Articles

Over the last decade of cloud migration, the threat model against Java applications and the way that we need to defend them has shifted. OpenJDK has made one positive change in this area already by deprecating the old SecurityManager, a relic that protected a bygone era of AOL CDs and paper maps. The next positive change in security is to strengthen the supply chain of software components, know what’s running and what’s vulnerable, and communicate this information with non-technical experts whose data is at risk.

Part of this threat model is driven by vulnerable libraries like last year’s Log4j. Although Log4j is a great logging library and was active on patching, many teams scrambled to identify where they needed to apply those patches. For individual Java developers or teams that knew their code and could deploy, the patch was simple — you updated a library and that was it. The reality though is that software moves fast and far, often leaving the locus of control of these technical experts to stakeholders that don’t have the expertise to manage a problem at this level. In a scramble, teams that did not know Java-specifics looked everywhere including .NET software and Python forums. The government of Quebec shut services down until they knew where Log4j wasn’t. This scrambling was not effective and does not protect our data.

Source de l’article sur DZONE

Data mesh. This oft-talked-about architecture has no shortage of blog posts, conference talks, podcasts, and discussions. One thing that you may have found lacking is a concrete guide on precisely how to get started building your own data mesh implementation. We have you covered. In this blog post, we’ll show you how to build a data mesh using event streams, highlighting our design decisions, and the key benefits and challenges you’ll need to consider along the way. In fact, we’ll go one better: we’ve built a data mesh prototype for you to check out on your own to see what this would look like in action, or fork to bootstrap a data mesh for your own organization. 

Data mesh is technology agnostic so there are a few different ways you can go about building one. The canonical approach is to build the mesh using event streaming technology that provides a secure, governed, real-time mechanism for moving data between different points in the mesh. 

Source de l’article sur DZONE

This week, a significant portion of the Web fell over when on Tuesday, sites powered by Fastly were impacted by a massive outage that affected around 85% of the network.

The near-total collapse — which was quickly identified and remedied — took out sites including GitHub, Stack Overflow, PayPal, Shopify, Stripe, Reddit, Amazon, and CNN. Furthermore, it was all but impossible to express rage on Twitter because the server that handles the social network’s emojis was also affected.

This outage was broad and severe, and we’re truly sorry for the impact to our customers and everyone who relies on them.

Nick Rockwell, Senior VP of Engineering and Infrastructure, Fastly Inc.

The incident occurred at around 10:00 UST (06:00 EST) and prompted mass “Error 503” messages. It was identified by Fastly in less than a minute and patched within an hour.

Initial analysis indicates that the whole episode was triggered by a single customer updating their settings (in a perfectly valid way) — you know those nightmares you have about clicking the wrong button and deleting the whole Web? Yeah, imagine being that person. The precise combination of settings triggered a bug in an update that had been missed in Fastly’s QA and had been sitting in production code since May 12th.

If you’ve ever visited a serious server center, you’ll know the kind of security they employ in defense of potential criminal attacks. The only center I’ve visited in person was inside a nuclear-proof bunker, involved multiple security checks, and I wasn’t even allowed into the really secure part. But it turns out, all the terrorists need to do to crash the global economy is open a CDN account and update their settings.

Fastly actually reacted far faster than previous CDN mass-outages by its competitors — one possible reason its share price soared this week. But it is still trapped in a cycle of competition in which fast and cheap are easily compared, and good is somewhat abstract…until it’s not.

Most of us feel like seasoned hands at the Web when the truth is we’re very early adopters. It will be a century or more before the Web is truly integrated into society. Still, we are building the foundations now, and future generations need those foundations to be robust. We need less focus on clawing back a few pennies, less focus on delivering sites 3 nanoseconds before a user opens their browser, and a greater focus on resilience.

Like everyone, I love eye-peelingly fast sites, and I’m more than happy to get a good deal, but personally, I don’t feel either of those things is worth waking up to an Error 503 on a site I’m responsible for.

Image via Unsplash.

Source

The post Poll: Fast CDN, Cheap CDN, Good CDN, Pick Any One… first appeared on Webdesigner Depot.


Source de l’article sur Webdesignerdepot

This week Google announced further details of its plan to remove cookies from ad tracking. The strategy, which the ad giant expects to be fully implemented by 2022, has come about due to increasingly stringent privacy laws in a growing number of territories around the globe.

Google’s first step was the announcement in January of FLoC (Federated Learning of Cohorts). Google itself is still testing and fine-tuning the system, but in essence, Google will replace 3rd-party cookies in Chrome with groups of anonymized users.

Critics of the plan have questioned whether users will be genuinely anonymous or whether Google will be tracking individuals to group them properly. The answer came earlier this week in a low-key announcement of KaST.

What is KaST?

KaST (Key and Surface Tracking) is the first iteration of Google’s new tracking technology. It works entirely without cookies and is fully device-agnostic.

The technology behind KaST is surprisingly old. It was first trialed in 1987 as a simple process for auditing the input of stenographers. Although the latest version of the technology draws heavily on voice recognition software algorithms, the original version of KaST — software named TAAA (Typist Account Accuracy Audit) — predates modern voice recognition by at least two years.

KaST uses…biomechanical and cognitive patterns, identifying individual users based on their keystrokes.

Just as your voice has a unique, identifiable modulation — anyone who uses telephone banking will be familiar with speaking their password — so too does your biomechanical input.

When you type on a keyboard or a touchscreen, the force, speed, and accuracy with which you hit characters are dependent on two things: your cognitive process and the unique biomechanics of your hands (the bones, ligaments, and muscles).

For example, when I type WordPress, I almost always type it as WordPRess (with a capitalized R). That is one facet of my combined biomechanical and cognitive process.

KaST uses keyboards and touch screens to track combined biomechanical and cognitive patterns, identifying individual users based on their keystrokes.

Mobile Approaches to KaST

KaST is heavily reliant on BMaC (Bio-Mechanical and Cognitive) input. Although Google hasn’t released any data to support the accuracy of KaST, BMaC is known to be surprisingly accurate.

Reports suggest that the KaST algorithm is 89.7% effective for character strings of 12 characters or more, leaping to 97.6% for 19 characters or more on a single device. That makes it too inaccurate for high-end processes like security but well within the necessary margin of error for a non-critical process like serving ads.

Google will be able to identify you on any machine, on any device, in any context, as soon as you type 19 characters or more

When switching to a touch-screen device, the accuracy plummets to just 87.8%. This may be one reason Google has been low-key in its trumpeting of the new technology so far.

According to TechBeat, initial trials of the tri-axis position of a device (X, Y, and Z rotation) were abandoned as inaccurate. Still, even without those additional tracking signals, Google claims KaST on mobile will achieve ~94% accuracy by the 1st quarter of 2022.

What Does KaST Mean for Users?

Much like many of the algorithms that govern our daily lives, KaST will be largely invisible to most of us. Unlike cookies that can be legislated for and removed from a local machine, your BMaC is as inescapable as your DNA.

Where privacy concerns really grow is that your BMaC follows you from device to device. How you type at home is identical to how you type at work. Your personal and professional profiles are now instantly connectable; Google will be able to identify you on any machine, on any device, in any context, as soon as you type 19 characters or more.

KaST Prompts Pre-M1 MacBook Rush

Within 24 hours of KaST’s announcement, Apple stores were reporting rush orders of pre-M1 MacBook Pros. With some stores reportedly selling out late on Wednesday.

The rush came in the wake of a Reddit post — that has since been removed — that claimed that the notoriously bad butterfly keyboard on pre-M1 MacBook Pros circumvented KaST because the inaccuracy of the keystrokes, and the tendency of the keys to stick introduced a random element that disguised the end-user from the KaST algorithm.

Although the Reddit post is unsubstantiated, it transpires that M1 Mac owners may not be the lucky ones after all.

Should You Worry About KaST?

Advocates maintain that KaST — and Google’s wider FLoC strategy — are beneficial to users and the web as a whole. They claim that identifying users without 3rd party cookies does more to protect privacy than hinder it.

Opponents argue that in a digital world rife with user tracking, privacy compromises of this magnitude cannot be contemplated simply to enable more sophisticated ad-serving.

Despite KaST’s early stages of development, privacy concerns are mounting, and a campaign has been launched to regulate Google’s use of the technology.

Source

The post Key and Surface Tracking Comes to Chrome first appeared on Webdesigner Depot.


Source de l’article sur Webdesignerdepot

Les marchés de clients individuels, optimisés par les plateformes et les algorithmes, peuvent désormais devenir instantanément une communauté ouverte pour des actions collectives et coopératives.

L’essor des communautés numériques

La technologie aide les clients à interagir plus facilement et à s’organiser en un nombre infini de communautés numériques exigeantes, parfois même révoltées.

Ces communautés se forment souvent de manière spontanée et se développent de façon exponentielle à un coût quasi nul. Nous le voyons, par exemple, lorsque de simples histoires individuelles deviennent virales ou lorsque des entreprises ont à affronter, quasiment du jour au lendemain, des foules qui entreprennent des actions difficiles à gérer.

La création et le partage d’objets sociaux sont au cœur de cette révolution des communautés numériques (1). Les communautés numériques étaient initialement basées sur des intérêts communs et se sont formées autour de points de rassemblement en ligne tels que des groupes de discussion et leurs artefacts numériques, les publications. De nos jours, les objets sociaux numériques prennent toutes sortes de formes, comme les tweets, les photos, les évaluations par les pairs et les mises à jour de statut (c’est-à-dire à peu près tout ce qui suscite un intérêt et une participation de masse et qui peut être facilement partagé).

Plus de 140 000 communautés mondiales se sont formées sur Reddit, couvrant des sujets très sérieux, et d’autres beaucoup plus obscurs. Par exemple, un groupe de 71 000 membres partage des photos de coussinets d’animaux.

La facilité avec laquelle des groupes comme celui ­ci peuvent se former, communiquer et agir implique que ces communautés sociales ne sont pas limitées à des objectifs de divertissement. Certaines sont clairement formées pour déstabiliser ou disrupter des entreprises. Les téléspectateurs, par exemple, ont réussi à faire revivre des séries télévisées, à faire pression sur celles qu’ils n’aimaient pas et à exiger que certaines soient réécrites.

Pour réussir, les entreprises doivent être capables de créer des objets sociaux importants aux yeux des groupes numériques et, par extension, de devenir la pièce maîtresse du fonctionnement du groupe. Il s’agit de trouver le bon équilibre : elles doivent éviter de déclencher la colère d’un groupe et de devenir l’objet de leur mépris.

Les clients se regroupent pour influencer les entreprises de quatre façons :

Ils utilisent les produits comme objets sociaux

Plusieurs sociétés de jeux en ligne ont donné naissance à des communautés participatives en transformant leurs jeux en objets sociaux. Les gamers peuvent partager des stratégies, créer de nouvelles versions des jeux et y jouer ensemble. Les sociétés de services musicaux transforment les playlists favorites en objets sociaux, qui sont ensuite facilement partagés avec d’autres personnes à la recherche du mix parfait.

Ils font des choix informés

Aujourd’hui, les sites d’avis sont généralement utilisés pour complimenter ou critiquer une entreprise en fonction de l’expérience vécue. D’autres utilisent ces avis pour décider quel produit acheter. De plus en plus de communautés numériques optimisées par l’IA se formeront pour partager opinions, conseils, bonnes pratiques et expériences personnelles autour d’intérêts communs.

Des ressources groupées

Les plateformes de données permettent aux clients de se regrouper pour acheter des articles à prix réduit. Les plateformes basées sur les coupons offrent des prix réduits sur des quantités minimums définies par le fournisseur. Les sites de financement participatif (Crowdfunding) permettent aux clients d’attirer l’attention sur une cause charitable ou de proposer leur aide pour développer de nouveaux produits. En échange d’un paiement initial, les donateurs reçoivent généralement le nouveau produit dès son lancement.

Ils font travailler collectivement les robots d’IA

Chargés par les clients d’obtenir le meilleur prix (par exemple via des comparateurs), les robots d’IA pourraient à l’avenir collaborer pour négocier et acheter collectivement des marchandises. Les robots d’IA apprendront à rechercher et à mobiliser d’autres robots d’IA pour aider à servir au mieux les intérêts de tous leurs clients.

Que peut faire votre entreprise ?

Rendre le partage social naturel

Utilisez le Big Data et l’IoT pour concevoir des objets sociaux qui s’intègrent à vos produits, plateformes numériques et à votre présence en ligne et que les gens veulent créer et partager. Oubliez la création et le contrôle de tout le contenu pertinent de l’entreprise, et optez pour le développement de communautés au sein de l’entreprise afin de partager du contenu qui bénéficie à l’entreprise dans le cadre de leurs interactions sociales.

Devenir le centre d’attention de votre communauté

Votre produit peut représenter la raison d’être d’une communauté, en permettant aux gens d’interagir de manière utile entre eux. Par exemple, de nombreux fabricants d’appareils de fitness utilisent des applications pour créer des communautés autour de ces appareils et accroître les interactions via des plateformes numériques.

Aider les communautés à trouver un sens

Aidez les communautés numériques à comprendre ce qu’elles veulent être, à défendre leurs valeurs et à atteindre leurs objectifs. Plusieurs entreprises de prêt-à-porter, par exemple, ont tiré profit de la volonté de leurs communautés de faire une différence à l’échelle mondiale, en associant l’achat d’un produit à une aide destinée à des communautés dans le besoin.

Publié en anglais sur insights.sap.com


Références

(1) « Social objects » (Objets sociaux), Wikipedia, consulté le 2 octobre 2018, https://en.wikipedia.org/wiki/Social_objects.

The post L’expérience client future : des marchés aux communautés appeared first on SAP France News.

Source de l’article sur sap.com

New research from the Pacific Northwest National Laboratory (PNNL) Data Sciences and Analytics Group shows that 25% of vulnerabilities appear on social media before the National Vulnerability Database (NVD). And it takes an average of nearly 90 days between a vulnerability being discussed on social media and the time it shows up in the NVD.

Vulnerabilities on Social Media

The reasons application vulnerabilities show up this often on social media before they get logged in the NVB are multiple. For developers just starting out in their career or those learning about a specific piece of software, they may not know that something is a vulnerability, that vulnerabilities need to be treated differently, and/or how to report vulnerabilities. In some cases, they may not know if the “issue” they found is a true vulnerability. Naturally, they look to the tools they regularly use when connecting with other developers—social media channels like GitHub, Twitter, and the various forums and discussions housed on Reddit.

Source de l’article sur DZONE

If the majority of your work meetings leave you feeling like this, you probably want to find a different employer.
Photo by Flickr/Ville Saavuori

If you’re a professional software developer – which is likely since you’re reading this article – you’re probably on Reddit. A lot.

And why wouldn’t you be? It’s a magical place where you and your tribe can exchange pearls of wisdom like this one:

Source de l’article sur DZONE