To receive full access to Campaign's content including: Unrestricted access to all The Information and The Knowledge content Access to Campaign's in-depth features and coveted reports including additional School Reports analysis, the Annual Salary Survey ...

Nigel Clarkson lands global revenue role at Taptap Digital

When you earn your online Bachelor of Science (BS) in Marketing with a concentration in Digital Marketing at SNHU, you develop the tools to master the mobile environment, specialize in social media and evaluate the metrics that lead to stronger campaigns.

Learn Digital Marketing Online

"Fashion doesn’t have to be static, it can be dynamic and even interactive," researcher Christine Dierk said while modeling the dress at Adobe MAX 2023 Bailey Richards is a writer-reporter at ...

Adobe Introduces Project Primrose, a Digital Animated Dress That Can Change Patterns

How has technology transformed how we tell stories? Jump into brave new digital worlds with some of the best examples of experimental narratives: escape from zombies, travel with Phileas Fogg, hear about life-changing events from the people who lived them ...

Digital Storytelling

It’s a strong selling point for the controller, which Digital Trends called “the best PS5 controller you can buy right now” in a 2022 review.

The best third-party video game controller is about to get even better

When Sony revealed updated models for the PS5 and PS5 Digital Edition, one specific accessory for the latter caught my eye. That would be the Ultra HD Blu-ray Disc Drive for PS5, which players can ...

PS5’s new Digital Edition brings console gaming one step closer to PC

All anime, all the time: Crunchyroll, the Sony-owned anime service, announced a new 24-hour free, ad-supported channel in the U.S. to promote the Japanese animation format — and try to win a few ...

Sony’s Crunchyroll Launches Free 24-Hour Streaming Channel in Bid to Reach ‘Anime-Curious’ Audiences

The Digital Licence is a handy app that can store your identification securely and easily on your mobile devices. The Digital Licence is optional—you do not have to get the Digital Licence if you do not wish to. All Queenslanders will continue to be sent ...

About the Digital Licence app

Inside a building on the central square, a young German extolled the virtues of a four-hour work week to a packed auditorium, while in the local park hundreds of digital nomads watched their peers ...

Bansko: Bulgaria's unlikely new digital nomad hub

Notably, the driver update does not have a WHQL certification. What that means is that it may require further testing and likely has not passed the Windows Hardware Lab Kit testing. That doesn’t ...

Intel’s new Arc driver can boost your performance by up to 119%

Taptap Digital

taptap

The Trick That Agentic Frameworks Pulled On Us

El truco que nos hicieron los frameworks de gestión de agentes

O truco que nos tiraron os frameworks axentes

A trükk, amelyet az ügynöki keretek rántottak ránk

エージェントフレームワークが私たちに仕掛けたトリック

Triks, ko mūs pamudināja aģentu sistēmas

Trucul pe care ni l-au tras de cadrele agentice

නියෝජිත රාමු අප වෙත ඇදී ගිය උපක්‍රමය

Mashtrimi që Kornizat Agjentike na tërhoqën

Ҳилае, ки чаҳорчӯбаи агентӣ ба мо кашид

Agentic Framework'ün Bize Yaptığı Hile

Трюк, який Agentic Frameworks застосував до нас

Thủ thuật mà các khuôn khổ Agentic đã áp dụng với chúng ta

Field, Forest and Farm by Jean-Henri Fabre, is part of the HackerNoon Books Series. You can jump to any chapter in this book here . ROTATION OF CROPS CHAPTER XL. ROTATION OF CROPS They are eating dinner at the farm. A large platter of pork cutlets and beans is smoking in the center of the table. Every one has been served. It is a pleasure to see these good people eat, they have such hearty appetites. Jacques, the big ox-driver, is the first to finish. He throws his bone away. Azor is there to seize it. He lies flat on his stomach and takes the bone in his fore paws. Hear him bite on his hard pittance. How it cracks! Let any one beware of teasing Azor now. An angry growl and a baring of his four formidable canine teeth would warn the rash intruder to have done with his joking at once, for if not—well, I will not be responsible for the consequences. Azor is not a surly dog; far from it; but he is well within his rights when he brooks no nonsense at his meals. He has done his duty most valiantly as a dog. Night before last some wolves were prowling about the sheep-fold, and he drove them off. Let Azor gnaw his bone in peace. Ha, there! The big tortoise-shell cat, Master Minet, is otherwise minded. He draws near, hair erect, tail as large around as your arm, to try to frighten Azor and rob him of his allowance. Azor, [ ]without dropping the bone, gives a low growl and lifts one paw. That is enough, the cat flees. So, my bold Minet, what were you after here? The bone is not for you; your teeth are not strong enough to bite it. Go away! Martha is calling you to give you some bread soaked in gravy. That will suit you better than a bone as hard as a stone. 203 Ah, here come some more guests. The door stands open and in come the hens from the poultry-yard. Tap, tap, tap, tap; they peck the crumbs fallen from the table. Azor has no use for such diet—tiny morsels much too small for him; nor does the cat want them either, they are too floury. But the hens feast on them. And all, human beings, dog, cat, hens, dine at the same time; only each must make the best of what the others cannot use. Azor is content with the bone that big Jacques threw away; the cat is satisfied with a little bread soaked in gravy, a dish quite inadequate to Azor’s needs; the hens pick up the crumbs disdained by Jacques, Azor, and the cat. Martha, it seems, had prepared dinner only for the farm people, and behold, by utilizing the scraps that are worthless to some, many others join in the midday meal. From the scraps disdained by man the dog will gain strength to defend the flock; from those rejected by the dog the cat will acquire keen eyesight and sharp claws to see and to seize the mouse; from what is of no value to the cat the hens will make eggs; and everything, absolutely everything, will go to the profit of the farm.[ ] 204 “Agriculture in its turn,” remarked Uncle Paul, turning to account this homely illustration in domestic economy, “prepares dinner for the crops in its own peculiar manner. It spreads the ground with manure, that fertile dressing so relished by growing plants. The table is set, or in other words the field is ready, well plowed and harrowed, and well manured. Whom shall we call first to the table, for it is plain we cannot invite all at once. Whom shall we call first? It shall be wheat, let us say, a plant with tastes hard to please, but one that in return gives us bread. So wheat is sown. In this soil, full of all sorts of good things, it cannot fail to thrive, however unfavorable the season may be. It will select what suits it best and leave the rest. “Now that is done. The harvest is in, and it handsomely comes up to our hopes. The wheat has converted into magnificent grain the fertilizer put into the ground. Out of decay it has created nourishment. Surely it has well acquitted itself of its charge. It has made a clean sweep: all that could be turned into wheat it has appropriated, and there remains nothing further to be done. What would happen, then, if wheat were sown again in the same field? Exactly the same thing that would happen to Simon if he had nothing to eat but the bone that Jacques threw away. He would die of hunger. Simon must have man’s food, wheat must have wheat’s food. So if the first crop has exhausted the supply of material for making wheat, how can you expect to raise a second crop? Evidently that is asking [ ]the impossible; it is running the risk of reaping only a very mediocre harvest or even none at all. Therefore it is the rule not to sow wheat twice in succession in the same field. And what is true of wheat is true also of all other crops. Where a plant has prospered one year, the same plant will not do well the second year, because the ingredients required by this plant are more or less exhausted. It is foolish to invite guests to a table that is stripped bare. 205 “If the table were spread again, if more fertilizer were added to the soil, that would be quite a different matter, and wheat would grow as well as it did the first time. But such a procedure would be bad management, for the very utmost should be made of one meal. Before further expenditure in the way of fertilizer let us exhaust the virtue of the fertilizer already applied. Azor dined well on what Jacques discarded; the hens were well fed with what Azor and the cat left. Let us take an example from this succession of eaters who utilize each in his own way the remnants worthless to the others. The wheat has exhausted, or nearly exhausted, all that is suitable for wheat; but just as Jacques the ox-driver left the bone, it has left in the soil a good many ingredients that make excellent food for other crops. In order, therefore, to utilize to the last ounce the first spreading of fertilizer, we must invite to the repast a guest of different tastes. This guest may be, for example, the potato. In soil that would have furnished but starvation diet for wheat the potato [ ]will find quite enough to live on, its tastes not being the same as the cereal’s. 206 “Thus we have two successive crops for one coating of manure: we have sacks of potatoes with no additional outlay in fertilizer. Is that all? Not yet. After the wheat and the potatoes there is, to be sure, but meager nourishment left in the upper layer of the soil; but in the lower layers there remains the part of the fertilizer that the rain has washed down and dissolved and that the short roots of the preceding crops could not reach. To utilize this underlying matter and bring it up again to the surface in the form of forage let us now sow a plant with vigorous roots, such as clover, sainfoin, or, still better, lucerne, which will penetrate deeper. And so we get our third crop. “After clover we can try a fourth crop, of a different kind; but it is evident that as the guests succeed one another at the same table the remnants become more and more scanty and difficult to utilize. Accordingly we must choose a hardy plant and one that is content with little. Finally a time will come, and at no very distant date, when the board will be bare: the coating of manure will have given up its last particle of nutritious matter. Then the table must be garnished afresh, the field fertilized anew before beginning again with the same crops or attempting others. Let us demand no more. You understand, my young friends, that in order to utilize to the utmost this precious substance that gives us every kind of food, such as bread, vegetables, forage, meat, [ ]fruit, dairy products—to make the very best use of this we must, instead of raising the same crop in the same field year after year, adopt the plan of varying our crops, changing from one of one kind to another of a different character, so that what earlier plantings have left in the soil may be turned to account by later ones. This succession of different sorts of farm produce is called rotation of crops.” 207 About HackerNoon Book Series: We bring you the most important technical, scientific, and insightful public domain books. This book is part of the public domain. Jean-Henri Fabre (2022). Field, Forest and Farm. Urbana, Illinois: Project Gutenberg. Retrieved October https://www.gutenberg.org/cache/epub/67813/pg67813-images.html This eBook is for the use of anyone anywhere at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this eBook or online at www.gutenberg.org , located at https://www.gutenberg.org/policy/license.html.

ROTATION OF CROPS

 THE ROOF SPACES

For the Story Teller: Story Telling and Stories to Tell, by Carolyn Sherwin Bailey is part of the HackerNoon Books series. You can jump to any chapter in this book here. Goody Two Shoes Goody Two Shoes SELECTED FOR ITS APPERCEPTIVE APPEAL Of course Goody Two Shoes was not her real name. In fact, her father’s name was Meanwell, and he had once been rich, and prosperous, and one of the most well-to-do farmers in the parish, but he lost his money. However it happened one could hardly tell, but his farm was seized, and he was turned out with his wife, and Tommy, and little Marjery, with none of the necessaries of life to support them. Care and discontent shortened the days of Farmer Meanwell. He was forced from his family and taken with a violent fever of which he died. Marjery’s poor mother died soon, too, of a broken heart, and Marjery and her little brother were left alone in the wide world; so they started off together, hand in hand, to seek their fortunes. They were both very ragged, and though Tommy had two shoes, Marjery had but one. They neither had anything to support them save what they picked from the hedges, or got from the poor people; and they slept every night in a barn. Their relations, who were rich folk, took no notice of them, because they were ashamed to own such a poor little ragged girl as Marjery and such a dirty little curly-pated boy as Tommy. But there was a very worthy clergyman named Mr. Smith who lived in the parish where little Marjery and Tommy were born; and having a relation come to see him who was a charitable man, he sent for these children. The gentleman ordered little Marjery a new pair of shoes, gave Mr. Smith some money to buy them clothes, and said he would take Tommy and make of him a little sailor. He had a new jacket and trousers made for Tommy, and he was soon ready to start for London. It was hard indeed for Tommy and Marjery to part. Tommy cried, and Marjery cried, and they kissed each other a hundred times. At last Tommy wiped off Marjery’s tears with the end of his jacket and bid her cry no more, for he would come to her again when he returned from sea, and he began his journey with the kind gentleman while Marjery went crying to bed. And the instant that Marjery awoke the next morning, the shoemaker came in with the new shoes for which she had been measured. Nothing could have helped little Marjery bear the loss of Tommy more than the pleasure she took in her two shoes. You remember she had worn only one shoe before, and a ragged one at that. She ran out to Mrs. Smith as soon as they were put on, and stroking down her ragged apron cried out, “Two shoes, Madam, see, two shoes!” And so she behaved to all the people she met, and she obtained the name of Goody Two Shoes. With Tommy gone there was not a great deal for Goody Two Shoes to do, so she made up her mind that she would learn to read. Now in the long ago days when this little girl lived, one had to pay quite a sum of money to go to a dame’s school and be taught how to cross stitch, and to bow politely, and to read. Only rich children could go, but Goody Two Shoes would meet the little boys and girls as they came from school, and learn from them and then sit down and read until they returned. After a while she had taught herself more than they had learned of the dame, and she resolved to go the rounds of all the farms and teach the little children who were too poor to go to school. And such a clever, pleasant way of teaching children to read as Goody Two Shoes invented! With her knife she cut some wooden sets of letters with which the children were to spell and make sentences by laying them together. These wooden letters she put in a basket and with the basket over her arm she became a little trotting tutoress who was known through all the countryside for her kindness and patience. Each morning she would start out at seven and run up to the door of a farmhouse. Tap, tap, tap! “Who is there?” the mother of the house would ask. “Only little Goody Two Shoes,” Marjery would answer, “come to teach Billy his A B C’s.” “Oh, little Goody,” the mother would cry, opening the door wide. “I am glad to see you. Billy wants you sadly, for he has learned all his lesson.” Little Billy would come out and have a new spelling lesson set him with the basket of letters, and then Goody would go on to Farmer Simpson’s. “Bow, wow, wow!” said the dog at the door. “Sirrah,” Mistress Simpson would say, “why do you bark at Little Two Shoes? Come in. Here’s Sally wants you sadly, for she has learned all her lesson.” Then out came the little one. “Good morning, Goody,” she would say. “Good morning, Sally,” Goody Two Shoes would answer; “have you learned your lesson?” “Yes, that’s what I have,” the little one would say, as she took the letters and spelled pear, and plum, and top, and ball, and puss, and cow, and lamb, and sheep, and bull, and cock, and hen. “Good,” said Marjery, and she hurried on to Gaffer Cook’s cottage. Here a number of poor children were met to learn to read and they all crowded around Marjery at once. So she pulled out her letters and asked the little boy next to her what he had for dinner. He answered, bread. “Well, then,” said she, “set the first letter.” So he pulled out a big B, and soon the other letters, and there stood the word as plain as possible. “And what had you, Polly Comb, for your dinner?” asked Goody Two Shoes. “Apple-pie,” answered Polly as she spelled her word. The next child had potatoes, the next beef and turnips, which were spelled with many other words until the lesson was done, and Goody set them a new task, and went on. The next place she came to was Farmer Thompson’s, where there were a great many little ones waiting for her. “Oh, little Miss Goody Two Shoes,” said one of them, “where have you been?” “I have been teaching,” said Goody, “longer than I intended, and am afraid I am come too soon for you now.” “No, but indeed you are not,” replied the other, “for I have got my lesson, and so has Sally Dawson, and so have we all,” and they capered about as if they were overjoyed to see her. “Why, then,” said she, “you are all very good; so let us begin our lessons.” She was indeed a wise and painstaking little tutoress for a long, long time. At last Dame Williams, who kept the village school for little gentlemen and ladies, became very old and infirm, and wanted to give up teaching. So the trustees sent for Little Two Shoes to examine her and see if she were able to keep the school. They found that little Marjery was the best scholar and had the best heart of any one who wanted to be the teacher, and they gave her a most favorable report. So Goody Two Shoes’ troubles and travels were over. She taught the dame school for the rest of her days, and never lacked for shoes or anything else needful. Oliver Goldsmith, 1765. Adapted. About HackerNoon Book Series: We bring you the most important technical, scientific, and insightful public domain books. This book is part of the public domain. Bailey, Carolyn Sherwin. 2018. For the Story Teller: Story Telling and Stories to Tell. Urbana, Illinois: Project Gutenberg. Retrieved April 2022 from https://www.gutenberg.org/files/58107/58107-h/58107-h.htm#Page_16 This eBook is for the use of anyone anywhere at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this eBook or online at www.gutenberg.org , located at https://www.gutenberg.org/policy/license.html .

Stories for Telling: Goody Two Shoes

Do you remember all the dating sites before Tinder came along? Match.com, eHarmony, OkCupid — the list goes on. What did they all have in common? The worst onboarding experience imaginable. I remember it like yesterday, the hours 21-year-old me spent setting up my OkCupid profile. Searching for photos, cropping them, uploading them, updating my preferences, writing and having friends edit short-form essay questions about myself — all of this just to using the service. start And then Tinder comes along. Login with Facebook and… you’re done. You went from 0 to actually fully productive and using the app in a matter of seconds. All your pictures are uploaded for you. Your name, age, and location are already pre-filled. All you need to do is update your preferences and start swiping. You could always add taglines or extra information about yourself later on, but it was not necessary to do this in order to using the product. I always loved that Tinder let the users experience the full value of the product right away and then later decide for themselves whether they wanted to invest more time into completing and “optimizing” their profiles. start So, if you were to ask me why Tinder absolutely demolished the other dating sites, I would tell you that its seamless onboarding had just as much to do with it as the uniqueness of its swipe left/right UX. How you do onboarding can truly mean the difference between an experience that turns new customers into loyal customers, and an experience that frustrates users and leaves them running for your competitors. Yet, what’s shocking is that new user onboarding remains a process few companies outside of gaming place enough focus on as early in the dev cycle as should be placed. very So how do you do user onboarding right? By no means do I have the magic recipe, but here is what I’ve learned over my years building onboarding experiences in mobile games: First step: keep it simple. Obviously, this is easier than it sounds, especially for the people who have been building the product from Day 1 and are now too “close” to the product to be a good gauge on what is “simple.” It’s understandable. You spend months and countless long nights building and fine-tuning your product, and in the process, you become so intimately familiar with it, you forget to make it approachable. The line between “complex” and “complicated” becomes blurred, and you take for granted the fact that users, opening up your app for the first time, don’t have the same knowledge and experience with it that you do. That’s why it’s so important to start thinking through and even building your onboarding process early on — you become too “close” and are no longer on the same playing field as even a sophisticated end-consumer. before Let’s look at Sketch as a great example of user onboarding. Sketch is basically an easier alternative to Photoshop, specifically catered to UI/UX design. The founders at Sketch knew that a sizable portion of Photoshop’s customers used the platform for UI mockups, so they made it a point to design their product and the onboarding experience in a way that would get these people productive as fast as possible — just like Tinder got its users “productive” as fast as possible. One example of how they did this was by creating prefab templates for all desktop and mobile device resolutions, as well as standard icon packs to use for iOS and Android. This was a mundane process that took an unnecessarily long amount of time in Photoshop that they completely removed and improved. Scott Belsky talks about his experience trying to improve Photoshop’s onboarding experience in his new book, He knew that Photoshop was a robust and innovative product, yet to even get started with using it was a huge obstacle for even tech-savvy consumers — a fact proven by the hundreds of YouTube videos detailing how to start accomplishing even the simplest tasks. The Messy Middle . Despite onboarding being literally the easiest part of your funnel to optimize, where Photoshop was losing a majority of potential users. Improving the onboarding experience, as it happens, was then one of the first things he did when he was put in charge of Creative Cloud. that’s Second step: have the user learn by doing. People learn best by doing, not by reading. The days of showing players endless streams of text to tap through is over. Not only do people not learn by reading these dialogue pop-ups (and often just tap-tap-tap to quickly skip all of them), but I have found text-heavy steps to be the #1 source of tutorial churn in mobile gaming. Unfortunately, this is what most startups resort to when they have an endless stream of tooltips pop up on the screen to explain different features of their product. And unfortunately, the decision to implement onboarding like this is likely a byproduct of trying to squeeze the onboarding in at the very end of the dev cycle. In gaming, because the tutorial is such a huge area of churn, the design of it always begins long before beta (or even alpha) versions of the game are released, and it’s continuously tested throughout the development process and post-launch. One of my favorite onboardings in gaming is in Destiny, which is a first-person shooter made by the same studio that made Halo. Instead of inundating users with typical in-game tutorial info that has to be learned all at once — press ‘Y’ to jump; pull the trigger to shoot — they drop the users immediately into the game environment and teach them how to play . The user presses a button or explores something new, and the game pauses and explains what exactly they just did, and how to do it again. experientially The user learns by actually doing something, and then repeating it. This is the right way to teach. The added benefit of teaching this way is that in no way does this onboarding experience feel like a tutorial, but rather just a fun part of playing the game. Third step: make your onboarding memorable by adding some delight and personality . In the gaming industry, teaching users how to play your game has to itself feel fun and actually like a part of the game. Even though it is a tutorial, it shouldn’t feel like one. You need to make it fun and engaging, not something mindless that users will just want to speed through and forget everything in the process. If you want to teach users something, you to make it something they will remember. need And one of the best ways I’ve found to do this is by adding a little to the process. delight If you look outside of tech and gaming, Virgin America does a great job of incorporating personality and delight into their onboarding starting from the check-in counter. You go to the Virgin America counter and there are purple mood lights glowing, red carpets, and light music playing; you step onto the plane and there are more mood lights and relaxing music; and then the flight begins, and they start their explanation of inflight procedures. But instead of doing the typical, mind-numbingly boring procedure that most airlines do where they mime how to put on your seatbelt, Virgin shows you a “music video” which is fun, attention-grabbing, and most importantly, memorable. In addition to using onboarding for just getting the customer familiar with functionality and procedure, they also use it to give the customer a feel for what type of brand they are. how onboarding should be done. That’s . This piece was originally published on Crunchbase

The Right Way To Onboard People Into Your Product

1 second video loops and polls let users explore the world around them in a blink. ’s beta is finally out. From the drawing board to conception, is now live on the App Store for the first users to try it out and get us feedbacks. queeklee Queeklee _‎*queeklee is an experiment with time, rather than with images and videos. With *queeklee you can create and share 1…_itunes.apple.com ‎Queeklee The idea is simple, almost virginal. The app, available only for iPhone, allows users to create and share 1 second video loops, called . queeks Each queek is associated to 1 hashtag and 1 location. The feed is not scrollable, rather the user swipes right or left to like or not like the queek and proceed to the next. It is a mechanism that many app users are very familiar with and that makes each queek an organic poll. With Queeklee, we wanted to go back to the origins of social media. No news whatsoever, real or fake. No audio. No filters. Remember Twitter and Vine? Twitter started the 140 character limit that allowed users to get smart with their tweets and get more creative. Then came with 6 second videos. While Vine has forever gone — even after a try earlier this year to revitalize it with v2 — the short videos were embraced by million of users that, to this day, want the app back. Vine Snapchat and Instagram stories have transformed the way we use social media. Every day we tap tap on hundreds of stories and often we go to the next before it even ends. After all our attention span is short. I remember attending a social media conference in Orlando, Florida were one of the speakers pointed out that the average attention span of humans is about 2.7 seconds, compared to that of fish at 2.8 seconds. Whether is true or not, social media has reduced our attention span and has changed our habits. We now scroll through feeds almost incessantly; we tap through story after story; we rarely watch videos more than a couple of seconds unless it really attract our attention; we see more news and ads than posts from friends and family. Now, Queeklee doesn’t really tackle this. Queeklee is an experiment on time and social curiosity. The idea is to fully embrace hyper-short videos, and scroll through as many as possible via a feed that invite the user to scroll right or left to proceed to the next video. Queeklee shows you posts from both people you follow, and users geo-located around you. Again, the idea is simple. We embrace social media limits to incite creativity and social curiosity. We now invite people to try it out and tell us what they think. Does it have a future? Is there a way to make it better? Do people hate it? Here’s the link to download it: https://itunes.apple.com/us/app/queeklee/id1435791152 Please, let us know!

The road to the Queeklee app

Photo by on Blake Connally Unsplash core runs multiple static analysis tools against code and reports back to the . Teams use multiple languages, which means tools are written in different languages and released in different ways. TeamCI’s check builder must account for the variety while being flexible enough to adopt new tools and languages. I also wanted empowered users to improve their tools. That’s why the is open source. Anyone can throw code on GitHub and label it open source, but that’s not enough context for people to start hacking away. This post walks through the code with examples. Beyond that, it’s just a fun example of what you can get done with elbow grease and spattering of Bash (long live the king). TeamCI’s GitHub Checks API check builder High Level Design I wrote about building the TeamCI in a previous post. It’s a good place to start if you’re unfamiliar with how TeamCI works. _How I saved time, effort, and built an MVP._medium.com Building a Faster MVP with GitHub Checks This post covers the technical details behind how TeamCI actually works. Each check ( , , , etc) is a Docker image. Using Docker makes supporting any language or runtime trivial. Docker Compose manages the configuration. Docker containers run with test code mounted at and shared configuration at . is also the working directory. Alpine based images are preferred. rubocop shellcheck eslint /code /config /code TeamCI checks as seen in Github. TeamCI uses to parse results and create . None of the tools output TAP that fits TeamCI’s requirements. Luckily, they all output JSON so each Docker image includes a program to convert JSON output to TeamCI’s TAP. TAP output Github Check Annotations TAP annotations results in action on PR diff Each Docker image includes a wrapper script. The wrapper script handles setting CLI options, parsing JSON to TAP, and determines the exit code. Example responsibilities are checking for files in and adding an appropriate and options. Wrapper scripts are named with postfix. So 's wrapper becomes . The wrapper scripts may do more than just set options, they may also specify files to test. They're also the Dockerfile's . In a nutshell, they're responsible for correctly invoking the underlying tool, outputting TAP, and determining the exit code. /config --config FILE --output -tap shellcheck shellcheck-tap CMD TeamCI uses three exit codes: for success 0 for failure of any kind 1 for skips (say running a Ruby linter, but there are no Ruby files) 7 Skip results can only be determined if the tool communicates the result via an exit code or output. Not every tool does this, so exit code is used in this case. Unfortunately this comes across as a "pass" instead of "neutral" in the Github PR UI. 0 A Check Suite as a Buildkite pipeline. Note that each check is step in the pipeline. Steps execute in parallel. TeamCI executes checks via . Using Buildkite removes the need to manage infrastructure. TeamCI uses the which provides scalable infrastructure and a functioning Docker stack. GitHub Check Runs trigger a Buildkite build. Each check runs as a build step. TeamCI receives a webhook on each completed step and communicates the result back to GitHub. Buildkite Buildkite Elastic stack Each check build step clones the test code and associated config repo and exports environment variables. The does all this since it's shared between all build steps. This results in slim build scripts. The build scripts run the relevant check with and volumes mounted at and . ORG/teamci pre-command hook docker-compose run /code /config Acceptance tests cover all checks. Acceptance tests are written with . Tests cover the , , and exit cases along with custom config cases (e.g. a config file exists in ). Tests run through a BuildKite which exports relevant Buildkite environment variables and executes hooks. Commands are stubbed in tests by executables in and appending to , thus taking precedence over real executable. The test suite to use fixture code instead of actual git repositories. The test suite wouldn't work without it. bats 0, 1 7 /config emulation wrapper test/stubs/bin test/stubs/bin $PATH stubs the git command Check Code Walkthrough _This PR adds stylelint. No prior configuration is required. The standard configuration file is used if…_github.com Add stylelint by ahawkins · Pull Request #10 · teamci/builder Let’s walk through a specific check to see how this works in practice. The stylelint PR is a good introduction. Let’s begin with the : tests @test "stylelint: invalid repo fails" {	buildkite-agent meta-data set 'teamci.repo.slug' 'stylelint/code'	buildkite-agent meta-data set 'teamci.head_branch' 'fail'	run test/emulate-buildkite script/stylelint	[ $status -eq 1 ]	[ -n "${output}" ]	[ "$(echo "${output}" | grep -cF -- '--- TAP')" -eq 2 ]	# Test for annotation keys	echo "${output}" | grep -qF 'filename:'	echo "${output}" | grep -qF 'blob_href:'	echo "${output}" | grep -qF 'start_line:'	echo "${output}" | grep -qF 'end_line:'	echo "${output}" | grep -qF 'warning_level:'	echo "${output}" | grep -qF 'message:'	echo "${output}" | grep -qF 'title:'	[ -n "$(buildkite-agent meta-data get 'teamci.stylelint.title')" ]} The first two lines are setup methods. TeamCI passes the git repo, branch, and commit via build metadata so the check code knows which code to clone. The two lines set values that map to a git fixture. live in . to implement the pattern. Fixtures test/fixtures/$REPO/$BRANCH git is stubbed The next line executes the check through the buildkite emulation wrapper, followed by assertions on exit code and output. This test asserts TAP output with correctly shaped annotations. The test covers the remaining success and configuration file cases. Here’s the test for a user provided configuration file: @test "stylelint: config file exists" {	buildkite-agent meta-data set 'teamci.repo.slug' 'stylelint/code'	buildkite-agent meta-data set 'teamci.head_branch' 'config_file'	buildkite-agent meta-data set 'teamci.config.repo' 'stylelint/config'	buildkite-agent meta-data set 'teamci.config.branch' 'config_file'	run test/emulate-buildkite script/stylelint	# The configured options should make the failing fixture pass	[ $status -eq 0 ]	[ -n "${output}" ]	[ -n "$(buildkite-agent meta-data get 'teamci.stylelint.title')" ]} The structure is the same except the provided configuration repo fixture. These test use fixture that fail using the default config, but pass with custom configuration. Thus, the expected result is . 0 The PR includes the expected code changes: A Docker image built from stylelint /stylelint A wrapper in stylelint-tap /stylelint A for converting JSON to in . tapify.rb tap /stylelint Additions to docker-compose.yml Additions to Makefile Tests in with corresponding fixtures. test/acceptance The “valid repo passed test” may also litter the fixture with irrelevant code files. Stylelint test stylesheets (e.g. ), so a stray Ruby file in the code directory should not cause a failure. Testing this depends on the tool. Stylelint requires an explicit lists of files, so a glob is used. However this isn't the case for something like PHP CodeSniffer which detects php files itself. **/*.css Wrap Up Adding a new check is straight forward once you understand the structure. I start by copy and pasting from the most recent check, since they’re all similar enough. Then I tweak the tests, wrapper, and . I start by testing exit code 1. This allows me to test the tools work as expected and to inspect the JSON output. It's easy to tweak afterwards. Then it's head down grunt work to create passing fixtures, config file cases, and the Docker image. -tap tapify.rb tapify.rb Adding a new tool is the easiest when: The tool automatically detects testable files An explicit config file may be provided The tool prints JSON to standard out Errors and extraneous information print to standard error The tool signals (via exit code or output) that no testable files were found There’s some way to exclude files I had fun writing the builder. It’s a straight forward task, plus the acceptance test suite gives me plenty of confidence. The experience also surfaced my preferred semantics in these tools. So what do you think? Want to add your own check? Feel free to send a PR and make TeamCI more useful for you. If not, then at least you learned that TDD with Bash (long live the king) is possible — and fun. during the beta. Test TeamCI for free _Automatically test team code repos against team coding standards._teamci.co TeamCI - Enforce Team Code Standards

Inside TeamCI's Check Code

Author Note: This write-up will not examine any new vulnerability. Rather, it explores a common methodology used in trivially hacking iOS apps, in which you perform a man-in-the-middle (MitM) attack on yourself. Additionally, you will need a perfunctory knowledge of man-in-the-middle attacks, SSL, and the HTTP protocol. It was written for a general audience, so some examples have been simplified for the purposes of the article. Common design patterns As an iOS developer, you often want to push updates/changes at a faster rate than Apple will let app updates through. Additionally, often there will just be small changes (literally a couple bytes) that would require all your users to download the updated binary, which could be hundreds of megabytes in size. If there are certain parameters that you change often, then it might make sense to pull them remotely. A simple change to a config file on your server allows you to propagate your changes quickly and efficiently. However, if the parameters being set in-app are critical, it could open your app to vulnerabilities and MitM attacks. This is most commonly found in mobile games, apps with p2p requirements, and apps that have aspects that require quick updates (news, social media, etc.) Intercepting the requests As a mobile device developer, one might not initially think that intercepting their network requests would be easy, and that simply using https would be enough to stop anyone from snooping around. However, when you are dealing with interconnected models that require frequent updates, you open yourself up to an entirely new vector of attack — when users perform man-in-the-middle attacks on themselves. Although there is no method to completely prevent users from intercepting their own connections, there are a few design patterns that can mitigate this risk. As a proof of concept, take a look at Tap Tap Reborn. Roughly 500k users, with an active community outside of the game, and comparatively expensive in-app-purchases (20$ for premium, and $10 for 750 “gems”). . Additionally, in newer versions of iOS you will need to allow full trust for root certificates, by going to Settings -> General -> About -> Certificate Trust Settings. To intercept iOS network requests, I’d recommend following the guide by PortSwigger On initial load of the app, it attempts to download configuration files from an EC2 instance — no verification or validation of the input. These dictate everything from default settings, available songs, point levels required, and “rewards” for each action. Example config file that tells the app how much EXP is required for each level There is not any sort of verification of the contents of these configuration files. Additionally, each time the app is run it updates the server with a large JSON object containing all of your details. Again, no verification or encryption. POSTing updates to the server for games you’ve played since last update The real kicker is that the app, on-load, will update the server with progress you’ve made since last signing it. It doesn’t do these updates as event based, either (as in, if you played 3 songs it submits 3 events with the details of the songs, and tallies up your XP) — instead, it just accepts a large JSON profile object. The server blindly accepts anything that is sent through. Changing values here reflect accurately server-side! Therefore, intercepting a single request and modifying the values, then clearing the app and re-signing in through Facebook will allow you to set your gems, level, and XP to anything you’d like. You can also set yourself to premium, as an alpha user, and your high score for each song. Through this method, one is easy able to become the #1 player in the world, and give themselves an arbitrary amount of in-game currency. That amount of gems is equivalent to Now of course it’s not actually worth anywhere near that amount, but it’s easy to imagine how, on a more critical or SaaS product you could easily rack up charges due to non-verification of payment or purchase. $187,000. Possible Solutions How should one fix this problem? We will explore a few common ways that are used to mitigate this attack vector. Hash the contents and verify Difficulty to break: Trivial Difficulty w/ embedded salt: Medium One of the first solutions to this problem was to include a hash along with the data, and would look somewhat like this: This is great for testing the validity of your information and that there was not corruption, but it falls short of being a valid method — all you would need is to rehash the information and replace the hash before forwarding the packet to the device. security This becomes somewhat more viable when you have a have a salt that is embedded in your binary. This is more formally known as “shared key” types of encryption. For instance, if you appended “My$ecure$@lt” to the end of your data before you verified it against the hash, it would prevent any pure man-in-the-middle attack. The attacker would have to decompile and inspect the binary, which is feasible but requires more effort and knowledge than a simple MitM attack. What the hashing/verification would look like internally to your iOS application — it would append the salt, then hash it and verify against the provided hash. This is a “shared secret” method of encryption. Through the use of an obfuscator, , this method can become even more secure. It still would not stop a dedicated attacker, however. like Obfuscator-iOS Custom Encryption Difficulty to break: Medium/Hard This is more along the lines of obfuscation than clear and open design, but it will provide a non-trivial roadblock to most attackers. This pattern would involve encrypting the contents of your data somehow. This could range from a simple encoding (base-64) all the way to PGP, or even rolling your own encryption ( ). This would again require some form of key hidden in the binary, which is not impossible to reverse engineer and extract. which I do not recommend — a system is not secure until it has been exhaustively attacked This will thwart all but the most dedicated attackers. A pure MitM attack will not suffice, and will require significant knowledge to figure out how to decrypt. Cons to this approach are that it’ll require significantly more computing resources, and that it adds another layer of abstraction to your system. Certificate Pinning Difficulty to break: Difficult Certificate pinning involves verifying that the certificate in which your information is encrypted/returns matches a known set of certificates — that is, it has not been “swapped out” in between. This is arguably one of the most secure methods to prevent MitM attacks — the device will not accept any connection that is not signed by the embedded certificates. The only way to bypass this would be to jailbreak the device, and manually disable SSL verification or replace the embedded certificates with Burp Suite’s. This would require a much more sophisticated level of attack, and if your device is jailbroken/rooted then there are multiple other attack vectors to take into consideration. Better Architectural Design The best methodology for a secure system is to design it from the beginning with security in mind. This means securing your endpoints, and making conscious decisions for what information should be renewed each session, as well as how many levels of verification should be required at each stage. It involves having a more abstract, security-conscious view of your application, and what attack vectors it may have. In the example above, minimizing these vectors would mean requiring as little information as possible be refreshed each session, and not pull certain critical components from live-config. Applicability and Further Research Man-in-the-middle attacks are not anything new —this is more of an application of a security paradigm than a ground-breaking revelation. However, as a developer you are often more focused on preventing an outside attacker from compromising your users data integrity than from a MitM attack performed by your users themselves. Snapchat and Facebook already implement certificate pinning, as it is one of the most reliable and secure methods of preventing any 3rd party from modifying the data in the middle of the connection (as of the writing of this article). It’s not impossible to circumvent (see for jailbroken devices), but at that point an attacker would have access to a lot more than a single HTTP connection. iOS Kill Switch This write-up was meant to illustrate a common bad design pattern, and on how relying solely on SSL/TLS for your iOS app can lead to consequences, ranging from loss of revenue to full compromise of your application. This is especially true on iOS, where it is easy to simply rely on Swift’s HTTP requests without considering a user replacing the certificate with one of their own.

Stories, News & Mentions about TAPTAP

Taptap’s Stories on HackerNoon

Taptap's News & Mentions