hopefully, this should be a good starting point for you. how to prepare for System Design Interviews in 2024 Happy learning! And all the best for your System design interview. Thanks for reading this article so far. If you like this System design interview preparation article, then please share it with your friends and colleagues who are preparing for tech interviews. If you have any questions or feedback, then please drop a note. All the best with your interviews. Feature image_credit - , Exponent

How to Prepare for System Design Interview in 2024?

The NFT world has made millions for lots of investors, while at the same time, it has bankrupted just as many people. There are rumors that NFTs will make a big comeback in 2024 and grab the headlines again. But is that really true? Can we trust these rumors? To find out, we will return to the very beginning - to the peak of NFTs in 2021, we will try to understand the reasons for the collapse of the market in 2022, its gradual recovery in 2023, and give a forecast for the current year. Main Takes: : NFTs experienced a significant surge in 2021, with trading volumes reaching $17.6 billion, driven by unique blockchain technology, the crypto bull run, the COVID-19 pandemic, the decline in ICOs, network effects, and FOMO. 2021 Historical Context : A dramatic correction occurred in 2022, with trading volumes and NFT prices plummeting due to a broader crypto market downturn, highlighted by events such as the collapse of TerraUSD and the bankruptcy of major crypto players. 2022 Market Correction : Despite a sluggish start, the NFT market showed signs of revival in the last quarter of 2023, buoyed by a bullish crypto market and the SEC's approval of Bitcoin ETFs, with weekly trading volumes surpassing $500 million in December. 2023 Revival Signs : The introduction of Bitcoin Ordinals and the growth of Solana contributed to the renewed interest in NFTs, offering unique features and security advantages. Bitcoin Ordinals and Solana's Influence : Positive expectations for the NFT market are supported by a more mature and diverse sector, the broader crypto market's performance, utility in various niches, and mainstream adoption by traditional brands. However, challenges such as wash trading, scams, and regulatory fragmentation remain. 2024 Outlook Why there was an NFT boom in 2021? In 2021, the NFT market experienced an unprecedented surge. At that time, many thought that the interest in non-fungible tokens was confined to a relatively closed group of traders who had little connection to the art world. Soon, auction houses began to offer more NFT sales and create infrastructure and consistent offerings of this kind. Research shows an explosion of interest in NFTs as a new asset class, with sales reaching in 2021. Famous NFTs, like the ones from Beeple, Bored Ape Yacht Club, and CryptoPunks, became iconic. Even big brands like Gucci and D&G joined in, making their own collectibles. $17.6 billion In 2022, the NFT market faced a serious disruption, leaving everyone reeling. The once bustling market took a nosedive in prices, sparking widespread concerns and discussions about its future. NFT crash in 2022 In June 2022, we witnessed a 12-month low. Sales fell to 1 billion dollars, the worst market performance since June 2021 (when sales were a modest 648 million dollars). According to , while the market was worth 3 trillion dollars in November 2021, it's now sporting less than 1 trillion dollars. Chainanalisys In the second quarter of 2022, things took a turn for the worse. The , laid out by the Non-Fungible, reveals that sales volume has decreased by 20.05% from the first quarter of 2022, from 12,639,781 to 10,105,967. The number of sellers has decreased by 35.88% and the number of buyers has decreased by 25.41%. market report for Q2 This data suggested that collectors weren't exactly interested in taking big risks when it came to investing in new and upcoming projects appearing on NFT platforms. They've decided to trade on the secondary market, where prices remained higher. NFTs at one time depreciated by millions of percent, almost to several hundred, having been purchased for hundreds of thousands of dollars. Take Logan Paul, for example. His Azuki NFT, once purchased for a whopping $623,000, is now worth $10. Likewise, Steve Aoki's Doodles NFT has seen its value drop to less than $42,000. Even the stars aren't immune to the NFT tragedy. Snoop Dogg also lost more than $300,000 on CryptoPunk, bought for $1.1 million, which is now worth about $688,000. However, the most popular loss is Justin Bieber's journey with the Bored Ape Yacht Club NFT project. What started as a $1.31 million investment turned into a shocking $59,090. The NFT market has plummeted in 2022, thanks to several factors including market oversaturation, scams, and the collapse of big systems. With a flood of NFT projects and the art of deception on the rise, investor hesitation contributed to the market downturn. First factor. Market oversaturation Before the NFT boom of 2021, the market was relatively niche, with just a handful of NFT projects grabbing attention. But when the hype hit its peak, it felt like everyone wanted a piece of the action. The result? An overwhelming deluge of NFT projects flooding the market.** Second factor. Deception and scams Where large sums of money start circulating, fraudsers immediately appear, eager to profit from it. The NFT market hasn`t been an exception. As interest in NFTs has grown, so had the number of fraudulent activities and scams targeting unsuspecting investors. Hackers and scammers have seized upon the NFT boom, deceiving people and causing them to part with their assets. Discord breaches, malicious links, and the whole range of free NFT coin scams left many people with heavy losses and undermined confidence in the market. Third factor. The collapse of big systems When FTX, one of the largest crypto exchanges, filed for bankruptcy, allegedly due to a liquidity shortage and a disappearing act with the funds. Additionally, the Terra blockchain cryptocurrencies, TerraUSD and LUNA, have seen catastrophic drops in value, leaving investors reeling from significant losses. In any ecosystem, when a big player fails, it can send shakes through the whole system. In the case of the NFT market crash, the collapse of important systems associated with Web3 contributed to the downturn. What happened with the NFT market in 2023? Despite the NFT market crashing in 2022, experts and enthusiasts are pretty sure that NFTs will bounce back to their best state. Even though there was a big drop in trading in June, the NFT market overall stayed strong in the first half of the year. The beginning of 2023 looked good for NFTs, with a sudden increase in trading activity. The launch of trading platforms like LooksRare and X2Y2 played a big part, along with the rewards they offered for trading. NFT sales in 2023 reached around $17.7 billion, similar to the sales recorded in 2021. This is also almost a 10-fold increase compared to the same period last year. Taking a closer look at the main factors, a pretty stable first half of the year was helped by a healthy growth in the number of unique buyers and transactions. But this was balanced out by a drop in the average sale price. Even if we ignore the less valuable and less important projects, most collections nowadays aren't really worth much. Out of the 8,850 collections leading in market value, 18% are not worth anything, and 41% are being sold for prices between $5 and $100. Less than 1% have a price higher than $6,000 – a far cry from the usual million-dollar deals made two years ago. Despite this, the NFT community's stability, combined with ongoing innovations in this area, is paving the way for a potential comeback. Thanks to forward-thinking NFT creators and big brands using this technology, the next bullish rise of NFTs looks promising. Yuga Labs' Role in the NFT Comeback Yuga Labs' groundbreaking games, like Dookey Dash, brought in new collectors and created a fresh wave of excitement in the NFT space. Thanks to these innovative Yuga Labs projects, they became the driving force behind the NFT comeback. Their contribution to a whopping 30% of all Ethereum NFT trades in just one month made them a beacon of hope for the NFT market. As we move forward, their impact will inevitably determine the course of NFTs for many years to come. NFT brands are selling stuff in big regular and online stores. We are seeing the launch of major blockchain-based games. And more big companies are joining the NFT world. As a result, NFT-based brand building could be a significant factor beyond just the recovery but also surpass previous heights in 2024. Will NFTs be reborn in 2024? The NFT market is expected to change a lot in 2024. Despite the prolonged decline and negative background, it's predicted that the NFT market will make around in revenue in 2024. $2,378.0 million In 2024, the NFT market is expected to go through big changes with lots of new trends. Here are some of the important trends. Metaverses The global Metaverse market size is steadily at the expected rate, recording a CAGR of 47.2% from 2023 to 2027. The cost of the metaverse industry will increase from $61.8 billion in 2022 to approximately $426.9 billion by the end of 2027. expected to grow The Metaverse NFT market is huge and includes a variety of digital assets such, as virtual houses, avatars, art, and even virtual fashion. Many things are making this market grow, like more people using blockchain, games, and virtual worlds becoming popular, and the growing demand for unique and scarce digital assets. Additionally, the Metaverse NFT market gives creators, artists, and gamers new chances to make money from their digital creations, and investors can diversify their portfolios by investing in these unique assets. NFT Aggregators In 2022-2023, saw the rise of NFT aggregators. These platforms let traders buy and sell NFTs from different marketplaces, all in one place. Top aggregators Gem and Genie showed impressive growth: this year, the trading volume went over 511,000 ETH. That's about 21 times more than in 2021. NFT aggregators also have extra benefits. They let traders complete whole collections by buying lots of NFTs at the lowest prices, without needing to go to each market separately. The market share of NFT aggregators from just over 1% at the end of 2021 to about 5% today. Even though the market share of NFT aggregators is still not very big, recent purchases of and Genie by Uniswap show strong interest from existing players in NFT aggregators. It confirms that NFT aggregators seem ready to play a big role in shaping the NFT trading scene for the long term. has also grown Gem by OpenSea Entering the era of Web3, the NFT world holds promises of growth, creativity, and financial opportunities. Will NFTs make a big comeback in 2024? It seems like Metaverse and NFT aggregators are ready to contribute significantly to the upcoming success.

Is the Revival of NFTs in 2024 a Reality, or Just Another Fairy Tale for Beginners?

Go (aka Golang) came to life at Google in 2009. It was designed by a few big names: , who had a large hand in the development of the Java Virtual Machine. Robert Griesemer , who holds a U.S. patent for windowing UI systems, helped build the Plan 9 operating system at Bell Labs. (In fact, the mascots and are remarkably similar because Pike’s wife, Renée French, is a renowned illustrator.) Rob Pike for Plan 9 for Golang , who designed and implemented a little thing called Unix. Ken Thompson In this article, we’ll demonstrate how simple it is to build a RESTful web service in Go. Then, we’ll demonstrate how to deploy this application with Heroku. But before we embark on this journey, let’s talk briefly about you might want to use Go. why Why Go? To build a web service in 2024, why would you choose to Go over another language, like Python or TypeScript? Go’s biggest advantage over those two languages is . Go is a compiled-to-machine-code language. It’s not interpreted like Python, Ruby, or JavaScript. It’s not even compiled into bytecode and run on a virtual machine like Java. Lots of benchmarks show Go to be 40x or 50x faster than applications written in interpreted languages. When it comes to speed, Go applications perform similarly to those written in Rust or C++. speed Go has a , often with only one particular way of doing something. This is appealing to many developers, especially any who have ever been in a development team setting, where squabbles over various ways of doing things eat up precious time. This simplicity drives conformity in a codebase and offers less perplexity when the code. (Believe it or not, most developers spend more of their time code rather than writing it.) simple syntax reading reading Go is a young language, so it comes packed with modern features out of the nursery. You get automatic garbage collection like in Java or Python. You get . You get a . And perhaps most beneficial to network programmers: You get an called . built-in linters, formatters, and unit testing rich network stack in the standard library easy-to-use multi-threading toolkit Goroutines Yes, there are some reasons why not everyone is hot on Go. One common complaint revolves around error handling in Go. Functions in Go can return multiple values, one of which is an error code. This hearkens back to the days of C—before exceptions—and feels admittedly archaic. It is easy to forget to check error codes for every function. It’s also tedious to percolate errors from down in the depths—when you awaken a balrog deep inside your application—up to somewhere manageable. You know you’ve done that. Alright, the Go cheerleading is done. Let’s get to building. Building a simple RESTful web service in Go We’ll build a small API service that provides some text operations that applications commonly need, such as: Encode a given string using a basic Caesar Cipher Determine if a string is a palindrome (Perhaps most importantly) SpongeBob-encode a zinging retort. If you’d rather skip ahead to the finished code for this application, you can find it in this . We’re not going to go through line by line, but we’ll talk about the important bits. GitHub repo main.go Let’s start with the main function, the bootstrapping code of the service: func main() {
	http.HandleFunc("/is-palindrome", palindromeHandler)
	http.HandleFunc("/rot13", rot13Handler)
	http.HandleFunc("/spongebob", spongebobHandler)
	http.HandleFunc("/health", healthHandler)

	appPort := ":" + os.Getenv("PORT")
	if appPort == ":" {
		appPort = ":8080"
	}
	err := http.ListenAndServe(appPort, nil)
	if err != nil {
		return
	}
} As we mentioned, one of Go’s powerful features is the expressive standard library. You don’t need any third-party dependencies to quickly get a basic RESTful service up and running. With , you can easily define your routes and assign handlers to the requests that are routed to those URIs. net/http http.HandleFunc The method kicks off the server, binding it to the port you specify. When we deploy to Heroku, . For our local deployment, we default to . http.ListenAndServe Heroku will handle setting the PORT var in the environment 8080 Let’s look at a handler: func spongebobHandler(w http.ResponseWriter, r *http.Request) {
	decoder := json.NewDecoder(r.Body)
	var t requestPayload
	err := decoder.Decode(&t)
	if err != nil {
		panic(err)
	}

	result := map[string]string{
		"original":  *t.Input,
		"spongebob": spongebob(*t.Input),
	}

	w.Header().Set("Content-Type", "application/json")
	err = json.NewEncoder(w).Encode(result)
	if err != nil {
		return
	}
} Our handler needs to do the work of taking the JSON body of the request and parsing it into a Go struct defined outside of this snippet. Then, it needs to build the result from other functions that transform the input string into a SpongeBob utterance. Again, none of the libraries here are third-party dependencies; they all come standard with Go. You can see the prevalence of error handling here via error codes, as working with takes up a large part of the code real estate. err $ go run main.go Then, we send a GET request to : /health $ curl -s http://localhost:8080/health We receive a JSON response indicating the service is up and healthy. That’s it—one file with roughly 100 lines of actual code, and you have a working Go RESTful microservice! Deploying your Go service to Heroku Running the service on your laptop is OK, I guess. But you know what would be really cool? Running it on the web, that’s what. These days, we have lots of options for how to host a service like this. You could build out your own infrastructure using AWS or Azure, but that quickly gets complicated and expensive. Lately, I’ve been turning more and more to . As a platform-as-a-service (PaaS), it’s a low-hassle, low-cost option that allows me to deploy applications to the cloud quickly. Heroku When I’m doing testing and development, I use their Eco Dyno plan to get 1000 dyno hours per month for $5. To deploy basic apps to production, I use their Basic Dyno Plan, which costs a max of $7 per month. For frameworks that Heroku supports, the process of deploying right from your local machine to the web is quick and painless. After setting up a Heroku account, I installed the and logged in from the command line. Heroku CLI You can create a new app directly through the CLI, or you can use the web UI. I named my application the same as my GitHub repo: . We’ll think of something snazzier before our IPO, but for now, this will do. golang-text-demo To deploy our GitHub repo to Heroku, we first need to add a remote repository. $ heroku git:remote -a golang-text-demo This creates a new remote location in our GitHub repo, pointing it to the Heroku application we just created. Now, whenever we push our branch to that remote ( ), it will kick off a flurry of activity as Heroku gets to work. git push heroku main Lastly, we add one file called , which specifies our app’s build dependencies (we don’t have any) and build configurations for Heroku. Our file is short and sweet; simply setting the Go version we want Heroku to use: go.mod module golang-text-demo

go 1.22 When we push to our Heroku remote, Heroku initializes all the required resources in the cloud. This may take a minute or two the first time you deploy your app, but the results appear to be cached, reducing the time in subsequent deploys. When your app has successfully deployed, you’ll see output that looks similar to this: This gives us the URL for our deployed Heroku app. Sweet! With a single command, we’ve deployed a Go microservice to the cloud, and it is now accessible anywhere in the world. To interact with it, we simply issue the same curl command we did before, but we use the Heroku app URL instead of . git push localhost The Heroku CLI also gives us access to our application’s logs. It’s almost exactly like working with the tools directly on your local machine. We just run , and we see the latest log lines from Heroku and our application right there in our terminal window. heroku logs -tail Before we finish, let’s briefly highlight the impressive insights that can be gained about your application from the Heroku app dashboard. Sure, there’s the obvious stuff you care about—like how much your resources are costing or whether or not they are functioning. But the metrics section gives you impressive details about the performance of your application in near real time. Somebody better do something about those critical errors… 🥴 Conclusion In this walkthrough, we’ve explored why Go is a great choice for building a modern, low-dependency, and efficient web service. We built a simple API service in Go and demonstrated how to deploy our service using Heroku. As a PaaS, Heroku supports running a wide variety of services, not just Go. With that, you now have the tools needed to get started on your own Go services journey. Don’t wait, get Go-ing! Also published . here

How I Built My First Go App and The Deployed it to Heroku

This paper is available on arxiv under CC 4.0 license. Authors: (1) Vianney Brouard, ENS de Lyon, UMPA, CNRS UMR 5669, 46 All´ee d’Italie, 69364 Lyon Cedex 07, France; E-mail: vianney.brouard@ens-lyon.f. Table of Links Abstract & Introduction and presentation of the model Main results and biological interpretation First-order asymptotics of the mutant sub-populations for an infinite mono-directional grap First-order asymptotics of the mutant sub-populations for a general finite trait space (Theorem 2.1) Convergence for the stochastic exponents (Theorem 2.2) Acknowledgements & References Abstract We aim at understanding the evolution of the genetic composition of cancer cell populations. To this aim, we consider a branching individual based model representing a cell population where cells divide, die and mutate along the edges of a finite directed graph (V, E). The process starts with only one cell of trait 0. Following typical parameter values in cancer cell populations we study the model under large population and power law mutation rates limit, in the sense that the mutation probabilities are parameterized by negative powers of n and the typical sizes of the population of our interest are positive powers of n. Under non-increasing growth rate condition (namely the growth rate of any sub-population is smaller than the growth rate of trait 0), we describe the time evolution of the first-order asymptotics of the size of each sub-population on the log(n) time scale, as well as in the random time scale at which the initial population, resp. the total population, reaches the size n t . In particular, such results allow to characterize whose mutational paths along the edges of the graph are actually contributing to the size order of the sub-populations. Without any condition on the growth rate, we describe the time evolution of the orders of magnitude of each sub-population. Adapting techniques from [13], we show that these converges to positive deterministic non-decreasing piecewise linear continuous functions, whose slopes are given by an algorithm. Keywords: cancer evolution, multitype branching processes, finite graph, long time behavior, power law mutation rates, population genetics. 1 Introduction and presentation of the model In the present work the population of cells will be studied in different time-scales: the random timescale and the following deterministic approximation where For any finite oriented labeled graph (V, E, L) under the following non-increasing growth rate condition Without any assumption on the growth rate function λ, the study is made on the deterministic timescale of Equation (4). As in [13, 3, 5, 8, 14, 2, 30] the asymptotic behaviors are obtained on the following stochastic exponent processes The results are presented in Theorem 2.2. It is the exponent as a power of n that is tracked for any sub-populations, whereas Theorem 2.1 gives directly the size order on n, this is a refined result. Up to our knowledge, it is the first model considering the power law mutation rates regime (1) capturing this level of refinement on the asymptotic behaviors. Two new significant results emerge. First it shows the remarkable result that under Assumption (5) the randomness on the first-order asymptotics of any mutant sub-populations is fully given by the stochasticity of only one random variable W -encoding the randomness on the long time for the lineage of wild-type cells issued from the initial cell. It means that the stochasticity for any mutant sub-population is fully driven, at least at the first-order asymptotics, by the randomness on the growth of the wild-type population and not from the dynamics of any lineage of a mutant cell, as well as the stochastic processes generating mutations. Second it characterizes exactly whether a mutational path on the graph structure of the trait space asymptotically contributes to the growth of the mutant sub-populations. Whereas having asymptotic results on the stochastic exponents only allows to discriminate some paths and not to determine exactly whose paths are actually contributing to the asymptotic growth of the mutant sub-populations. More precisely, if the weight of a path is defined as the sum of the label of its edges, asymptotic results on the stochastic exponent gives that for every trait v, among the paths from 0 to v only those with the less weight might contribute to the asymptotic growth of trait v. On the contrary, having results directly on the first-order asymptotics of the mutant sub-populations allows to discriminate among those paths with the less weight those which actually contributes to the dynamics of trait v. In particular among those paths with the less weight only those with the maximal number of neutral mutations on their edges have an asymptotic impact on the growth of trait v. Indeed an additional multiplicative factor of order log(n) for each neutral mutation of a path is captured when looking at the first-order asymptotics and is obviously not captured with asymptotic results only on the stochastic exponents. Moreover it is the first time that this power-law mutation rates regime is studied in the random timescale of Equation (3) up to our knowledge. From the biological point of view it is more interesting to get result on such random time-scale instead of the deterministic one. We obtain that the randomness on the first-order asymptotics of any mutant sub-populations is fully given by the stochasticity on the survival of the lineage of wild-type cells issued from the initial cell. As in [7, 6], compared to the different models in [13, 3, 5, 8, 14, 2, 16], the initial population Z (n) (0) is not assumed to have a macroscopic size. It introduces a supplementary randomness on how the wild-type population is stochastically growing to get a macroscopic size. But contrary to [7, 6], we do not condition on the survival of the wild-type population or on the stopping times of Equation (3) to be finite. In [28] Nicholson and Antal study a similar model under a slightly less general non-increasing growth rate condition. More precisely, in their case all the growth rates of the mutant populations are strictly smaller than the growth rate of the wild-type population: ∀v ∈ V \{0}, λ(v) < λ(0). But the main difference remains the mutation regime. In their case, only the last mutation is in the power law mutation rates regime, all other mutations have a fixed probability independent of n. In Theorem 2.1 the case where all mutations are in the power law mutation rates regime is treated. Also Nicholson and Antal are interested in obtaining the distribution of the first time that a mutant sub-population gets a mutant cell. Whereas in the present work the first-order asymptotics of the sizes of the mutant sub-populations over time are studied. In [29] Nicholson, Cheek and Antal study the case of a mono-directional graph where the time tends first to infinity with fixed mutation probabilities. In particular they obtain the almost sure first-order asymptotics of the size of the different mutant sub-populations. Under the non-increasing growth rate condition, they are able to characterized the distribution of the limit random variables they obtained. Without any condition on the growth rates, they study the distribution of the random limit they obtained under the small mutation probabilities limit, using the hypothesis of an approximating model with less stochasticity. Notice that the mutation regime they study is not the large population power law mutation rates regime of Eq. (1) as considered in the present work. Under the latter regime both the size of the population goes to infinity and the mutation probabilities to 0, through the parameter n, see Equation (1). In [18] Gunnarson, Leder and Zhang study a similar model as the one in the present work and are also interested in capturing the evolution over time of the genetic diversity of a population of cells, using in their case the well-known summary statistic called the site frequency spectrum (SFS). The main difference is the mutation regime because they are not considering the power law mutation rates limit. In their case the mutation probabilities are fixed. Also, they restrict the study to the neutral cancer evolution case. In particular, as in the present work, they capture the first-order asymptotics of the SFS at a fixed time and at the random time at which the population first reaches a certain size. Two noticeable similarities in the results are that the first-order asymptotics of the SFS converges to a random limit when evaluated at a fixed time and to a deterministic limit when evaluated at the stochastic previous time. One could argue that in the present work the correct convergence for the latter case is actually a stochastic limit. But the stochasticity is fully given by the survival of the initial lineage of cells of trait 0, so conditioned on such an event at the end the limit is a deterministic one. In particular the results of Gunnarson, Leder and Zhang are all conditioned on nonextinction of the population. In [16] Gamblin and Lambert study a model of an exponentially growing asexual population that undergoes cyclic bottlenecks under the large population power law mutation rates regime. Their trait space is composed of 4 sub-populations 00, 10, 01 and 11, where two paths of mutations are possible 00 7→ 10 7→ 11 and 00 7→ 01 7→ 11. They study the special case where one mutation (10) has a high-rate but is a weakly beneficial mutation whereas the other mutation (01) has a low-rate but is a strongly beneficial mutation. In particular they show the noticeable result that due to cyclic bottlenecks only a unique evolutionary path unfolds but modifying their intensity and period implies that all paths can be explored. Their work relies on a deterministic approximation of the wild-type sub-population 00 and some parts of the analysis of the behavior of the model is only obtained due to heuristics. The present work, and more specifically Theorem 2.2 because they are considering selective mutations, can be used and adapted to consider the case of cyclic bottlenecks in order to prove rigorously their results, in the specific trait space that they consider as well as on a general finite trait space. The rest of the paper is organised as follows. In Section 2 the results and their biological interpretations are given. Sections 3 and 4 are dedicated to prove Theorem 2.1, which assumes Equation (5). In Section 3 the mathematical definition of the model is given for an infinite mono-directional graph as well as the proof in this particular case. The generalisation of the proof from an infinite mono-directional graph to a general finite graph is given in Section 4. In Section 5, Theorem 2.2 is proved adapting results from [13].

Genetic Composition of Supercritical Branching:Abstract & Introduction and Presentation of the Model

Stories, News & Mentions about SUREIN

Surein’s Stories on HackerNoon