Open source companies are thriving in the cloud – ARNnet

Quick, can you spot the common link between MongoDB, DataStax, Redis Labs, Percona, Couchbase, and EnterpriseDB?

If you said, Theyre all open source database vendors, youd be mostly correct. Not all offer databases governed by an open source licence.

But if you said, Each offers an increasingly popular database-as-a-service cloud offering, youd be spot on. Indeed, while weve spent a few years with erstwhile open source vendors changing their licenses to ward off evil cloud vendors, what were starting to see is these same vendors embracing the cloud, and to hugely positive effect.

Hence, while Databricks CEO Ali Ghodsi has correctly argued that its extremely hard to manage and run a high quality managed service in the cloud and not all open source companies are good at it, its also true that more companies are figuring this out, making the next decade the era of open source databases in the cloud.

Signs, signs, everywhere the signs

Already were seeing clear indicators that open source is leaving behind its on-premises roots and heading to the cloud. Arecent Red Hat surveyfound that 95 per cent of respondents view open source as important, with use of proprietary software declining to 42 per cent (from 55 per cent the year before).

And while it may be too soon to call it a trend, 28 per cent of respondents called out Designed to work in the cloud as a key benefit of using modern open source tooling (like Kubernetes), the fourth-most cited benefit (up from eighth place last year).

Meanwhile, as more applications are born in the cloud, cloud databases have been booming. When I first started writing about this in earnest, cloud database mostly referred to databases offered by Amazon Web Services (AWS), Microsoft, and Google.

Quite quickly enterprises figured out that rather than having one massive Oracle database to run their diverse workloads, they couldinstead leverage a broader array of databases, with cloud databases increasingly central to their selections.

So much so, in fact, that in mid-2019 Gartner was ready to declare that cloud is now the default platform for managing data and that only legacy compatibility or special requirements should keep you on-premises.

This declaration, however, isnt just about databases offered by public cloud vendors. No, an interesting thing has happened to open source vendors on their way to financial success: Theyve discovered the cloud, and in a big way. Consider MongoDB, for example.

Atlas lifts MongoDB

MongoDB launched Atlas, its fully managed cloud database service, in 2016. A year later, MongoDB reported that Atlas accounted for 10 per cent of its Q4 2017 revenues.

By March 2019, Atlas revenues had surged to 34 per cent of AWS revenues, worth over $100 million in 2018. At that time, MongoDB CEO Dev Ittycheria was asked about the impact cloud database vendors were having on MongoDB.

Ittycherias response? We see no impact on a negative basis whatsoever. If anything, he said, it was raising awareness for MongoDB.

And how. In MongoDBs most recent quarter, Atlas revenue boomed by 185 per cent year-over-year, claiming 40 per cent of the companys revenue. In the earnings call, Ittycheria touted MongoDB as a cloud-first company, citing three ways in which focusing on delivering MongoDB as a fully managed cloud service has changed the company:

This calls to mind some advice Couchbase director Andy Oliver recently offered to database competitors who try to innovate open source licensing rather than offer real product innovation: Only better service, support, and innovation... will save them. Changing the open source definition wont fix what is, in the long-term, a business model problem.

Open source as-a-service

But as MongoDBs results show, creating cloud database services is possible for these current or former open source vendors.

And as difficult as it may be to create competence in operational efficacy, says Ghodsi, its the only way forward: The reality is open source software itself has zero intrinsic monetisation value because anyone can use it, so there will always be a requirement for open source vendors to determine the value beyond the software. We believe this value lies in the vendors ability to deliver open source software as a service.

As results from MongoDB, Redis Labs, DataStax, and others show, database vendors are figuring out how to be as good at operationalising software as they have been at developing software. This should give hope to would-be open source entrepreneurs that worry about how to monetise open source.

Ironically, it turns out that the open source model is the same as it ever was: charge for support. The difference, of course, is that support is baked into the product in a cloud offering.

The database future is firmly planted in the cloud, as Gartner has declared. Fortunately, open source database vendors got the message.

Error: Please check your email address.

Tags Cloudopen source

The rest is here:
Open source companies are thriving in the cloud - ARNnet

SystemInfo is a simple open source system information tool for Windows – Ghacks Technology News

Most of us have used some system information tool at some point or the other to quickly analyze the devices, hardware, and software of a computer system. Tools like HwInfo display information that is useful in various situations. SystemInfo belongs to the genre and is an open source software.

The program is a portable software, so you can just download the executable and run it directly. The interface looks a lot like Piriform's Speccy, and as a matter of fact even the GitHub page for the program has a Speccy tag. Maybe it was the inspiration behind the application?

Do note that this is not a system monitoring application. If you want one of those, you can try Thilmera7 or Desktop Info, or Conky for Linux. Regardless of that, SystemInfo is quite the useful tool. You can view all of your system's hardware information on a single page. Built a new computer? Bought a new laptop? Run the program to see if everything is as it's supposed to be.

There are no settings whatsoever. It's that simple. SystemInfo lists the BIOS/EUFI name and version number, Operating System information, CPU model and clock frequency, Motherboard model number, total memory and the RAM frequency, GPU, Display, Storage drives (model number and total storage), Optical drives, Network Adapters, Sound cards and the Uptime of the computer.

I'm not certain if this is a bug, but there are a couple of issues with the application. It detected only 1 of my memory modules and showed that the laptop has 4GB of RAM. In reality, it has 2 memory chips, and Windows detects it correctly as a total of 8 gigs. Aside from this, it works pretty well and accurately detected that the system doesn't have an optical drive, and has an SSD (which I have installed using a SATA Caddy in place of the DVD drive).

SystemInfo has a built-in screenshot saving option that you can access from the File menu. Snapshots are saved in the PNG format at a location of your choice. The default file name is saved in the following format: sysinfo-capture-YYYY-M-DD_@_HH.MM.SS.

The file name contains the Year, Month, Day, Hour, minute and even the second when the screenshot was saved. You can optionally upload the screenshot to gyazo. The program offers to open the saved file in the default viewer.

If you'd rather have a text based result, you're in luck. SystemInfo can save the details in HTML, XML or TXT documents. You can also Import XML files that you have saved previously.The Hide IP (Show IP) button can be used to toggle the IP address. This is useful when you're taking a screenshot of the window, or exporting it to a file, and wish to hide your IP address from prying eyes. The program is written in C++.

The fact that its portable makes SystemInfo a useful little tool to carry on a USB Flash Drive. And since it has no options to tinker with, it's suitable for all users.

Author Rating

Software Name

SystemInfo

Operating System

Windows

Software Category

System

Price

Free

Landing Page

Follow this link:
SystemInfo is a simple open source system information tool for Windows - Ghacks Technology News

2020 Call for Code Global Challenge Led by IBM Takes On Climate Change on 75th Anniversary of United Nations – The Weather Channel

Call for Code founding partner IBM and creator David Clark Cause, in partnership with United Nations Human Rights and the Linux Foundation, announced this year's Call for Code Global Challenge on Wednesday and invited the world's software developers and innovators to help fight climate change with open source-powered technology.

On its 75th anniversary, the United Nations is demanding a "global reality check" and has launched the biggest-ever global conversation on how to address the world's most pressing issues such as climate change. Heeding the U.N.'s rallying cry to help build the future we want, IBM is joining forces with key U.N. agencies and world leaders to help tackle the climate crisis.

Following two successful years, the 2020 Call for Code Global Challenge encourages and fosters the creation of practical applications built on open source software including Red Hat OpenShift, IBM Cloud, IBM Watson, IBM Blockchain, and data from The Weather Company. The goal is to employ technology in new ways that can make an immediate and lasting humanitarian impact in communities around the world.

A recent global IBM study conducted by Morning Consult surveyed more than 3,000 developers, first responders and social activists across China, Columbia, Egypt, India, Japan, Spain, United Kingdom, and the United States, and found:

-77% of first responders and developers surveyed agree with the statement "Climate change is the single most pressing issue facing my generation."

-79% of respondents agree that climate change is something that can be reduced or combated with technology.

-87% of respondents feel it is important that a potential employer has taken action on climate change.

-Three quarters of respondents agree that the open source community can help scale climate change solutions to communities in need.

-Eight in 10 respondents agree that most people want to do something to help combat climate change, but don't know where to start.

-Over 180,000 participants from 165 nations took part in Call for Code in 2019; they created more than 5,000 applications focused on natural disaster preparedness and relief.

-This year Call for Code is challenging applicants to create innovations based on open source technologies to help halt and reverse the impact of climate change.

"There is an urgent need to take action against climate change, and IBM is uniquely positioned to connect leading humanitarian experts with the most talented and passionate developers around the world," said Bob Lord, IBM senior vice president of cognitive applications and developer ecosystems. "IBM is determined to identify, deploy, and scale technology solutions that can help save lives, empower people, and create a better world for future generations."

Lord noted that IBM has been mobilizing throughout the company, from policy commitments on climate to IBM's weather forecasting capabilities powered by AI and supercomputers.

Last years Call for Code Global Challenge winning team, Prometeo, created a wearable device that measures carbon monoxide, smoke concentration, humidity, and temperature to monitor firefighter safety in real-time as well as to help improve their health outcomes in the long-term. The solution has been developed further through IBMs Code and Response program and has just completed its first wildfire field test during a controlled burn with the Grups de Refor d'Actuacions Forestals (GRAF) and the Grup d'Emergncies Mdiques (GEM) dels Bombers de la Generalitat de Catalunya near Barcelona, Spain. Prometeo was developed by a team comprising a veteran firefighter, an emergency medical nurse, and three developers. As recently piloted, the Prometeo hardware-software solution is based on multiple IBM Cloud services.

Other applications like 2018 Call for Code winner Project Owl and 2018 Puerto Rico Call for Code hackathon winner DroneAid have also been cultivated through the Code and Response program.

Visit CallforCode.org to join the community and learn more about the challenge, which will open for submissions on March 22, World Water Day 2020. Additional details, a schedule of in-person and virtual events, and training and enablement for Call for Code will be available at https://developer.ibm.com/callforcode/.

Read the original here:
2020 Call for Code Global Challenge Led by IBM Takes On Climate Change on 75th Anniversary of United Nations - The Weather Channel

Best F-Droid apps to replace your existing apps – The Android Soul

Lets admit it. Googles Play Store is the single largest app store available at the moment but theres no doubt that it does a significantamount of tracking as well. After all, the Mountain View company is the worlds largest ad broker and data is todays biggest currency. Besides that, there are several apps in Google Play that exploit the companys privacy and security policies to track user data and perform malware attacks.

F-Droid is an app repository that only provides Fully Open Source Software (FOSS) with no tracking or hidden costs. It offers to focus on privacy and security with safety precautions like avoiding leakage of browsing data, sending all data through HTTPS, Tor support, and converting supported languages in the metadata so as to not reveal your location.

Hence, F-Droid looks like a good bet when it comes to safety of your data.That being said, we cannot guarantee that F-Droid, or any other apps store, is 100% safe, or safer than the Play Store itself.

RELATED:

You can install F-Droid like any other app on your phone and browse over 2000 apps that are available for download for free.

Luckily for you, weve compiled a list of best apps that you can download from F-Droid. Some of the apps listed below could even replace the app that youre using now while the others will add more functionality and productivity features on your phone.

Note: You need to install the F-Droid app first to be able to install the Android apps given below.

NewPipe is the open-source alternative to watching YouTube videos but thats not the thing it specializes in. The app not only lets you watch YouTube but also supports subscriptions, floating player, downloading videos and audio, view history, queue videos, local playlists, and subtitles.

Besides that, the app is more privacy-orientated than YouTube since it saves your data offline by not using proprietary Google APIs that generally collects your watch history data. NewPipe also doesnt require you to sign-in to Google and you can bypass regional restrictions with the app.

Download: NewPipe

How to stop pop-up ads on Android

This app is a fully-featured email client, with support for POP3, IMAP and Push IMAP accounts. You can log in using multiple accounts and can export your settings and account configurations whenswitching betweenpackages. Additional features include multi-folder sync, flagging, filing, signatures, BCC-self, and PGP/MIME.

Download: K-9 Mail

RELATED:

In order to access Facebook without its own tracking and invasive features, F-Droid offers Face Slim which is a lightweight replacement to the otherwise memory-hogging Facebook app on Android. The app weighs at 1.3MB but includes full Message functionality and provides features that arent present on the official app. Additional features include dark mode support, a basic mode for usage in low-speed networks, personalization inside the feed, and more.

Download: Face Slim

Twidere is the only open-source app thats officially supported by Twitter. The app comes with a built-in image and map viewer, direct messages that support conversations, multiple account support, secure and direct login with a username and password. Theres a night mode option that lets you enjoy dark theme as well as options tomute filters, schedule tweets, customize tabs, avoid ads and promotions in your timeline.

Download: Twidere

Firefox preview might be an open-source app but Fennec F-Droid is a version of Firefox stripped of any proprietary bits found in official Mozillas builds.

Download: Fennec F-Droid

An open-source alternative for Reddit is Slide which is material-designed, ad-free, and packs an array of features for power users. The app comes with support for over 12,000 theme combinations, has offline capabilities complete with images and gifs, Gallery and shadowbox modes, Synccit integration, multiple accounts support, and more. In terms of bonus features, Slide offers Image Flair support, replying to comments without opening a new window, a filter system to block content, viewing and deleting browsing history, and casual subscriptions that wont show up on the front page.

Download: Slide

ownCloud is a self-hosted cloud storage option that lets you manage files, contacts, calendars, music, pictures, and more through its app. The service allows you to browse all of your ownCloud synced files, create new ones, edit existing files, and share files to others. ownCloud supports syncing of content across all devices and you can define different paths for different types of files before uploading.

Download: ownCloud

Open Camera as the name implies is an open-source camera app that offers full manual controls, customizable hotkeys, HDR support, widgets, external mic support, and multitouch zoom. The app comes with an auto-stabilize option, different focus modes, face detection, burst mode, and silenceable shutter which are something that many default camera apps dont offer on their own.

Download: Open Camera

To replace your existing file manager, F-droid lists the Amaze app which is a file manager that follows theMaterial Design guidelines. In addition to basic features like cut, copy, delete, compress, and extract, the app offers the ability to work on multiple tabs, theme support, a navigational drawer, and an app manager. With Amaze, you can quickly access bookmarks, history and search for any files that are present on your device with Root explorer support for advanced users.

Download: Amaze

OsmAnd is a Google Maps alternative that utilizes OpenStreetMap for capturing maps data and is available for free. The app provides turn-by-turn directions, voice guidance, offline support, lane guidance, automatic re-routing, and searching for places like gas stations, museums, restaurants, and also any geographical coordinates. The app offers offline viewing with data consumption of under 200MB for a specific region.

Download: OsmAnd

OpenVPN is an open-source client to create a VPN without root. The app can be used to connect to any services using OpenVPN certificates.

Download: OpenVPN for Android

AntennaPod is an open-source podcast manager that offers you instant access to both free and paid podcasts from publishers and independent podcasters. You can import and export feeds through gPodder, OPML, RSS URLs, and the iTunes podcast database. The app provides users with powerful automation controls that can be used to save effort, power, download episodes and delete them.

Download: AntennaPod

You might be used to tethering your mobile data for use on your computer but what if we tell you can reverse that process and use your computers internet connection on your Android device using SimpleRT. The app, unlike others, works without root and can set custom DNS servers, and sports multiple tethering.

Download: SimpleRT

While AdAway is also an open-source alternative, it only works on rooted phones. Thats why, we have listed the DNS66 app which can block ads, malware, and trackers by creating an encrypted server to filter ads including popup ads, intrusive Ads and even advertisements across the web and apps.

Download: DNS66

Ever thought of gifting a smartphone to the elderly ones in your family? Thats a nice idea but its important to know that they might find it difficult to get through their day using the modern UI that Android and iOS offers. BaldPhone solves that problem as it dumbs down your smartphone with simple tools that can be easily accessed by the elderly.

When you install and open the app, you will be greeted with large-sized icons and shortcuts that are basically displayed as the default launcher. In addition to that, the app offers shortcuts for Contacts and Phone, Voice Assistant, Alarms, Notifications, Voice Assistant, and WhatsApp. However, the highlights of BaldPhone comes in the form of timely reminders for pills and an SOS button in case of an emergency, both of which can help the elderly in an immense way.

Download: BaldPhone

Have you tried using apps from F-Droid? What do you think about them? Let us know in the comments below.

RELATED:

More:
Best F-Droid apps to replace your existing apps - The Android Soul

Australian police are using the Clearview AI facial recognition system with no accountability – The Conversation – Australia

Australian police agencies are reportedly using a private, unaccountable facial recognition service that combines machine learning and wide-ranging data-gathering practices to identify members of the public from online photographs.

The service, Clearview AI, is like a reverse image search for faces. You upload an image of someones face and Clearview searches its database to find other images that contain the same face. It also tells you where the image was found, which might help you determine the name and other information about the person in the picture.

Clearview AI built this system by collecting several billion publicly available images from the web, including from social media sites such as Facebook and YouTube. Then they used machine learning to make a biometric template for each face and match those templates to the online sources of the images.

It was revealed in January that hundreds of US law enforcement agencies are using Clearview AI, starting a storm of discussion about the systems privacy implications and the legality of the web-scraping used to build the database.

Australian police agencies initially denied they were using the service. The denial held until a list of Clearview AIs customers was stolen and disseminated, revealing users from the Australian Federal Police as well as the state police in Queensland, Victoria and South Australia.

This development is particularly concerning as the Department of Home Affairs, which oversees the federal police, is seeking to increase the use of facial recognition and other biometric identity systems. (An attempt to introduce new legislation was knocked back last year for not being adequately transparent or privacy-protecting.)

Gaining trust in the proper use of biometric surveillance technology ought to be important for Home Affairs. And being deceptive about the use of these tools is a bad look.

Read more: Why the government's proposed facial recognition database is causing such alarm

But the lack of accountability may go beyond poor decisions at the top. It may be that management at law enforcement agencies did not know their employees were using Clearview AI. The company offers free trials to active law enforcement personnel, but its unclear how they verify this beyond requiring a government email address.

Why arent law enforcement agencies enforcing rules about which surveillance tools officers can use? Why arent their internal accountability mechanisms working?

There are also very real concerns around security when using Clearview AI. It monitors and logs every search, and we know it has already had one data breach. If police are going to use powerful surveillance technologies, there must be systems in place for ensuring those technological tools do what they say they do, and in a secure and accountable way.

Relatively little is known about how the Clearview AI system actually works. To be accountable, a technology used by law enforcement should be tested by a standards body to ensure it is fit for purpose.

Clearview AI, on the other hand, has had its own testing done and as a result its developers claim it is 100% accurate.

That report does not represent the type of testing that an entity seeking to produce an accountable system would undertake. In the US at least, there are agencies like the National Institute for Standards and Technology that do precisely that kind of accuracy testing. There are also many qualified researchers in universities and labs that could properly evaluate the system.

Instead, Clearview AI gave the task to a trio composed of a retired judge turned private attorney, an urban policy analyst who wrote some open source software in the 1990s, and a former computer science professor who is now a Silicon Valley entrepreneur. There is no discussion of why those individuals were chosen.

The method used to test the system also leaves a lot to be desired. Clearview AI based their testing on a test by the American Civil Liberties Union of Amazons Rekognition image analysis tool.

However, the ACLU test was a media stunt. The ACLU ran headshots of 28 members of congress against a mugshot database. None of the politicians were in the database, meaning any match returned would be an error. However, the test only required the system to be 80% certain of its results, making it quite likely to return a match.

Read more: Close up: the government's facial recognition plan could reveal more than just your identity

The Clearview AI test also used headshots of politicians taken from the web (front-on, nicely framed, well-lit images), but ran them across their database of several billion images, which did include those politicians.

The hits returned by the system were then confirmed visually by the three report authors as 100% accurate. But what does 100% mean here?

The report stipulates that the first two hits provided by the system were accurate. But we dont know how many other hits there were, or at what point they stopped being accurate. Politicians have lots of smiling headshots online, so finding two images should not be complex.

Whats more, law enforcement agencies are unlikely to be working with nice clean headshots. Poor-quality images taken from strange angles the kind you get from surveillance or CCTV cameras would be more like what law enforcement agencies are actually using.

Despite these and other criticisms, Clearview AI CEO Hoan Ton-That stands by the testing, telling Buzzfeed News he believes it is diligent and thorough.

The Clearview AI case shows there is not enough understanding or accountability around how this and other software tools work in law enforcement. Nor do we know enough about the company selling it and their security measures, nor about who in law enforcement is using it or under what conditions.

Beyond the ethical arguments around facial recognition, Clearview AI reveals Australian law enforcement agencies have such limited technical and organisational accountability that we should be questioning their competency even to evaluate, let alone use, this kind of technology.

See the article here:
Australian police are using the Clearview AI facial recognition system with no accountability - The Conversation - Australia

Domen Zavrl: What Is Cryptography? – The Merkle Hash

Cryptography is a field of information security that is often misunderstood. Although the fundamental principles of algorithms generally stay the same, as infections and attacks evolve so too must these algorithms to maintain the security of confidential information.

Cryptography incorporates three key principles: encryption, integrity, and authentication.

Encryption

To encrypt a file data is converted into an unreadable form, protecting its privacy during storage, transfer and reception. Encrypted data is decrypted via a process known as decryption.

In essence, encryption and decryption require a special key, so that while data appears scrambled, both the sender and the desired recipient can still read and understand it.

Integrity

Cryptography assures message integrity, meaning that messages are accurately communicated and not altered or intercepted en route from the sender to the recipient. This is often achieved by hashing data, or cryptographically mapping out its path.

Maintaining message integrity requires technical skills. It can be accomplished using one of the following three techniques:

Authentication

Authentication is used to verify the senders identity. It consists of a short string of information that is used to confirm that the message originated from the stated sender. Method authentication code systems generally consist of three algorithms:

What Is the Difference Between Asymmetric and Symmetric Cryptography?

With asymmetric cryptography, two different keys are used to encrypt and decrypt the file. All participants in an asymmetric cryptosystem have both a public key and a private key. The public key can be freely distributed, but the private key is kept secret.

Data encrypted using a public key can only be decrypted using a corresponding private key.

With symmetric cryptography, both encryption and decryption are carried out using the same key. The sender and recipient must both already have the shared key.

Symmetric cryptography is generally more suitable for encrypting large amounts of data, since this form tends to be faster. Asymmetric cryptography is only suitable for encrypting files that are smaller than the size of the key, i.e. 2048 bits, or smaller.

Domen Zavrl has two PhDs: one in Applied Macroeconomics and the other in System Dynamics. Mr Zavrl has also studied Cryptology at Stanford University. He is an associate of Framingham Asset Management, as well as a member of The Institute of Internal Auditors.

Image(s): Shutterstock.com

Follow this link:
Domen Zavrl: What Is Cryptography? - The Merkle Hash

Switzerland files criminal complaints over crypto spying on behalf of CIA – Financial World

The Swiss Government had filed a criminal lawsuit over the United States Central Intelligence Agencys alleged abuse of a cryptography firm to spy on several Governments secret intel and communications, the Swiss Attorney Generals office said in a statement on Sunday, the 1st of March 2020.

Besides, according to the court documents, the criminal complaint was filed against persons of unknown origin who had been allegedly breaching the international law of exports controls. On top of that, latest accusation from the Swiss Government over CIAs abuse of a cryptography firm to execute covert operations on behalf of them followed a similar high-profile lawsuit regarding alleged breach of Government data named as Operation Rubicon dated back to the 2007s, which for decades involved United States CIA and Germanys BND to covertly spying over other nations encrypted messages by utilizing a technology sold by Swiss firm Crypto AG.

Meanwhile, adding that the Swiss Attorney Generals office would review the complaints before proceeding in to criminal jurisdictions, the Attorney Generals office said in its Sundays (March 1st) statement, The Office of the Attorney General confirms it has received a criminal complaint by the State Secretariat for Economic Affairs (SECO) dated Feb. 2, 2020 regarding possible violations of export control law.

Read more:
Switzerland files criminal complaints over crypto spying on behalf of CIA - Financial World

Onchain Custodian Picks IBM’s Solution to Securely Expand its Wallet Management Offering – Fintech News Singapore

Onchain Custodian (ONC), the Sequoia-backed digital assets custody service provider headquartered in Singapore, has just released the next version of its SAFE platform, integrating cryptography services on an infrastructure securely hosted by IBM.

The digital asset custody SAFE platform complements its cold storage offering with a wallet management service underpinned by the IBM Cloud Hyper Protect Crypto Services. IBM Cloud Hyper Protect Crypto Services allows for secure key generation and protection of key by taking advantage of the industrys first and only FIPS 140-2 Level 4 1 certified Hardware Security Module (HSM) available in the cloud, which means that its highly tamper-resistant.

Storing keys in such an environment means they are highly secured not even IBM, the cloud infrastructure provider, can access the keys. Only Onchain Custodian, responding to an authenticated customer instruction, can access them. The platform update enables digital asset exchanges, fund managers, and projects, among others, to outsource partially or fully the safe hosting of their wallets, while securely automating transaction flows based on threshold and other security measures.

Alexandre Kech

Alexandre Kech, CEO of Onchain Custodian, said

Being able to work with IBM and use their technology to create a highly secure platform was a privilege. IBM Cloud Hyper Protect Crypto Services is exactly what we were looking for. Onchain Custodian can focus on building the best execution platform and user experience with our technology provider Onchain while IBM provides us with the best HSM on cloud solution in the market to securely host, maintain and operate our SAFE key management infrastructure.

Rohit Badlaney

Rohit Badlaney, Director, IBM Z as a Service, said

By taking advantage of IBM Cloud Hyper Protect Services, Onchain Custodian can build a highly resilient and secure cloud-based solution that digital asset custody deserves. Supporting custodians like Onchain Custodian is an ideal use case for IBM Cloud Hyper Protect Services.

Onchain Custodian is backed by Fosun, DHVC and Sequoia Capital, the venture capital firm which has backed companies that now control $1.4 trillion of combined stock market value, including Apple, Google, Oracle and PayPal, and is gaining significant foothold as it builds up its portfolio of institutional clients across the Asia Pacific region.

Da Hongfei

Da Hongfei, Onchain Custodians Chair of the Board, concluded:

Since our debut, we have been relentlessly growing our customer base and open finance service offering with our curated partners. With our enhanced custody solution now live, Onchain Custodian is ready to expand further. We are looking for strategical investors to accelerate our scaling.

Independent third-party digital asset custody has become an essential piece of infrastructure that many experts consider critical for the long-term sustainability of digital assets and cryptocurrencies. By providing a focused approach to security, operational efficiency and risk management to institutional players holding cryptocurrencies and digital assets, Onchain Custodian allows its customers to focus on their core business.

Featured image: Alexandre Kech, CEO of Onchain Custodian

Original post:
Onchain Custodian Picks IBM's Solution to Securely Expand its Wallet Management Offering - Fintech News Singapore

A change in Safari will soon prevent website owners from using TLS certificates for longer than 13 months – Gizmo Posts 24

Within a short while, Apples browser Safari will warn users when a website theyre visiting is using a TLS/SSL certificate that is valid for more than 398 days. It doesnt have to be an expired one either. Any certificate that has been valid for more than 398 days since issuing will now be automatically flagged by the browser.

This has come after the 49th CA/Browser Forum in Slovakia, and The Register reported that the goal is plain- ensuring that web developers are using the latest certificates and technology available. Before this came to be, developers were able to assign certificates for multiple years, resulting in using technology that was long out of date.

As reported by an insider, the aim is to improve website security by making sure Deva uses certificates with the latest cryptographic standards and reducing the number of old and outdated certificates that has a high chance of getting stolen and re-used for phishing and drive-by malware attacks. If any miscreant happens to break the cryptography in an SSL/TLS standard, people will be switching over to more secure certificates witn hin a year.

Like any other thing, this is also going to have its set of negative points. According to Tim Callan, who is from the SSL management firm Sectigo, more certificate replacements means more chances of something going wrong.

In a report to The Register, he stated, Companies need to look for automation to assist with certificate deployment, renewal, and lifecycle management to reduce human overhead and the risk of error as the frequency of certificate replacement increases.

As of now, GitHub and Microsoft are using two-year certificates, with microsoft.com set to be renewed in October. If they plan to keep going with their two-year policy, you can expect Safari to tell you that the website isnt secure.

See the rest here:
A change in Safari will soon prevent website owners from using TLS certificates for longer than 13 months - Gizmo Posts 24

Cloud Security Alliance 2020 Initiatives Changing the Face of IT Audit and Cloud Assurance – AiThority

Certificate of Cloud Auditing Knowledge and Cloud Controls Matrix v4 represent critical progress to modernize the audit profession and align cloud assurance with technology innovations

TheCloud Security Alliance (CSA), the worlds leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, announced a call for subject-matter experts to support the ongoing review of its flagship document, the Cloud Controls Matrix (CCM), Version 4 of which will be released later this year. CCM v4 will reflect the current cloud technology landscape, providing cloud users with a better, more comprehensive security framework and guidelines to facilitate both implementation and audit.

Calling all today cloud subject-matter experts! @cloudsa is asking for help to support the ongoing review of its flagship document, the Cloud Controls Matrix (CCM) Version 4. Join Us!

Additionally, CSA is pleased to announce that theCertificate of Cloud Auditing Knowledge (CCAK)subject-matter expert working group has held initial program development meetings and that the CCAK credential and courseware will be previewed at CSAsSECtemberconference (Seattle, Sept. 14-18). The CCAK is a new credential for industry professionals that demonstrates expertise in the essential principles of assessing and auditing cloud computing systems and will be released in the second half of 2020. The CCAK will provide a common baseline of knowledge and shared nomenclature to ensure that IT and security professionals, as well as auditors, have the right expertise and tools to appropriately and accurately understand and measure the effectiveness of cloud security controls.

Recommended AI News: Incremental Growth in Cloud Spending Hits a New High while Amazon and Microsoft Maintain a Clear Lead

For 11 years, the Cloud Security Alliance has led the industry in delivering the necessary innovations to build the trusted cloud ecosystem on a global basis. In 2020, CSA will focus on supporting the cloud community in acquiring the necessary tools, skills, and expertise to ensure that the many iterations of cloud meet robust security and privacy objectives, said Daniele Catteddu, Chief Technology Officer, Cloud Security Alliance. As organizations adopt DevOps, CI/CD, and related innovations, the audit function must keep pace. With the release of CCM and CCAK, we continue to support the community in their cloud journeys.

The Cloud Controls Matrix is the de facto standard in the market. Its latest iteration will include new control objectives in areas such as container and microservices, cryptography, and identity and access management, along with implementation guidance, and will improve upon the auditability of existing controls.

Recommended AI News: Cubic Signs Agreement With US Special Operations for Intelligence, Surveillance and Reconnaissance R&D

Cloud auditing skills are becoming a mandatory requirement for IT auditors and will become fundamental expertise for any IT manager and professional, especially in the areas of governance, risk management, compliance, and vendor/supply chain management. Traditional IT audit education and certification do not adequately prepare professionals for the challenges cloud provides. Recent breaches demonstrate the knowledge and responsibility gap that comprehensive cloud auditing frameworks such as the CCAK will solve.

Those interested in contributing to the development of the CCAK are encouraged to join the CSACloud Audit Expert Group. Group members should be familiar with CSAs best practices and control frameworks, such as theCloud Controls Matrix (CCM), theConsensus Assessment Initiative Questionnaire (CAIQ), andCSA STAR levels of assessment, as well as have knowledge in such key areas as cloud risk management, compliance, continuous auditing, and more. Members will be tasked with reviewing and providing advice on the scope, curriculum, objectives structure, go-to-market, and value proposition for the CCAK.

Recommended AI News: AiThority Interview with Adrian Leer, Managing Director Triad Group Plc

Original post:
Cloud Security Alliance 2020 Initiatives Changing the Face of IT Audit and Cloud Assurance - AiThority