Samsung Galaxy S21 series pre-order reservations now open in the US – Android Authority

Samsung has opened up pre-order reservations for the next Galaxy flagships aka the Galaxy S21 series in the US.

First spotted by XDA Developers in the Samsung Shop app, the reservations for the upcoming phones can also be made through this link on Samsungs website.

Get ready to jump to the next galaxy, reads Samsungs promotional webpage for Galaxy S21 reservations. Those who sign-up for the pre-order notifications via the website will get $50 in instant credits towards buying accessories for the Galaxy S21, S21 Plus, of S21 Ultra.

An extra $10 instant credit will be given to those who complete their pre-order using the Samsung Shop app.

Youll need to share details such as your name, email ID, phone number, and ZIP code to reserve your Galaxy S21 pre-orders. You can also select your preferred carrier or choose to get pre-order notifications for unlocked models.

Samsung has included a trade-in option that can fetch you an instant credit of up to $700 if you exchange your old phone for one of the new flagships. For instance, if you want to trade in any of your Galaxy S20 or Note 20 models, youll get the full $700 instant credit provided your device meets Samsungs trade-in criteria.

As per Samsungs website, the pre-orders for the Galaxy S21 phones will last till January 28, 2021. However, the reservation credit offers are only valid for customers who reserve their pre-orders till January 13, 11:59 PM ET and complete their pre-orders between January 14, 2021 and January 28, 2021. This sort of confirms that Samsung will launch the Galaxy S21 series on January 14 as expected. It also means that you can expect the phones to start shipping only by the end of January.

You can read all that we know about the Samsung Galaxy S21 series here. Some fresh details about the specs of the Galaxy S21 and S21 Plus also leaked recently. You can read those here.

Read the original post:

Samsung Galaxy S21 series pre-order reservations now open in the US - Android Authority

SD Times Open-Source Project of the Week: Micro – SDTimes.com

Micro is an API backend that allows developers to write code without worrying about managing backend services as well.

Micros team believes that developers should be empowered to build software at an accelerated pace without any limitations.

Too much time is being lost on walking the maze that is the CNCF landscape. Too much time is being lost to managing the complexity of cloud infrastructure. Developers need to get back to what matters, absolute productivity in the software theyre building. For us that means making backend developers super productive, the projects documentation states.

Key features of Micro include authentication, configuration management, key-value storage, an API gateway, service discovery, and PubSub messaging.

In addition to the free open-source project, there is also a managed version called M3O. The free version includes the ability to deploy from Git, connect from anywhere, zero infrastructure management, public API and private repository support, and a shared hosted environment. M3O adds perks like 2x increased resource limits, Slack and email support, and business day SLA response time.

The team also recently introduced Micro Services, which offers a set of building block services that can be used in Micro. The initial release includes 10 services: Helloworld, chat, posts, comments, tags, feeds, location, messages, notes, and users.

Continued here:

SD Times Open-Source Project of the Week: Micro - SDTimes.com

Covidius horribilis: Business winners and losers of 2020 – The Irish Times

How do you weigh up the annus covidius horribilis of 2020 in words that dont have to be asterisked?

It was a year when a virus inflicted a brutal end on some businesses, and tortuous stop-starts or finance-draining freezes on others. Some were able to pivot to survive, others found silver linings amid the spike proteins. But for many the pandemic was the kind of extended disaster for which no amount of crisis planning could have helped.

Good King Wenceslas himself would have looked out the window at the state of 2020 and crawled back under his duvet.

With uncertainty the new certainty, employment was often precarious by default and forward-looking statements were rendered works of speculative fiction. By the time the second wave came along, once-buoyant businesses seemed weary and depleted and in the most Covid-wracked sectors, the despair was palpable.

Ryanair is the biggest airline in Europe, which in normal years is great, but in 2020 put it on the front line of an aviation standstill. At the start of March, Michael OLearys airline cut a quarter of its flights to and from coronavirus-hit Italy for three weeks because bookings had plummeted amid passenger nerves and a blizzard of travel advisories.

On the same day, Leo Varadkar assured that there were no plans to cancel the St Patricks Festival, but with the caveat that March 17th was still two weeks away, and a lot can happen between now and then.

Indeed, by the time St Patricks Day came round, Ryanair was stripping back its schedule by 80 per cent, three-quarters of Aer Lingus flights were not taking off and struggling regional airline Flybe, which operated four in five of the flights at Belfast City Airport, had collapsed into administration.

Ryanair flew into the pandemic with a relatively strong balance sheet but it still could have done without the tripling of its debt and a winter travel write-off that brought the closure of its Cork and Shannon bases. By this point, OLeary was railing against what he saw as government mismanagement of EU air travel.

Any holidaymakers who made it to Ireland this summer were at high risk of becoming prime Liveline fodder, which was bad news for hotels, restaurants and everyone from Airbnb hosts to the company behind the Viking Splash.

At the pub end of the hospitality trade, the bleakness was unavoidable. In Dublin, the third of pubs that werent in a position to produce 9 chicken wings never reopened while, outside Dublin, almost half of pubs could only do so for a fortnight.

For companies dependent on the night-time economy, dawn was forever postponed. How many people do we have to marry to open this place, read the signage on the Academy gig venue.

The Press Up hospitality group, which has built a veritable empire of 55 restaurants, bars and hotels, wasnt the only company aggrieved at public health policy, but it was the one with both the desire and resources to mount a legal challenge. The group, run by Paddy McKillen jnr and Matt Ryan, sued the Government, seeking both compensation and a High Court declaration that the restrictions were an unconstitutional interference in its business.

So could pubs forced to close claim on their insurance for business interruption? Not if FBD had anything to do with it. Despite the assurance of cover that one of its executives accepted he had given Lemon & Duke publican Noel Anderson, FBDs position was that it did not offer pandemic insurance and never had.

Early 2021 will bring a High Court judgment on four test cases brought by publicans, including Anderson, on FBDs refusal to pay out. But even if FBD wins, the dispute has left the bitterest of tastes.

With one-time office workers dispersed to attic desks and ironing-board workstations, it wasnt the best of years to be big in the food on-the-go market. As Christmas neared, Greencores website hosted an animated corporate video showing a tree being decorated with sandwich packs, which was certainly one use for them.

In November, as the Dublin-headquartered company conducted a share placing to raise cash, chief executive Patrick Coveney said Greencore had been absolutely smashed by the first lockdown and would not recover until at least 2022. Indeed, it was still reeling from the spring slump in sales of its pre-packed sandwiches when almost 300 workers at its Northampton factory tested positive for the virus.

In retail, it was a tale of two categories, essential and non-essential. Supermarkets rose to the challenge, their staff effectively becoming front-line workers during the first lockdown. Later, DIY chains like Grafton-owned Woodies were the beneficiaries of a home improvement boom: with nowhere to go, nesting was in vogue.

But for other bricks-and-mortar retailers, 2020 was miserable, and the list of casualties was long: Oasis, Warehouse, Monsoon, Pamela Scott, Mothercare Ireland and Cath Kidston all disappeared from Irish streets, while the administrators of Topshop owner Arcadia spent December trying to find buyers for its fashion brands.

The biggest loss, however, was department store chain Debenhams. The liquidation of its Irish operations in April inspired protests from former staff shocked that their years of service would not be treated with the respect of a redundancy payout.

Their fight was not entirely in vain: after an invention by a mediator, the Government will set up a 3 million training and upskilling fund to assist the 1,200 workers who lost their jobs. But the sad sight of black sacks covering the Debenhams sign on Dublins Henry Street, one sack for each letter, summed up the sorry end.

The surge in working-from-home / living-at-work was good news for those telecoms companies that could keep up with demand. Alas, this was not the case for Eir, which provided a textbook example of Covid-19 exposing organisational weaknesses that long predated it.

Frustrations about former State monopolys shortcomings on customer service spilled over in a year in which many people across the State were dependent on a decent broadband signal to keep their jobs and see their grandkids. Complaints rocketed exponentially.

We have never had fantastic [customer] care in Eir, admitted chief executive Carolan Lennon as she apologised for below par service. Unfortunately, her explanation of the challenges in bringing the function in-house included a declaration that establishing a customer care centre on a greenfield site in Sligo had been a mistake. Suffice to say, the remark did not go down well in Yeats country, where CEOs are best advised to tread softly.

Incredibly, there were some who had a 2020 to forget for reasons unconnected to Covid-19. Such was the case for the perennially under-resourced Data Protection Commission (DPC), led by commissioner Helen Dixon, which made Twitters day by fining it a mere 450,000 for a December 2018 data breach in which it inadvertently made some users private tweets public. Insert screaming-with-horror-face emoji here.

With this first fine under the EUs General Data Protection Regulation (GDPR) a mere 0.016 per cent of Twitters 2019 revenue, other more punitive-minded EU regulators are now said to be exploring ways to get around the DPCs status as lead regulator for the tech giants that have their European headquarters here. If they do, the office may no longer seem quite so under-resourced.

One leading Irish business, meanwhile, had its inner workings on dismal display at the London inquiry into the 2017 Grenfell fire tragedy in which 72 people died.

Kingspan chief executive Gene Murtagh told employees that it would take time to rebuild trust in the building materials company after undeniable historic shortcomings were revealed at the inquiry, which heard that Kingspan had some years previously relied on results from flawed safety tests to market its Kooltherm K15 insulation product. Some of it was used on Grenfells cladding.

The inquiry has not yet concluded, but Kingspans internal communications to surface in recent weeks including one senior figures suggestion that a builder who questioned K15s safety should f*** off have been distinctly grim.

But before we bin 2020 never to discuss it again, lets also look back on those who managed to rack up a bright note or two amid the general gloom.

It is 31 years since Anne Heraty co-founded recruitment company Computer Placement Ltd, better known as CPL, and 21 years since it was floated, making Heraty the first female chief executive of an Iseq stock. In November, CPL agreed to be taken over by Japanese group Outsourcing for about 318 million in an all-cash deal.

That put Heraty and her husband and fellow director Paul Carroll in line to receive 110.9 million for their combined 34.9 per cent stake. Not bad in the middle of a global recession.

Indeed, this was a positively upbeat year for Irish tech sector, which was cutting deals with the sort of modest confidence in which the numbers did the talking. Back in the before-times (January), for instance, Irish chipmaker Decawave was sold to US-based Apple supplier Qorvo for $400 million (361 million), putting its staff in line to share a 54.4 million payout.

The company, founded in 2007 by Ciaran Connell and Michael McLaughlin, specialise in a sort of Bluetooth on steroids that is now being used in iPhones. It has become a big boys game, said Connell.

Also sticking them with the pointy end was, well, Pointy. The company that helps small retailers make their online stock visible, founded by Mark Cummins and Charles Bibby in 2014, was sold to Google for a reported $160 million (135.9 million).

Amazingly, this was the second time that Cummins, who was once turned down for a job at Google, had found a buyer in the tech giant, which had earlier acquired his start-up Plink in a life changing deal.

Elsewhere, Apple acquired Peter Cahills voice recognition company Voysis for an undisclosed sum and is now using its technology to help improve its virtual assistant Siri, while 2017 Young Scientist winner Shane Curran raised $16 million (14.5 million) from Silicon Valley investors for his data privacy tech company Evervault an impressive achievement to rack up before you have even hit your 21st birthday.

Nine-year-old Waterford software solutions company NearForm, led by co-founder Cian Maidn, had a 2020 to remember thanks to its work with the HSE on the Covid Tracker Ireland app.

After getting the call on the sunny Sunday afternoon of March 22nd, the NearForm team pushed hard into the night to present a prototype the next morning and, after three months of intense yet fully remote development, the app was ready. Within 36 hours of its launch on July 7th, it had been downloaded more than one million times.

The apps open source code, Covid Green, is now being used around the world and, yes, the company is hiring. We did something really good this year at NearForm we really did, Maidn tweeted in December. So proud of everyone.

Its enough to make even the most jaded of hearts feel emotional.

Never Mind the B#ll*cks, Heres the Science could scarcely have been a more timely title for the bestselling new book by immunologist Luke ONeill. Prof ONeill was one of the leading voices on Covid-19, but he was in the news for another reason after Swiss drug giant Roche paid $380 million for Inflazome, the inflammatory diseases treatment company he co-founded in 2016 with Australian chief executive Matt Cooper.

The money was obviously nice, Prof Cooper told The Irish Times, but it wasnt what had motivated the biotech entrepreneurs. We do what we do because there are people that need the medicines and thats the most important thing.

Inflazome was the product of something that couldnt happen for most of 2020: a chance meeting in a bar after an international medical conference. For all the addictive magic of Zoom, the business world will see in 2021 hopeful that vaccines will bring about a return of lanyard-wearing days, airport priority queues and opportunistic coffees.

Reclaiming the ability to move safely around the world, free of the cycle of lockdowns and reopenings and without fear of sudden border closures, has never felt such a huge ambition.

Link:

Covidius horribilis: Business winners and losers of 2020 - The Irish Times

The Top Web Service Exploits in 2020 – Security Boulevard

Join us for a look at 2020s top ten most prevalent exploits targeting web services leveraged in large scale attacks or reconnaissance campaigns as seen by Radwares Threat Research Center.

The Threat Research Center monitors and researches malicious traffic and vulnerability exploits using Radwares Global Deception Network, which is a network of globally distributed darknet deception agents honeypots running services that attract bots attempting to compromise, abuse, hack into computers, create new botnets and launch DDoS attacks. The deception network attracts hundreds of thousands of malicious source IPs that generate millions of events daily. The automatic analysis algorithms provide insights and categorization of various types of malicious activity from reconnaissance through password brute force attempts to injections and RCE.

Radware proprietary and patented algorithms running on the deception network are used to catalog and identify new and emerging threat actors, including web application attackers, botnets, IoT bots, and DNS attackers, as well as to analyze malicious behavior designed to hide the attacker such as spoofing and anonymizing.

Lets drill down into the top 10 Service exploits identified in 2020:

74.85% of all web services hits.Apache Hadoop Unauthenticated Command Execution via YARN ResourceManager.

Hadoop is an open-source distributed processing framework designed to manage storage and data processing for big data applications running in clustered systems. In October 2018 Radware discovered the DemonBot, a malicious agent designed to run on vulnerable Hadoop servers. The original bot was first seen in Radwares Threat Deception Network in September 2018 scanning and trying to execute the request to /ws/v1/cluster/apps/new-application, which is the first step to exploit exposed unprotected Hadoop server, today though rarely seen in the wild, its successors take first place in scanning attempts.

What is the risk? A successful attack could allow an unauthenticated attacker to execute commands on the vulnerable server which may lead to data leakage and complete takeover of the server.

[You may also like: Hadoop YARN: An Assessment of the Attack Surface and Its Exploits]

11.27% of all web services hits.Apache Tomcat Manager Application Upload Authenticated Code Execution.

Apache Tomcat is an open-source HTTP web server written in Java under license Apache License 2.0. This module can be used to execute a payload on Apache Tomcat servers that have an exposed manager application. The payload is uploaded as a WAR archive containing a JSP application using a POST request against the /manager/html/upload component.

What is the risk? This vulnerability can allow an attacker to abuse the server in many ways such as steal users data, use the server resources for crypto mining, establish continuous control over it, and/or use it to hack another server.

6.9% of all web services hits.Cisco routers without authentication on the HTTP interface.

Cisco Systems, Inc. develops, manufactures, and sells networking hardware, software telecommunications equipment, and other high-technology services and products. In Aug 2002 Cisco released Cisco IOS 11.2 for Cisco routers which offered a new HTTP interface that provided an HTTP 1.0-compliant Web server in the IOS. This HTTP server allowed a user to execute commands directly from a URL. Attackers keep trying to find the unprotected Cisco routers, those without authentication on the HTTP interface.

What is the risk? An exposed router may allow a remote unauthenticated attacker to execute commands directly from a URL to receive configuration files of Cisco routers, scan an internal network, and detect additional devices in the NAT. This activity can allow an anonymous attacker to explore and abuse the internal network hidden after a compromised router.

[You may also like: FireEye Hack Turns into a Global Supply Chain Attack]

1.56% of all web services hits.Sangoma FreePBX multiple vulnerabilities.

Sangoma FreePBX is a web-based open-source graphical user interface, GUI, that helps to install and configure an Asterisk-based (a voice over IP and telephony server) open-source phone system on a server or virtual environment. Starting in 2018, many requests for the resource /admin/assets/js/views/login.js were identified and captured in Radwares Threat Deception Network. This resource belongs to Sangoma FreePBX code and it looks like the attackers are trying to detect vulnerable FreePBX servers and exploit one of the known vulnerabilities.

What is the risk? The compromised server can be used to steal users data, crypto mining, or any other malicious usage.

1.2% of all web services hits.WIFICAM web camera multiple vulnerabilities.

Many cheap Wireless IP web cameras use the same genetic code based on the GoAhead code (the tiny, embedded web server). This code includes multiple vulnerabilities where the most serious one is command injection.

In May 2017 an article was published about the Persirai botnet which exploits the vulnerabilities of these cameras to spread itself and launch high volumetric distributed Denial-of-Service (DDoS) attacks.

What is the risk? This vulnerability allows a remote attacker to inject arbitrary commands and achieve a complete takeover of the camera. Spying the videos received from the camera, steeling the video records, usage the camera to explore the internal networks all those are a small part of possible activities available to attackers.

0.92% of all web services hits.Sonatype Nexus Repository Manager Remote Code Execution.

Nexus Repository Manager is an open-source Repository Manager that allows to a proxy collect and manage dependencies developed by Sonatype. In 2019-02-05, Sonatype Security Team released a Critical Security Advisory which covered CVE-2019-7238. Affected versions are Nexus Repository Manager 3.x OSS/Pro versions up to and including 3.14.0.

The vulnerability, CVE-2019-7238, allows a remote attacker to inject and execute code on the server that could potentially affect confidentiality, integrity, and availability by sending a specially crafted request to the Sonatype Nexus Repository Manager server. For further information see here.

What is the risk? In addition to other usages of the Remote Code Execution Vulnerability, in this case, there is an additional dangerous scenario an attacker can inject any code into the code storage and affect any product in its development stage.

0.48% of all web services hits.Apache Solr Directory traversal vulnerability.

Apache Solr is an open-source enterprise search platform built on Apache Lucene. On May 30, 2013, Apache foundation published security issue SOLR-4882 with was related to CVE-2013-6397, the affected version was 4.3. The issue was resolved in version 4.6 and a patch from September 21, 2013.

What is the risk? The vulnerability, CVE-2013-6397 allows a remote attacker to read arbitrary files on the Solr server via the tr parameter. This, when combined with other vulnerabilities, may lead to remote code execution on the victim server. Attackers are scanning the internet using the above URL to find the old and unpatched Solr servers that are still vulnerable to CVE-2013-6397. The attacker can use the potential of the Remote Code Execution on a compromised server.

[You may also like: Youre Only As Protected As Your Providers SOC]

0.42% of all web services hits.PHPUnit testing framework for PHP Remote Code Execution.

PHPUnit is a programmer-oriented testing framework for PHP language. Like other unit testing frameworks, PHPUnit allows PHP developers to find mistakes in their newly committed code. In Jun 2017, CVE-2017-9841 that addresses the vulnerability was issued.

What is the risk? The vulnerability, CVE-2017-9841 allows a remote attacker to execute arbitrary code on an affected PHPUnit server. A remote unauthenticated attacker can send a malicious HTTP POST request to /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI, which may lead to a complete takeover of a vulnerable PHPUnit server.

0.4% of all web services hits.Hudson continuous integration tool multiple vulnerabilities.

Hudson is a continuous integration tool written in Java, which runs in a servlet container, such as Apache Tomcat or the GlassFish application server. Over the years the project was replaced by Jenkins. The final release. 3.3.3 was on February 15, 2016. Today Hudson is no longer maintained and was announced as obsolete in February 2017.

What is the risk? Since Hudson is still in use (albeit it is no longer maintained), attackers keep trying to find and identify Hudson servers to attack unhandled security vulnerabilities.

1.99% of all web services hits.

In addition to the new items that we covered in this list, we have also seen items that we already saw and covered in our previous blog Top 10 Web Service Exploits in 2019 such as /ctrlt/DeviceUpgrade_1, /TP/public/index.php and /nice%20ports%2C/Tri%6Eity.txt%2ebak.

A whopping 75% of the hits in Radwares Deception Network were attempting to exploit the Apache Hadoop vulnerability, a well-known vulnerability from 2018 that was covered in Radwares blog New DemonBot Discovered. Today though DeamonBot is a rare sight, its successors and many other malicious bots are still exploiting this vulnerability.

As for the other attacks, although the trending vulnerabilities that attackers choose to exploit have changed, the focus is the same as last year. It is not necessarily on new attacks and new attack vectors as one would expect, but rather on popular technologies and devices with known and easy to exploit vulnerabilities, going back to vulnerabilities initially reported in 2013.

Organizations that lag so far behind with upgrading or patching these vulnerabilities, are recommended to implement patches on their assets as soon as possible.

Download Now

Read the rest here:

The Top Web Service Exploits in 2020 - Security Boulevard

DevSecOps: The good, the bad, and the ugly – Security Boulevard

DevSecOps offers benefitsbut it also has its challenges. Learn why companies are making the shift and why its not always easy.

DevSecOps is the practice of integrating security into every stage of the DevOps pipeline. It unites development activities, operations support, and security checks, and coordinates the teams involved in the software development life cycle (SDLC). The synergy between the teams is helped by automation.

But DevSecOps isnt a quick fix or a temporary solution. Its a long-term implementation that helps ensure that an organization can achieve and maintain secure SDLC practices. It requires development teams to follow a standard SDLC process to guarantee that security issues are addressed early on, when they are easier to fix.

In the DevSecOps paradigm, developers maintain versions of their code and follow a peer review process before it can be moved to other environments. No one person or team has full control over how updates are made in the code/environmentseparate teams are responsible for development, testing, deployment, and so on.

The operations team supports the entire development process, including maintaining and updating the operating environment, defining and implementing a deployment process, and logging every detail of the DevSecOps process.

The security team identifies and eliminates any vulnerabilities. Should a vulnerability reach production, DevSecOps processes provide a clear trail of when and how it got there. In traditional coding processes, the process of deploying an application to production starts with changes to code, but in DevSecOps, building, testing, and security scans start earlier and require other activities to complement it, such as design reviews and postproduction monitoring.

There are many tools that offer various types and combinations of services, but there is no single tool that can provide a DevSecOps process. Some vendors that offer static application security testing (SAST) tools are now adding software composition analysis (SCA) tools (and vice versa), but DevSecOps is more than just performing scans.

Its also important to note that no one tool fits in all environments, and often no one tool fitsall companies. In addition to application testing tools, DevSecOps processes require reporting tools, defect tracking/management tools, environment building tools, and more. Also please note that security, build, and metric collection activities are not restricted to just the tools available in the market. Even scripts (Shell, PowerShell, Python, etc.) offer various capabilities.

In DevSecOps any changes to code will trigger activities such as SAST or dynamic application security testing (DAST) review, architecture review, pen testing, and so on, which in turn trigger scans, which in turn generate metrics and reports that can make or break deployment. And all that happens in minutes or even secondsand that speed enables teams to scale up.

Security teams are often short of resources, but they still hold responsibility for stopping bad actors from taking advantage of vulnerabilities. As development teams move toward more multifaceted, multipronged agile methods, DevSecOps processes help security teams share the responsibility of building security into the CI/CD workflow with everyone involved in the SDLC process. Introducing security testing earlier in the SDLC enables developers to fix security issues in their code in real time to avoid costly delays.

DevSecOps lets you do a lot of work quickly. Speeding things up, reducing delays, and enabling scalability are some of the biggest advantages. With global teams dispersed across many different time zones, organizations need processes and frameworks that foster collaboration while reducing dependencies to help teams achieve their goals.

Often, different teams work in independent silos, and these fragmented environments make it difficult to ensure consistency while still allowing each team the independence their processes require. How can teams get aligned on a goal if theyre unable to change their entire development process? Is gradual change better than full-blown change in implementation?

DevSecOps can address these issues and more. No matter how mature an organizations security level isor how fragmentedDevSecOps makes it possible to initiate and implement security activities and adapt to different functional teams.

You may have heard the saying, Security isnt one persons responsibility, its everyones responsibility. DevSecOps involves everyone in the process and practices of ensuring security. Developers, app managers, ops teams, security teams, reviewers, and testers all have an important role to play.

The fast-paced world needs fast-paced solutions. DevSecOps eliminates manual steps and dependencies, so the entire process is completed faster and sooner.

The power of acceleration in DevSecOps can be seen in the example of a company that received a request to onboard and scan 30 microservices two days before production. By leveraging automation, the team was able to complete this request in two hours. Think of that: onboard 30 new microservices on two tools, run the scans, evaluate them, and triage the scan resultsall in two hours.

With often less than a week to move through the entire SDLC, there is little time to address security processes. Thats why many security tools today have improved in terms of how quickly a scan can be run, and many provide capabilities to customize a scan so you can select the checks to run, further optimizing scan time.

One of the reasons DevSecOps is so popular is that it enables security teams to scale with limited bandwidth. The automation inherent to DevSecOps is critical to a firms ability to support many applications even with a limited security team. For example, a team of four was tasked with SAST reviews and signoffs, but since it was done manually, it could only support 200 apps. But with automation and security integration, the team was able to scale up to 700+ apps in a few months and support reviews for each of them.

Organizations may want to transition from one tool to anotherand sometimes that involves 1,000 apps or more. Does that sound like a nightmare to you? In DevSecOps, jobs are run through a common library of scripts, and because those scripts are shared across all jobs, you can transition easily from one tool to another. Updating a common set of instructions with the new tasks or replacing existing tasks makes it easy to propagate these changes across all applications instead of making changes in each job.

In DevSecOps, processes are interconnected and automated, so its easy to see if a change results in an issue or problem. This level of traceability makes it easier to hold people accountable for their changes. It also encourages developers to be more careful about writing secure code, helping prevent the pipeline from breaking. Projects can also be set up to send emails to the entire development team at specific milestones, such as when the job is completed or when the team has met or failed to meet the security requirements. When a change triggers a scan, the emails can specify who checked in or created the changes that triggered the scan.

Automation can be used to trigger builds, scans, deployment, evaluations, and approvals. When these tasks are automated, security teams can focus on other important activities rather than the operations of it all. For example, if an organization has 700 apps, it would be difficult for a security team of four to monitor regular releases manually. But automation can greatly reduce the workload.

As mentioned earlier, organizations often have teams spread across several different time zones. The security team doesnt have the budget nor the bandwidth to support all those time zones, but DevSecOps can help. For example, it can monitor code being reviewed by developers in India during local business hours but late night / early morning New York time. It can also help by providing portals through which developers can run on-demand scans for on-prem tools. DevSecOps also helps by enforcing standardization, which makes every step of the process clear and understandable for everyone. Standardization also makes it easier to scale the process and make updates and additions as needed.

Every organization has to prioritize its activities, and DevSecOps may not be everyones top priority. In some cases, organizations may not be able to integrate security into their DevOps process because they are dependent on some environment and script changes. Or the team may not have the capacity to take on these changes due to other priorities.

Often teams support legacy apps because they simply dont have a plan to transition them yet. There are security tools that dont integrate easily or automatically with other tools, and they require a layer of abstraction in order to be used in the DevSecOps process. For example, until recently Burp didnt have a CI plugin, so it wasnt easy to integrate a Burp scan into an automated process.

Another issue with legacy applications is that they can be critical to functionality, but because they were written so long ago, no one is able to or willing to make changes. Assigning resources to automate such apps doesnt make sense. But these applications still have to be scanned by the security team on a regular basis (especially when there are updated testing methodologies). So they need to be adapted to the standardized process of testing.

DevSecOps requires patience and tenacity. Any DevSecOps implementation takes a minimum of a yearanything less than that is incomplete. It will involve a lot of planning and designing before you start setting up the solution. You must first identify the gaps in your current process and then determine the tools required to support the process you intend to implement. You will need to coordinate with a variety of teams to get buy-in and instruct them to implement the required changes. None of this happens overnight.

Making changes to your process affects all people involved in the process and all applications following the process. If all your applications are being scanned using a common set of libraries, any change in these libraries will impact all apps unless you put in specific conditions.

Adding a new application to this process may take a long time. Onboarding .Net applications usually take a lot more time because they must build correctly. Visual Studio tends to hide a lot of build errors and provides dependencies at runtime; this is less true for MSBuild. In cases when the app team built an application using Visual Studio and checks it in, an automated process using the MSBuild command line can break due to a variety of reasons (incorrect directory structure, missing dependencies, incorrect dependencies, and so on).

Sometimes the CI tool itself is not up to the task. Organizations often start their CI process using Jenkins because its free, open source, and popular. But the number of bugs in Jenkins and its plugins can be staggering, and they can result in the need for messy workarounds. And a lot of plugins on Jenkins are no longer maintained or supported. Which is not to say its completely badits still very useful. And its worth noting that although there are other CI tools on the market, they have limitations as well.

Its also good to remember that tools dont always have the level of maturity to do everything thats needed. Every tool has its limitations, especially in an automated process. For example, Jenkins probably cannot allow conditional parameterization. And there may be some plugins that offer workarounds, but not the actual requirement.

Of course, the biggest headache any security team has to deal with is false positives. Without properly customizing your security tools, you could be overwhelmed with false positives. Organizations need to be vigilant about customizing the tool to the application, language, technology, or framework being used to narrow down your results.

Despite the challenges, there are many advantages to adopting DevSecOps. Not the least of which is how it helps address the ongoing lack of resources in security teams. DevSecOps enables teams to work more efficiently and keep up with an ever-expanding environment.

Read more here:

DevSecOps: The good, the bad, and the ugly - Security Boulevard

A Month of Reckoning for SaaS software creators and consumers – Security Boulevard

An illustration of transitive and deeply connected software supplychains

The U.S. was caught off guard by foreign interference in the 2016 election. Given the powerful role of social media in political contests, understanding the Russian efforts was crucial in preventing or blunting similar, or more sophisticated, attacks in the 2020 congressional races. Tracking back to 2016, it was far more difficult to trace Russias experimentation on Facebook and Twitter social networks, who essentially weaponized the social network platform to become engines of deception and propaganda.

Fast forward to end of 2020 and switching context to software supply chain domain, this `new` meltdown began on Dec. 13 when Reuters reported that nation-state hackers potentially linked to Russia had gained access to email systems at the U.S. Commerce and Treasury departments, and that the attackers infiltrated by way of SolarWinds Orion softwareupdates.

This is not in any vein similar to recalls affecting products such as automobiles, food and toys that tend to affect a narrower supplychain.

The outcome is evidenced by shares of SolarWinds rallying downward ~ 23%. On the contrary, a BlackRock iShares fund of cybersecurity stocks surged nearly 10% last week and rose another 3.5% this week entering Thursday. FireEye rose this week to a 5-year high, Microsoft topped a 90-day peak and Palo Alto Networks jumped to an all-timerecord.

Whats the alternative? said Venkatesh Shankar, marketing professor at Texas A&M University.But the magnitude of this breach is not just within the software industry, he said, noting SolarWinds customers span countless industries.

Kartik Kalaignanam, a University of South Carolina marketing professor, said traders are expecting organizations will bolster their defenses even if it means purchasing services from companies that werehacked.

Although one could argue each one of them has some sort of flaw in their system, theres a feeling theres going to be more spending happening, and the market will be pushed up overall, Kalaignanam said.

~ SOURCE: Paresh Dave,Reuters

As a vendor, this is clearly not the time to exploit the misfortune of SolarWinds as sooner than later it could be you dealing with these circumstances. Try not to ambulance chase or victim shame by portraying that your solution is a miracle cure to all such problems.

This can happen to any one of our software services that weve authored or supply chains that weve subscribed into. Besides combing through our logs and incident response data we would need to elevate this discussion and understand how software services are assessed for security during a procurement phase. Unfortunately, CIOs still rely on security questionnaires (little more than excel spreadsheets) to assess the security posture of their vendors prior to signing MSAs.. The consumer of a SaaS solution or services provided by an on-premise agent have little or no understanding of the transitive supply chain of the services that theyprocure.

In this retrospective exercise, lets attempt to understand the following

Every executive (VPs, Directors, CxOs) of a SaaS based companies (both producing and consuming side) are introspecting their own security posture in light of the SolarWinds incident. The impact is far reachingas

When you buy software, youre buying a matryoshka doll of various vendors products nested inside and connected to the product [that] you think youre buying, says Joel Fulton, who was the former CISO of Splunk. Your relationship is between you and your suppliers unseen tertiary pyramid. Combing through all of those pyramids is practically impossible, so CIOs will likely have to rely on randomchecks.

This unseen tertiary pyramid (as Joel states) is continuously evolving on a daily basis. Engineering teams procure new services, install new software agents and add new open source libraries/frameworks to their software stacks. Merely exporting and assessing their asset inventory at a point and time cannot assist in effectively quantifying exposure andrisk.

Todays software stack is a web of overlapping dependencies (depending on OSS supply chain and consuming SaaS/API services). Why? Because incentives are aligned with speed and release velocity over everything else.

Borrowing from Steve Yegges excellent post where he drew a clear distinction between products and platforms on the basis of Matryoshka principle.

At its simplest, a product is an application that is as good as it will ever be. A platform is an application that allows other things to be built with it that even its creators may be surprised with what users do with it. The easy way is to design a system using the Matryoshka (or Russian Doll) principle so that each layer is complete and perfectly suited to what the layer does so that other layers may be built on-top or aroundit.

The Matryoshka principles led to the creation of many successful platform plays like Stripe, Segment, PayPal, AppDynamics, DataDog, NewRelic, SalesForce, Facebook, Google, Slack, etc that benefited the greater good of our software ecosystem

In an attempt to abuse this principle, the Russians and other nation-state actors have now shifted their attention from social-media deception to supply-chain infiltration.

While analyzing the recent SolarWinds supply-chain attack security researchers have found a second backdoor, suggesting involvement of another hacker group, unrelated to the suspected government-backed threat actor that compromised SolarWinds.

Tracked as Supernova, the backdoor is a memory resident web-shell injected into SolarWinds Orion code that would allow threat actors to execute arbitrary code on systems running the compromised version of Orion. Supernova web shell was used to download, compile and execute a malicious PowerShell script (dubbed CosmicGale by some researchers).

How can we keep up with this mutation?

We at ShiftLeft have been studying and provisioning backdoor/insider detection policies using code property graph since mid 2019. Speak to us and we can help assess and recommend more efficient processes and procedures.

A Month of Reckoning for SaaS software creators and consumers was originally published in ShiftLeft Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Recent Articles By Author

*** This is a Security Bloggers Network syndicated blog from ShiftLeft Blog - Medium authored by Chetan Conikee. Read the original post at: https://blog.shiftleft.io/a-month-of-reckoning-for-saas-software-creators-and-consumers-da791a4189e9?source=rss----86a4f941c7da---4

Here is the original post:

A Month of Reckoning for SaaS software creators and consumers - Security Boulevard

The Slow-Motion Tragedy of Ola Bini’s Trial – EFF

EFF has been tracking the arrest, detention, and subsequent investigation of Ola Bini since its beginnings over 18 months ago. Bini, a Swedish-born open-source developer, was arrested in Ecuador's Quito Airport in a flurry of media attention in April 2019. He was held without trial for ten weeks while prosecutors seized and pored over his technology, his business, and his private communications, looking for evidence attaching him to an alleged conspiracy to destabilize the Ecuadorean government.

Now, after months of delay, an Ecuadorean pre-trial judge has failedto dismiss the case despite Bini's defense documenting over hundred procedural and civil liberty violations made in the course of the investigation. EFF was one of the many human rights organizations, including Amnesty International, who were refused permission by the judge to act as observers at Wednesday's hearing.

Bini, a Swedish-born open-source developer, was seized by police at Quito Airport shortly after Ecuador's Interior Minister, Maria Paula Romo, held a press conference warning the country of an imminent cyber-attack. Romo spoke hours after the government had ejected Julian Assange from Ecuador's London Embassy, and claimed that a group of Russians and Wikileaks-connected hackers were in the country, planning an attack in retaliation for the eviction. No further details of this sabotage plot were ever revealed, nor has it been explained how the Minister knew of the gangs' plans in advance. Instead, only Bini was detained, imprisoned, and held in detention for 71 days without charge until a provincial court, facing a habeas corpus order, declared his imprisonment unlawful and released him to his friends and family. (Romo was dismissed as minister last month for ordering the use of tear gas against anti-government protestors.)

EFF visited Ecuador to investigate complaints of injustice in the case in August 2019. We concluded that the Bini affair had the sadly familiar hallmark of a politicized "hacker panic" where media depictions of hacking super-criminals and overbroad cyber-crime laws together encourage unjust prosecutions when the political and social atmosphere demands it. (EFF's founding in 1990 was in part due to a notorious, and similar, case pursued in the United States by the Secret Service, documented in Bruce Sterling's Hacker Crackdown.)

While the Ecuadorian government continues to portray him to journalists as a Wikileaks-employed malicious cybercriminal, his reputation outside the prosecution is very different. An advocate for a secure and open Internet and computer language expert, Bini is primarily known for his non-profit work on the secure communication protocol, OTP, and contributions to the Java implementation of the Ruby programming language. He has also contributed to EFF's Certbot project, which provides easy-to-use security for millions of websites. He moved to Ecuador during his employment at the global consultancy ThoughtWorks, which has an office in the country's capital.

After several months of poring over his devices, prosecutors have been able to provide only one piece of supposedly incriminating data: a copy of a screenshot, taken by Bini himself and sent to a colleague, that shows the telnet login screen of a router. From the context, it's clear that Bini was expressing surprise that the telco router was not firewalled, and was seeking to draw attention to this potential security issue. Bini did not go further than the login prompt in his investigation of the open machine.

Defense and prosecution will now make arguments on the admissibility of this and other non-technical evidence, and the judge will determine if and when Bini's case will progress to a full trial in the New Year.

We, once again, urge Ecuador's judiciary to impartially consider the shaky grounds for this case, and divorce their deliberations from the politicized framing that has surrounded this prosecution from the start.

See the original post:
The Slow-Motion Tragedy of Ola Bini's Trial - EFF

Poetry vs. programming: Wandering the city, a writer finds the intersection of literature and code – GeekWire

The Doppler building reflected in the Amazon Spheres. (GeekWire Photo / Kurt Schlosser)

[Editors Note: Frances McCue is a poet, writer, co-founder of nonprofit community writing center Hugo House, and a teaching professor at the University of Washington. She reads this piece in a special installment of the GeekWire Podcast, embedded below.]

I needed to take a break from work and get outside. Also, Id been reading a lot of Baudelaire so I imagined being a flaneur when I headed out to walk in the city. I live in Seattle, (it could be Dublin or Boston or Washington DC) and a lot of people are living in tents and doorways and parks while some well-dressed minor athletes run by or pass on bikes. Buildings are boarded up and the shiny big technology palaces, typically humming with thousands of workers, are epidemic-level quiet.

Being an urban explorer without an itinerary, I soon found, was harder than it seemed. Wandering is challenging; its a mind game, willing yourself to get lost. I tended to move in straight lines and fall into old routes, so I had to force myself to make random turns. The more I walked, the more ironic this became because I was thinking about the linearity of computer coding as I passed big buildings where tech workers, until recently, had clicked away on their computers. What did they actually do? I wondered. As I strolled, I aspired to the whimsical turns and pauses that Baudelaire took as he roamed Paris, a city that ramped up being a flaneur to a whole new level, especially during the mid 1800s when that metropolis, too, was a mix of finery and filth.

That afternoon, I passed the glass spheres in front of the Amazon headquarters. The domes are Buckminster Fuller-ish orbs pentagonal hexecontahedrons actually that serve as terrariums for misty faux jungles. I imagined the programmers taking a little time off from their desktops and sitting inside those exotic plant enclosures, dreaming of nature. Sadly, the lights were off and the place was empty. The coders were all at home. Maybe they were lying on their couches and stringing lines into their laptops, as I did when I wrote poems.

Was writing code, I wondered, really like writing poems? Around me, the city was filled with the effects of technology: glassy new buildings and sleek new bike paths. Artists and poets lived here too, mostly in the soon-to-be-teardowns off to the side of this Tupperware-scape. I considered that, despite their difference in earnings, poets and coders followed similar processes in their work, playing with images and symbols to make something happen.

Those coders and I we both traded in language. Whether the language was Java or C or our own spoken languages, poets and coders manipulated symbols into syntax, promising logical paths that shimmer with different effects. A coder made the Word program that catches my spelling errors and simulates paragraphs. Her goals were specific though the reader, for her, is a computer that does not ingest nuance, only instructions. For this, Im thankful.

Urban planners and people in Silicon Valley will tell you that a lot of coders are artists, and as Richard Florida (Rise of the Creative Class) pretends, they live happily with other artists in tech communities. To me, the notion that IT people are making symphonic level lines of code is a marketing ruse in which artists, performers, musicians, designers and poets are laid out as bait to attract highly-salaried software engineers. Floridas rickety idea that coders and artists are tilling the same ground predicts the monoculture harvest of mass gentrification.

I can see the manifestation of this as I pass a whole new line of buildings that have shot up in the last two years: monoliths with fake balconies and enormous garage entrances. Theyve smothered the old warehouses, car dealerships and carpet outlets. Floridas classification of cultural creatives within a creative class felt pretty phony in this part of the city, one I didnt usually visit. A poet and a coder at Amazon live three full time wages apart from each other and several neighborhoods apart. Just because they both string symbols together doesnt mean that the engineer making algorithms about online shopping is an artist.

Poets want to make beautiful things out of language. Coders, to be fair, want to achieve elegance in their work and elegance in coding, specialists say, is about brevity and clarity. For insiders, its also about taking suave turns that other people might not, leading to the same result. Installing an unexpected swerve in a line of code and still arriving at the desired point showcases a coders voice. Clarity through innovation is a triumph.

I was passing a light rail station when this idea of clarity had me thinking of Imagist poetry, a movement in the early part of the 20th century, that also condensed language to an essence. Imagists worked until words felt transparent and disappeared into the picture conjured in the readers mind. Ezra Pounds poem In a Station of the Metro is the epitome, the imagist object lesson, and I find it be the one closest to computer code and a haiku simultaneously:

In A Station of the Metro

The apparition of these faces in the crowd:

Petals on a wet, black bough.[19]

I remembered this poem as I looked into the dark stairwells that led to the trains. The apparition of strangers floated before me: their faces as petals on a wet, black bough. That bough has a way of staying in your psyche. It protrudes. It stuck out in my consciousness as I walked by the station.

As miscellany is stripped away, both imagist poetry and well-honed code shine in their sleek designs. Code resonates in the style of the commands, though the outputs might be the same for different methods. For example, Javascript, if used to form a poem, could arrange the same set of lines with different commands. The coder would get the same outputs. Poems, on the other hand, shift with juxtaposition. In both cases, resonances are in the textures made by form, either in the commands or the results.

Thinking like a poet engineer and a coding spiritualist was thrilling. When I returned from the Amazon spheres, all pumped up on ideas of code and symbols, I took to my couch and I propped up Magic, an essay by WB Yeats from his strange book, Ideas of Good and Evil. Magic explores symbols and transcendent imaginings while skating through some pretty Jungian ideas about the collective unconscious, though when Yeats wrote it in 1901, Jung was early in his career, still working on his dissertation: On the Psychology and Pathology of So-Called Occult Phenomena. However, even though they were both drawn to the occult, creative processes and the interventions of magic, and though an underground river of collective consciousness and archetypes connected them, actual correspondence did not.

Yeats fascination with symbols and their effect on consciousness was probably influenced by his sessions with occultist theosopher Madame Blavatsky whom he had visited in the late 1880s as a young man in London. He tried to run experiments, to no avail, in which naturally occurring phenomena were altered by his mind. Nonetheless, his interest in the occult persisted into the automatic writing he began with his wife Georgie twenty years later, and A Vision, an accumulation of these matters published in 1937, when the poet was an old man.

What caught my attention and spun my thinking about symbols even further was a moment in Magic when Yeats claims that the borders of our minds are ever shifting, and that many minds can flow into one another, as it were, and create or reveal a single mind, a single energy. He pushes the idea of a single mind into one great memory, the memory of Nature herself. The way to delve into this common memory, according to Yeats, was through symbols. A common consciousness excavated through symbols of course. Id read Joseph Campbells work on myths and symbols; it wasnt a new idea to me. Those were what all artists traded in.

The symbols are of all kinds, Yeats continues, for everything in heaven or earth has its association, momentous or trivial, in the great memory, and one never knows what forgotten events may have plunged it, like the toadstool and the ragweed, into the great passions. If the toadstool and the ragweed can become part of the great memory, why not computer code? Across different symbols and languages, it also had a connective circuitry. Indeed, Yeats seems open to symbols coming from many sources: Almost everyone who has ever busied himself with such matters has come, in trance or dream, upon some new and strange symbol or event, which he has afterwards found in some work he had never read or heard of.

But I couldnt quite resolve the notion that the great memory always led back to the memory of nature. For a software engineer and coder, the great memory seemed to me to be more of a common algorithm that re-calculates our desires to solve problems. Its mechanical. Symbols, for poets, could indeed access archetypes and images from our most atavistic human memories, back into a common sense of nature. But the effect is not a pastoral one. For poets, its feral not the Anthropocene that we are living in.

The opposite of feral, the antithesis of Yeats occult and reliance on the great memory as an unfathomable mystery, was in the work of futurists and philosophers. Ray Kurtzweil and John Searle explore the idea of machine learning expanding to singularity, a point when AI is far smarter than any human processing. Thats when well see the intelligence explosion that some say could doom us. Yeats would imagine it as a consciousness that the universe already possessed.

Poems rely on a readers consciousness to fill in the leaps of association and, through that process, they reach into a subconscious undercurrent. Little pivots in their imagery and music move a reader away from the predicted route (at least in good poems). While coders may embed processes in language for particular uses, poets aspire to use language to uncover intention and surprise, both secrets and revelation. Code, on the other hand, sticks to the program, arriving at a predicted end no matter what innovations have led there.

In poems I love, my psyche feels snug within a coded experience and then set free. I couldnt exactly explain to you why a particular poetic turn works. Its something you feel and hear though a voice that plays inside you. Here, for example, is a poem I love for its tidy, reasonable lines in a column, for its quirky turns and for the voice that carries lyricism and surprise, to no expected end:

There is a

distance where

magnets pull,

we feel, having

held them

back. Likewise

there is a

distance where

words attract.

Set one out

like a bait goat

and wait and

seven others

will approach.

But watch out:

roving packs can

pull your word

away. You

find your stake

yanked and some

rough bunch

to thank.

Bait Goat reads like code. It moves linearly; the poems short lines jump easily, one to the next, like well-formed, simple commands. The images and sounds flicker with tension: the speaker is exploring a distance where/ words attract. Thats the turn. How, you might ask, is the distance where/ words attract measured by a bait goat? In the poems short lines (ironic for a poem about measuring distance), roving packs of bait goats implode the expanse that makes us draw towards the poem and then, at the end, your stake is yanked and you, the reader and the poet both, have some/rough bunch to thank. Disruption, in other words, comes intentionally and then takes over.

Who can say why the disruption is a bait goat? But it is, and it works. Were down there looking into a river of common experience that we are brought to by quirkiness, by a magical, guiding hand. And then we arrive to face the truly unexpected: goats. Goats are smelly and they spit. They bite and play roughly in groups. They eat garbage. By the poems willful insistence to focus on setting out one goat as bait, it sends us reeling with those smells and sounds and images.

Kay Ryans poem is a contraption that springs on sonics: attract/back; wait/bait; stake/yank/thank. These rhymes roil underneath the visual content to draw connections. How the language sounds inside your head as you read it is what pops loose the quirky sensibility and strange logic within. The lines cant be too long admired visually, nor interpreted without the sound track that rolls along with them. The music connects and fulfills the little art trap that the poem is. You cant help hearing that.

Poetrys language, the currency of the tongue, is human-tethered to the dark caves of our beings. Poems are crafted out of that darkness and brought, then, into view. One who writes computer code might ask: But is a poem useful? What does it actually do? We cant measure that. We have no data. Indeed, to our coder, a poem might be a machine in which usefulness is the nexus of interactions both quantitative (syntax and sonics) and qualitative (the feelings and insights these inspire). Codes utility, on the other hand, may have no qualitative aspect other than aesthetic elegance. Brevity and fresh command paths are earmarks of beauty and may be codes only hint at narrative. The form is hermetically sealed. The Amazon dome, I speculated, was like a pen for the coders.

Wandering was innate to a poem because it imitated how consciousness worked. A poem is reader-activated, dormant until she rolls her mind over the lines. Poetry relies on its own music, whereas coding isnt a heard-aloud language. Codings a ploy that instigates certain processes and its non-sonic wrappings are purely visual and algorithmic. It all unspools externally, outside the human body. In that way, it feels cool and logical machine-activated, as it slides through processors.

Doesnt logic run out of tarmac? I put down Yeats essay. I imagine a hunk of machinery within his great memory of nature. Dont useful things eventually become wreckage, caught in over-growth?

Here we were, poets and coders living together in this expanding and shut down urban space, and we were both wandering indoors, into our syntax, looking for turns and seeing the unexpected. Maybe poetry was the logical and liberated manifestation of coding. I could imagine Yeats saying that, but he always aspired to magic. To me, code forced a bloom back into its bud. A poem held, always, its own promise of blasting open.

Finally, I was roaming like a flaneur, except that I was reclining on the couch. Werent we all coders and artists and poets flaneurs creating symbols within forms? We wander and then we find ourselves standing at the river of collective memory where we ask: Does it end up where I want it to? Does it look interesting and beautiful along the way?

Audio editing by Curt Milton. Photography by Kurt Schlosser.

Read the original:
Poetry vs. programming: Wandering the city, a writer finds the intersection of literature and code - GeekWire

Hacker Noon Experts: On Demand Video Calls with The Smartest People in Tech – Yahoo Finance

The technology publishing platform kicked off a partnership with Superpeer, opening up an on demand marketplace for top tech bloggers to book video calls with their readership.

EDWARDS, Colo., Dec. 22, 2020 /PRNewswire-PRWeb/ -- Hacker Noon, the technology publishing platform, launched an on demand marketplace to book video calls with experts in programming, cryptocurrency, remote work hacking, outer space, venture capital, futurism, and startups. It's called Hacker Noon Experts.

"For readers, it's cool to be able to book a call with the creator of the story they're currently reading or learning from," said Founder & CEO David Smooke. "And for the writers, we're happy to surface new revenue opportunities and creative ways to connect with their readership."

Writers set their own rate and availability for all phone and video calls. The functions of the Hacker Noon Experts app are search, filter by expertise, sort by price, profile page, write a review, and a big call to action that clicks through to the booking and scheduling page, which is powered by Superpeer.

According to a Hacker Noon post, there are some of the notable tech experts to join the marketplace:

Adrian Raudaschl Former physician (MBChB) working in the NHS. Now an experienced product manager for research, academic and medical education products.

Alex Berke MIT Media Lab PhD student. Work experience: Google Search software engineer on news credibility projects, maker of election tech; and publisher of "Beautiful Symmetry: A Coloring Book About Math."

Al Chen Taught Excel to 30,000+ people. I blog and podcast about spreadsheets and data analysis. Have been teaching Excel for 8+ years.

Amanda McGlothlin User Experience Expert. 15 years+ experience working with startups and brands including Nike, Belkin, Audi, Google, Pearson, Allstate, and Cisco.

Branislav ali Philosopher of code. CTO of ML startup, open-source contributor, threat analyst, educator.

Story continues

Bernard Moon Global VC Investor. Experienced startup entrepreneur and tech trend writer.

Christopher Luc Software Engineer. Full-time at WhatsApp; internships at Uber, Snap and Yelp.

Cynthia Huang Female hackathon ninja. I can advise on personal branding, public speaking, content marketing, strategy, operations, startups, product, crypto, cannabis, short term rentals and insurance.

Daniel Wu Housing Innovation & Data Strategy. I'm a Harvard JD/PhD and product manager, and advocate for inclusive smart cities and data ethics. Also published in Bloomberg, TechCrunch, etc.

Doc Norton Agile/Leadership Coach. 35+ years continually learning in the software field as a consultant, Director, VP, and CTO.

Emil Koutanov Winner of 2020 Noonies Microservices Thinker of the Year. Software architecture and engineering.

Eugenia Kuzmenko Internet? What is Internet? Google certificated marketer, Facebook certificated adman, Hubspot certificated SEO-specialist.

Geshan Manandhar Lead Software Engineer. In addition to my full time tech work, I have been blogging for 14 years and mentoring people in the past years.

Jackson Kelley Software Engineer at Amazon. I also worked as a consultant for block.one during the launch of EOSIO.

Kahlil Crawford Content Strategist | Theorist. Content professional in the hi-tech sector using design, creativity, and collaboration to innovate.

Kevin Davey Champion Algo Trader. Proven futures trader and 4 time best selling trading book author.

Matt Klein Cyberpsychology Strategy Director. Cultural Strategy Consultant for Fortune 50 Brands, Acclaimed Writer & Startup Advisor.

Monica Hernandez Moni Mission Control. I have the uncanny ability to be a human router and rally the troops for increased impact. My areas of expertise include the space industry and high tech sectors.

Linh Dao Smooke Hacker Noon COO. Helped raise millions, and 2x sales for Hacker Noon 3 years in a row. Founded a nonprofit. Mother of Norah.

Liyas Thomas Author of Hoppscotch. Helped build Buy Me a Coffee (YC W19), currently building one-stop solution for open source monetization.

Mahbod Moghadam Founder of Genius. I started two major companies and I am currently writing a book about how startups work, in addition to being a top angel investor with an excellent portfolio.

Nebojsa Todorovic Freelancing Uncensored and Uncut. 10+ years pro remote work on all major freelance platforms.

Nicholas Resendez Let's Grow Together. I focus on relationships and communication to understand the needs of those looking to build for the future.

Peter Thomas Creator: Karate Framework. Open Source and Java veteran, has been invited to speak at the Ministry of Testing Dallas, DevConf.IN, GIDS, Test Talks, Test Automation Guild, GraphQL Asia and Selenium Conf Tokyo. Also appears in the TechBeacon list of Test Automation Leaders to follow in 2019.

Jean Machuca Creator of QCObjects. Software Developer with more than 20 years now experience working for large-scale projects in private and public sector.

Sandesh Suvarna $1.4M App in 4 Minutes. Masters in Engineering Management.

Sergey Baloyan Make crypto-projects popular. I can support projects with building overall concept, tokenomics, marketing and PR strategy and implementation.

If interested in becoming a Hacker Noon Expert and receiving leads for paid video calls, please fill out this form. We'll review the information and then if sufficient send over an invite to the Hacker Noon network.

About Hacker Noon

How hackers start their afternoons. Hacker Noon is built for technologists to read, write, and publish. We are an open and international community of 15k+ contributing writers publishing stories and expertise for 3M+ curious and insightful monthly readers. Founded in 2016, Hacker Noon is an independent technology publishing platform run by David Smooke and Linh Dao Smooke. Start blogging about technology today.

About Superpeer

Superpeer is a monetization tool for the best minds providing a platform for paid 1:1 video calls and livestreams.

About Hacker Noon Experts

Book a call with a tech expert today.

Media Contact

Natasha Nel, Hacker Noon, +31061366617, support@hackernoon.com

Twitter, Facebook

SOURCE Hacker Noon

Go here to see the original:
Hacker Noon Experts: On Demand Video Calls with The Smartest People in Tech - Yahoo Finance

2020 in Review: 10 AI Podcasts You Need to Know – Synced

The term podcast first appeared in the 00s, coined by a British journalist as a portmanteau of iPod and broadcast. Podcasts have since evolved into a popular entertainment and information source, and with 2020 emptying offices and curtailing nights out at the club or cinema, podcasts have become more attractive than ever.

Podcast solution provider Voxnest reports a 42 percent increase in year-on global podcast listens as of this April, with the figure likely much higher now. The report notes the rise is even more pronounced (53 percent) in European markets, where podcasts are just starting to take off. In a year plagued by shutdowns, being home has actually opened up a new opportunity to discover this format.

Synced has selected 10 AI-related podcasts for readers to check out over the holiday season.

Launched as This Week in Machine Learning & Artificial Intelligence in 2016 by host Sam Charrington, the TWIML AI Podcast focuses on the business and consumer application of machine learning and AI, bringing AI-powered products to market, and AI-enabled and -enabling technology platforms. Many AI luminaries have shared their wisdom with listeners on the channel. Recent guests include the Founder of Fast.ai Jeremy Howard, Professor of Computer Science at UC Berkeley Dawn Song, Distinguished Professor in the Departments of EECS and Statistics at UC Berkeley Michael I. Jordan, and Head of AI Research at JPMorgan Chase Manuela Veloso. With over seven million downloads, the TWIML AI Podcast has quickly grown into a leading voice in the field.

Hosted by REWORK, Women in AI is a biweekly podcast that presents conversations with leading female figures in AI, Deep Learning, and Machine Learning. Episodes have featured CEOs, CTOs, data scientists, engineers, researchers and industry professionals such as Google Brain Researcher Sara Hooker, Mila Research Scientist Alexia Jolicoieur-Martineau and DeepMind Research Lead Doina Precup.

The Lets Talk AI mission is straightforward: letting you know whats actually on going with AI and what is just clickbait headlines. The podcast features AI news and discussions with researchers on the latest AI trends and hot community news. Stanford University PhD Student Andrey Kurenkov and Carnegie Mellon University PhD Student Jacky Liang rolled out Lets Talk AI this March. The pair are also the bright minds behind AI news site Skynet Today,

Talking Machines is your window into the world of machine learning, say Neil Lawrence and Katherine Gorman, who aim to open that window wider by presenting experts in the field and discussions on new and innovative ideas. Lawrence is the DeepMind Professor of Machine Learning at the University of Cambridge, and Talking Machines founder Gorman is a former public radio producer.

The Radical AI Podcast encourages progressive conversations and radical ideas regarding advanced technologies role in our rapidly changing world. Created by Dylan Doyle-Burke, a PhD student at the University of Denver, and Jessie Smith, a PhD student at The University of Colorado Boulder (CU Boulder), the podcast sets out to explore AI ethics in a manner that is fundamentally representative of diversity of stories, voices, and ideas that are accessible, bold, and transformative for all individuals and communities that use, design, and engage with AI technology.

In each episode, Voices in AI host Byron Reese conducts an hour-long, in-depth interview with a prominent AI author, researcher, engineer, scientist or philosopher. There are discussions on the economic, social, ethical and philosophical implications of AI. Topics are covered from a wide variety of perspectives with even the dark dystopian despair viewpoint of AI explored. Reese is CEO of media company GigaOM,

When it comes to AI in business, we ask: whats possible? Whats working? The AI in Business podcast content is aimed at enterprises that have deployed or are planning to deploy AI systems. Each week, host Daniel Faggella interviews leading AI and machine learning executives, investors, and researchers from globally renowned organizations. The focus is on identifying trends and providing facts that matter to help business leaders navigate through the hype and skepticism around AI.

NLP Highlights was created by the Allen Institute for AI (AI2) to showcase recent research related to natural language processing and to present interviews and discussions with authors and researchers on new papers. The hosts are AI2 Research Scientists Matt Gardner and Pradeep Dasigi, and Senior Google Research Scientist Waleed Ammar.

Long-time journalist Noah Kravitz hosts The AI Podcast, where he dives into deep conversations with leading experts in AI, deep learning and machine learning to demystify artificial intelligence. This podcast is a NVIDIA production, and while that association is reflected in many episodes, the presented scientific content, stories and collaborations are of high quality and go beyond promotion of the brand.

AI for Entrepreneurs is produced by OpenCV (Open Source Computer Vision), the non-profit organization behind the popular worldwide library of computer vision programming functions. The podcast features interviews with successful entrepreneurs working with AI, to provide those thinking of launching an AI startup with the understanding required to get their project up and running.

All the podcasts on this list offer their episodes online for free. Interested readers can listen on their home computers or download dedicated podcast apps on their smartphones to enable additional user interface options and offline listening convenience.

Reporter: Fangyu Cai | Editor: Michael Sarazen

Synced Report |A Survey of Chinas Artificial Intelligence Solutions in Response to the COVID-19 Pandemic 87 Case Studies from 700+ AI Vendors

This report offers a look at how China has leveraged artificial intelligence technologies in the battle against COVID-19. It is also available onAmazon Kindle.Along with this report, we also introduced adatabasecovering additional 1428 artificial intelligence solutions from 12 pandemic scenarios.

Clickhereto find more reports from us.

We know you dont want to miss any news or research breakthroughs.Subscribe to our popular newsletterSynced Global AI Weeklyto get weekly AI updates.

Like Loading...

Here is the original post:
2020 in Review: 10 AI Podcasts You Need to Know - Synced