Commentary: Cyral has been on a roll with two open source projects designed to make security a natural part of the development workflow.

Image: metamorworks, Getty Images/iStockphoto

Moving database applications to the cloud has been a boon for development teams anxious to move faster. It has also, however, exposed security flaws inherent in traditional security solutions, something data layer security startup Cyral has been tackling. To take this a step further, Cyral recently open sourced a project called Approzium to enable developers to better observe and secure data by themselves. It's a cool project for several reasons, not the least being that in security, obscurity really isn't your friend.

By open sourcing Approzium, Cyral makes it easier for developers to trust the project precisely because they don't really have to trust it--they can see the code. It turns out open source offers other advantages for Cyral, as well.

SEE:How to build a successful developer career (free PDF)(TechRepublic)

Approzium, available free for download under the Apache 2.0 open source software license, is designed to make lives easier for developers to iterate code faster and ship more secure applications and services. On the observability side, Approzium helps to eliminate blind spots in the diagnosis and tracing of complex performance problems within microservice architectures. On the security side, it also lets developers connect their applications to databases without the need to access credentials, thereby preventing leaks that can arise through inadvertent application logging, application compromise, or theft of secrets manager API keys.

In these ways, Approzium complements an organization's existing investments in monitoring tools like Datadog, New Relic, and Grafana, as well as secrets managers like HashiCorp's Vault. Out of the box, it supports Grafana, reporting performance and security metrics to the Grafana dashboard. With minor modifications, it can do the same for Datadog and other dashboards.

At first glance, I assumed Cyral was using a modified "open core" strategy here, but the company tells me that, no, Approzium is a fully functional, standalone service. It's simply an SDK that is easy to incorporate into an application and runs as a self-hosted service. It eliminates the need for credentials in code and provides confirmed identity information at runtime and enriches logs with service identity instead of simply logging a shared user.

Nice.Approzium follows Cyral's release in January of the open source brewOPA project, created to make it easier for developers, DevOps, and SecOps teams to interface with policy engines of the future. As Steven J. Vaughan-Nichols has written on TechRepublic sister site ZDNet, brewOPA helps developers to take advantage of YAML interfaces to bridge the gap between DSLs for data security in the new world of cloud-native, Kubernetes, service meshes, and more.Both open source projects help get developers invested in security from the start, rather than trying to bolt it on at the end of their development cycle. In this way, it has become critical to make security feel like a natural part of the development process so that it doesn't slow developers. Getting this balance right is increasingly critical to the success of open source projects, as well as the companies that hope to capitalize on them, like Cyral. In this case, Cyral seems to have handled the balance between its commercial complements to the open source Approzium and brewOPA projects with aplomb.

Disclosure: I work for AWS, but the views expressed herein are mine and don't reflect those of my employer.

Strengthen your organization's IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices. Delivered Tuesdays and Thursdays

Continue reading here:
This new open source project could be key to securing database applications - TechRepublic

For those worried about preserving the heritage of open source coding for future generations, rest assured, a deposit of GitHubs public repositories has made it safely to the Arctic World Archive.

According to a GitHub blog post, the code was successfully deposited on July 8, 2020 to the Github Arctic Code Vaulta data repository preserved in the Arctic World Archive, a facility for data preservation in Svalbard, Norway. The effort is part of the Github Archive Program and is Githubs second deposit made through the program.

Our mission is to preserve open source software for future generations by storing your code in an archive built to last a thousand years, GitHub wrote.

According to the blog post, a snapshot of all the active public repositories on GitHub was taken on February 2, 2020, resulting in 21 TB of repository data. In GitHub, a repository is used to organize a project and contains all the folders and files needed for the project to run.

This data was then written onto 186 reels of piqlFilma digital photosensitive archival film. According to a spokesperson for Piql, the makers of the film, the technology is a completely self-contained medium and any files stored on it will be recoverable in the future regardless of available technologies.

All information required to recover stored information is written on the film itself in human readable text, along with file specifications and source code for the retrieval software, the spokesperson told Motherboard in an email.

This is good news for advocates of open source coding who want to preserve a snapshot of all of Githubs public repositories. GitHub says on its website that it has over 50 million users and more than 100 million repositories.

As todays vital code becomes yesterdays historical curiosity, it may be abandoned, forgotten, or lost, Github wrote on its website. Archiving software across multiple organizations and forms of storage will help ensure its long-term preservation.

Every reel in the archive will include a guide in five languages. Information documenting the technical history and cultural context of the archive will be included as well.

Partners with GitHub in the Github Archive Program include the Internet Archive, Software Heritage, and Project Silica.

According to its website, the Arctic World Archive was established in 2017 and holds a collection of digital artifacts and information from over 15 contributing countries. The archive is located in the permafrost of an arctic mountain in the Svalbard archipelago and is designed to withstand natural and man-made disasters.

Other artifacts stored in the archive include manuscripts from the Vatican Library and masterpieces from the National Museum of Norway.

By signing up to the VICE newsletter you agree to receive electronic communications from VICE that may sometimes include advertisements or sponsored content.

Read the original:
21 Terabytes of Open Source Code Is Now Stored in an Arctic Vault - VICE

Worker-owned Deliveroo alternative Kolyma2 offers a potential blueprint for transitioning the platform economy to a post-capitalist world.

The platform economy as the business model of Deliveroo, Lieferando, UBER and Airbnb is called is a relatively new phenomenon. When it appeared, traditional unions did nothing to protect the workers from the new forms of exploitation that came along with it. It appears as independent, freelance work, but in reality it is not. Class struggle still lies at the heart of it: Some platforms like e.g. UBER do employ freelancers because they dont want to pay social benefits like health insurance, sick leave, vacations etc. This disruptive behavior has fierce effects on national and global economies.

A delivery rider earns 10,50 Euro on average, which is more than minimum wage in Germany, but in fact its less: If no order is dispatched to you, you dont earn anything and flat hourly rates are rare. Most riders pay their own gear smartphone, bike, maintenance and dont have paid holidays or sick leave.

In big cities like Paris most of the delivery riders are (illegal) migrants that do the job because they simply wont find another one. They often work as subcontractors for other bicycle couriers that have a legal status and dont perceive the flexible working conditions as a benefit. This not entirely the fault of the platforms, however, but also a result of the general situation of migrants that politics failed to address. Also there is a fierce competition between different platform companies, as they aim for market dominance.

This caught my attention immediately because it touches on many of the topics that we at DiEM25 discussed in our seminal policy paper: Technological Sovereignty Democratising Technology and Innovation. I couldnt wait to observe our theoretical concepts in real life. In early summer 2020 I finally got to talk to some people of Kolyma2 in a video conference.

Stefano Lombardo the prolific founder of Kolyma2 had been working for Deliveroo for more than four years. He was already planning to form a cooperative during his Deliveroo years. While riding for the multinational company, however, the idea never kicked off. But when Deliveroo left Berlin, he seized the opportunity. This is how the food delivery cooperative Kolyma2 started: with a tiny landing page and a telegram channel.

As adorable as this lo-fi approach was, technology seemed to play a crucial part, as it was really complicated to complete an order. The amount of communication between customers and riders was enormous. As a result, in November 2019, Kolyma2 had to close down operations. Apart from the technology there have been other issues. It simply was too much work on the shoulders of too few people.

But that wasnt the end of Kolyma2. In January 2020 they returned, equipped with better infrastructure. They teamed up with the French developer Alexandre Segura, who goes by the moniker Mex, and the platform Coopcycle. For once the COVID-19-Shutdown came in handy and business boomed in spring 2020.

The Coopcycle app brought in new customers that insisted on using a real app. From 60 orders on one weekend, the turnover rose to 80 orders per day. This was important to sustain Kolyma2, says Stefano.

You need to generate revenue, because dedication and idealism alone dont sustain your life. In 2019 we just imploded. We burnt out.

Mex platform Coopycycle the new app that is at the core of Kolyma2 has been built upon the remains of another failed startup: The Belgian delivery company Take Eat Easy. Mex tried to wrap his head around the fact that this billion-dollar startup could fail so badly and lose all its money. He felt that it couldnt be so complicated to build a food-ordering app. So Mex cloned the application and played around with it. Meanwhile, the idea of rider cooperatives with collective bargaining power started circulating across Europe.

Until then, Mex had thought that cooperatives belonged in the 19th century, as he vaguely remembered some socialist writings by thinkers like Charles Fourier or Robert Owen. However, he suddenly realized that the concept makes perfect sense in the modern world.

The idea arose that he could develop an app that belonged to delivery riders and that it could act as the factory they commonly own. Riders could run the platform on a local scale without global structures involved. Technology is not everything, for sure, he adds, but you need to have an app and a functional website to compete.

So why not build an open source solution and spread it around? For cooperatives like Kolyma2, this means having a boilerplate code for a monthly fee that is based on their turnover on the platform.

The idea of (publicly financed) open source software platforms that dont belong to a private entity but can be used by all citizens is something that DiEM25 already identified in the Technological Sovereignty paper. Such a commonly usable tool is a crucial means to level the playing field: To make sure that newcomers like platform cooperatives have a fair chance to compete against global players.

Bike messaging organised as a cooperative has been a thing in urban areas for some time now. The individuals working in this field are particular, as they are often left-leaning, anarchist and ecological. In that regard, e.g. UBER drivers really are a different crowd.

Mattia and Dana early members of the Kolyma2 collective think that the difference between a cooperative like Kolyma2 and a company like Deliveroo is the level of group engagement. It is different to work for a collective that you are part of, as opposed to working for a boss that you will probably never meet. At Kolyma2 there are no regular meetings, but they communicate via text messenger as this feels more organic in terms of chaos and flow. Not everyone likes to get involved at the same level. Some people only want to ride a bike for a living. Self-organization can be a lot of work.

There is a benefit to getting to know the work process, says Mattia, because at a company like Deliveroo you always feel kept at bay and there also was a kind of anxiousness about how long your job was about to last.

Most people value their freedom more than a fixed contract. There can be flexibility for everyone, not just for the upper echelons of these emerging economies. For Dana, for example, security isnt really an issue when it comes to her job. She prefers to live in the now and not in a possible future. Mattia, on the other hand, did have a fixed contract while working for Deliveroo. In reality, however, he wasnt secure in his job. It was a six-month contract with automatic renewal, but when he became sick near the end of one contract it turned out that the contract hadnt been renewed. Now, he prefers to work for a cooperative that he trusts and where he despite his freelancer status feels safer.

As of now, Kolyma2 is just a network of freelancers, but that is going to change soon as the company is now joining Smart Cooperative. Smart is a legal structure that enables freelancers to employ themselves in a cooperative. You make a contract based on your projected income and they pay you a monthly wage. Smart will host Kolyma2 under a legal umbrella until they are ready to fund themselves.

An important issue in the platform economy is the agency workers have over managing their reputation. Even liberals will agree that someone that has a good working biography should be able to use it in the labor market. If you work for platforms like UBER or Deliveroo, however, your reputation or rating belongs to the company and it disappears as soon as you stop working for them. Thats one of the reasons why DiEM25 argues for data unions representative organisations of platform workers that make sure that they can negotiate the terms and conditions of their contracts and prevent such bad business conducts.

Furthermore, the software itself is a crucial tool for platform cooperative like Kolyma2. Coopcycles app runs on a license inspired by Dmytri Kleiners Copyleft concept Coopyleft. To prevent that a giant like Lieferando just comes and takes away the software, in the Coopyleft license, the source code can only be used by entities who stick to certain ethical principles. To use software protected by a Coopyleft license, you need to use a cooperative model and fit the definition of a social economy actor as defined by the European Union.

This certainly has to be explored in more detail, as the world of delivery drivers is a unique ecosystem that doesnt necessarily translate to other work areas.In any case platform cooperatives can play a crucial part in helping to imagine new models of workplace democracy and workers organization.

Nick Srnicek argues in his book Platform Capitalism that the state should act as a kind of Venture Capitalist in the platform economy to ensure competitiveness. Stefano doesnt agree, because he thinks the state should stay out of these issues. Workers should learn to run a company the hard way, instead of learning to fill in funding applications. Otherwise you dont learn to get to know your customers and their needs.

In our Technological Sovereignty policy paper we demand to make EU funding for research and innovation more easily accessible for civil society organisations, non-profit technology projects, cooperatives and other actors with a clear mission of green and social change. With that and a Universal Basic Dividend that makes sure society gets a fair return on its public investment future cooperatives might have the financial means to explore these possibilities in a safe space.

Do you want to be informed of DiEM25's actions? Sign up here

More here:
Platform Cooperatives: Workplace Democracy for the 21st Century? - DiEM25

We've pointed out how the mainstream media's constant reference to Bitcoin being 'untraceable' just isn't true, and the FBI agrees - saying they're "far from being anonymous" and that there are also various types of software, open source and proprietary, that carry out an exhaustive exploration of transactions on their blockchain.

But one coin does qualify as 'untraceable' at least for now, and it's a thorn in the FBI's side as they admit to having an inability to detect the destination of the funds in operations when Monero (XMR) is used.

The FBI report appeared in a leaked document repository, and shows three cases involving Panamanian cryptocurrency exchange MorphToken. The document explains three cases of supposedly illegal exchanges of bitcoin (BTC) to monero (XMR) in said exchange house.

The leaked report is part of the documents released in Blueleaks, an extensive collection of police reports and government office documents published by the Anonymous group.

The FBI points out in the document that it evaluated actors in the dark web market (Darknet Market or DNM) that turned bitcoin into monero, allegedly unlawfully . The federal office rates monero as an enhanced anonymity cryptocurrency (AEC), implying that the aforementioned conversion prevents law enforcement officials from mapping the destination of the funds.

But That's Not Necessarily A Dead End...

If someone is converting Bitcoin to Monero, they're using an exchange. This means there's still a way to find what IP address is behind a Montro transaction. Instead of following entries on the blockchain's ledger, they're looking at server logs of the exchanges used to execute the transactions.

The evaluation is highly reliable, says the FBI, and is based on that agency's research, analysis of blockchains, and the use of "proprietary software." Also, the FBI says in the leaked document that it used information from the MorphToken cryptocurrency exchange, which operates in Panama.

Given that after the conversion to monero, the FBI cannot detect the destination of the funds , this agency assumes that the DNM actors do not carry out such a conversion to "diversify their portfolio." The suspicion of illegal activities is based, according to the FBI, on two factors: the availability of information about the inability to trace the funds once converted to monero and the existing means to acquire them without providing user information.

In the first case addressed by the FBI, Bitcoin transaction fees processed by Cryptonia, which operates in the DNM, were detected between May and September 2019. These were sent to addresses associated with MorphToken, according to blockchain analysis and investigations. from the FBI. All bitcoin, says the FBI, was converted to monero.

In another case, bitcoin shipments from the sale of drugs to MorphToken were detected in November 2019, by 4 participants from the DNM. In this case, proprietary software that analyzes Bitcoin transactions and open source software for traceability of the Bitcoin blockchain were used. More recently, in January of this year, actors associated with the DNM Apollon sent at least 11 bitcoin to MorphToken for conversion to monero.

Reality Check...

We're for legitimate usage of cryptocurrencies, and believe it being used for illegal purposes does nothing but slow mass adoption, even though the reasoning behind this lacks any logic.

It's important to remind everyone that every government provides untraceable currency themselves - it's called cash.These days, physical cash can be turned digital easily via a pre-paid debit cards available at thousands of convenience stores, even many gas stations - with no ID needed.

So don't let any spin you find elsewhere convince you that cryptocurrencies provide a new level of anonymity.

Original post:
Leaked FBI Docs Show Just How Easily They Track Bitcoin - And The Untraceable Coin They're Frustrated With... - Global Crypto Press