fabiochiu/medium-articles huggingface dataset:
Harmony 2019 Q4 Planning
By: Stephen Tse
Tags: Staking, Blockchain, Leadership, News, Meaning

Harmony’s vision is “Open Consensus for 10B” (see harmony.one/story).

Toward a fully open development and platform, we publish our quarterly planning publicly here as harmony.one/plan. We follow Google’s OKRs.

We believe activity < productivity < impact < value < meaning.

Here are our main goals this quarter:

$10k transaction fees: stablecoin, animoca game, porting dai

$10m ONE staked: delegation, 3 pools (binance, blockdamon, staked.us), 10 wallets

100% uptime: 40% external, $50k machine cost, 2-hour deploy

10 hires: 3 eng, 1 biz, 3 interns, china (2 eng, 1 biz)

We wear our ambitions on our sleeves. But these goals are not guaranteed deliverables.

Leadership & Vision

wallets / no throttle for token swap with binance, bitmax, kucoin (open deadline)

delegation, economics, slashing for EPoS specification

design doc for cross-shard HRC20/721 token standards

publish on cross-border financial products with china/india/vietnamese currency pairs

treasury management on foundation tokens, US utility memo
A Short But Interesting Answer to The Unavoidable Question of Life
By: Jonas Ressem
Tags: Self, Knowledge, Psychology, Meaning, Philosophy

An Absurd Answer

Indeed, in the lack of an answer, it’s not hard to render life meaningless. Looking at life as a whole, we realize it’s gigantic and never ending. Looking at ourselves, we realize we’re small and always ending. In the cosmic scale of things, we’ll be gone in a blink of an eye.

For some odd reason, however, we still search for meaning despite it. And that, according to the philosophy of Albert Camus, is the absurdity of life. To paraphrase the internet encyclopedia of philosophy:

“The Absurd is the product of a collision between our human desire for meaning and the blank, indifferent ‘silence of the universe.’ Here we are: poor creatures desperately seeking meaning in a seemingly meaningless world.”

Chances are we will never know whether there’s an objective meaning to life. There might be one, but due to limitations in our reasoning, we cannot discover what it is. But what we can know, is whether there’s a subjective meaning to our life — because that’s something we can experience.

Besides, why should we bother with the cosmic scale of things? Even if the universe doesn’t have any meaning, doesn’t mean that our lives doesn’t have any too. That’s what Nihilists forget. They forget who experiences meaning in the first place. The world doesn’t have the ability; we do.

This is an important realization because what we fundamentally believe will affect our thoughts and actions. And so, whether or not we believe that life is meaningful, we’re right. As Viktor Frankl, the psychiatrist who survived the Nazi concentration camps, observed:

“Ultimately, man should not ask what the meaning of his life is, but rather must recognize that it is he who is asked.”

So, maybe the answer to the unavoidable question is, in fact, another question. Maybe we shouldn’t ask what the meaning of life is, but rather, ‘how can I live a meaningful life?’
SQLite Database Encryption: The Easy Way
By: Abdul Wahab
Tags: Security, Sqlite, Encryption, Android, Database

How I did it!

I started looking at some basic ciphers that fulfill our acceptance criteria and found classical ciphers to began with. Classical ciphers are very simple to implement and can provide relatively less secure encryption while keeping the performance intact. To begin with, I selected the following three ciphers:

There are other classical ciphers i.e. Vigenère and Gronsfeld Cipher that are more complex and secure. I decided to implement a double transpose cipher for my use-case. Another requirement for my use-case was to encrypt only specified tables and columns. I created a JSON based configuration file to capture this information.

I created a utility in java that would take the SQLite database file and encrypt it as per my JSON based configuration file. In the App.java class of the utility, you have to define the path of the SQLite DB and configuration file.

The main method of the App.java builds DBEncryptor.java Object using the App Constants defined above and a type of ICipher object. In the example below, I have used ShiftCipher.java. It also takes the configuration file parsed into a Map<String, List<String>> for its processing.

The structure of the JSON based configuration file is rather simple. It contains an array of objects and each object defines the encryption configuration of a table. Only the table defined in the configuration file will be encrypted.

The DBEncrypter.java encrypts the database based on the configuration file by generating a set of select and update statements. Each Cipher class has a decode method that can perform decryption. You can convert the decryption code into a different programming language as per your platform.

Remarks

Although classical ciphers are less secure than modern cryptography, the tradeoff between security and performance is best suited for a database and storage intensive application.

Please contribute to the Github Repository or comment below if you know a better encryption scheme for my use-case.
Bcrypt — Account TakeOver Due To Weak Encryption — #HR51KDB
Tags: Encryption, Account Takeover, Bug Bounty, Ato, Information Security

Hey Fellas! I hope you all are doing good and safe. Thank you so much for showing your interest in my previous blogs and making it first viral blog post of the InfoSec Write-Ups.

I was testing a private program recently, let’s take target.com as an example. On the Log-In page, there is a functionality “OTP Log In”. In which OTP is sent to the registered mobile number.

To check if the OTP is leaking in response body or not, I intercepted the “OTP Log In” request in burp. And, yes, I was right. The OTP had leaked in the response body with the name “otpPassword” but the OTP was in an encrypted format i.e Bcrypt.

With the help of this nice tool (https://github.com/BREAKTEAM/Debcrypt), I easily decrypt the OTP value and successfully TakeOvered the victim’s account.

Steps:

“otpPassword”:”$2a$10$hs/tvUkd4GveEdx/hACRDehWza38Z1ncMAEFeOtG77/l.Ja0ktuQa”

2. Copy the Bcrypt Encrypted Value to Decrypt it.

3. Provided the value to this tool.

4. OTP for login is “12345”.

5. ATO is Successful.

I hope you enjoyed this writeup!, Follow me on Twitter for some cool tricks.
CTF Forensic challenge
By: Carlos Cilleruelo
Tags: Security, Encryption, Ctf, Cybersecurity, Technology

CTF Forensic challenge

Photo by Mika Baumeister on Unsplash

Last week a CTF event organized by the Spanish Guardia Civil was organized, the II NATIONAL CYBERLEAGUE GC. This challenge is oriented to students, due to that reason I could not participate. But I have I friend who participate, He knows I love forensic challenges so He sent me one of the challenges that were part of the competition. Their team did not manage to solve this challenge so let’s see what was about and how to solve it.

Evidence

There are two files:

container

snap.vmem

If you have played other CTF challenges this seems a little obvious but let it break into parts. The container seems to be an encrypted container and snap.vmem it is a RAM acquisition.

Secrets in live memory have been always a problem. Having a RAM acquisition can give us a lot of information in a digital forensics investigation. We can discover processes running, dump files, secrets, connections and a lot of useful information. The most popular tool for memory analysis is Volatility. Volatility is an Open Source project with a great and active community behind it, there are alternatives like Rekall but I personally prefer Volatility.

Right now Volatility has a 3.0 version with a lot of improvements but it is under beta. Because of that, I used the latest stable release, Volatility 2.6.

Volatility Analysis

The first thing we need to do is to identify the operative system in order to properly analyzed the live memory adquistion. Every operative system handles memory in a different way. Running image info will give us the suggested operative systems profiles.

./volatility_2.6 -f evidencias/snap.vmem imageinfo

The suggested profiles are Windows XP related, we can use one of them WinXPSP2x86 or WinXPSP3x86.

Knowing the operative system we can start to extract useful information. I always start with pstree. This will let us know whats processes were running in the system.

./volatility_2.6 -f evidencias/snap.vmem --profile WinXPSP2x86 pstree

The most interesting process to lookup is TrueCrypt. TrueCrypt was a program that allows us to created encrypted containers and partitions. Right now it is discontinued and has been replaced by Veracrypt. Some people thought that Truecrypt had hidden vulnerabilities but long history short, nothing was found.

Either way, Volatility has some commands centred in analysing Truecrypt processed:

truecryptsummary

truecryptmaster

truecryptpassphrase

truecryptsummary can give us information about the TrueCrypt process.
Alternative to IceDrive
By: Fran Villalba Segarra
Tags: Encryption, Alternative To Icedrive, Icedrive, Privacy, Encrypted Cloud Storage

IceDrive is a cloud storage service based in the United Kingdom that emphasizes enhanced security and data encryption.

For a very long time, IceDrive has praised to be the single most secure alternative to all these traditional cloud storage services. It features zero-knowledge encryption, and it is indeed extremely secure. It features mobile, web, and desktop apps, and its prices and usability are very reasonable. However, IceDrive is closed-source, thus you need to trust its practices, and doesn’t feature client-side encryption per default.

Internxt Drive, on the other hand, was developed by Internxt, with the vision of creating the first cloud storage service which presented the user with total control, security, and privacy of their files.

Unlike traditional cloud storage providers (eg Google Drive, Dropbox, Microsoft OneDrive), IceDrive and Internxt Drive encrypt your files not only in transit but also at rest, and only you have the decryption key of these. That means that your files are encrypted when stored and that only you can access your files. Internxt Drive does this in all its plans (free & paid). IceDrive doesn’t.

Unlike IceDrive, however, Internxt Drive is open-source and makes use of file distribution, meaning that files are fragmented, shards are encrypted, and no machine ever holds a whole file. This is a huge differentiator between Internxt Drive and Sync, pCloud, MEGA, IceDrive, etc. Thanks to this unique architectural design, Internxt Drive praises to be the single most secure cloud storage service out there.

Additionally, unlike IceDrive, Internxt Drive comes with 24/7 support, a free plan that features zero-knowledge encryption, seamless user experience, and many other perks.

Think smart. Make the switch.
Ring Rolls Out End-to-End Encryption to All Users Globally
By: Raziah Lauretta
Tags: Ringrolls, End To Endencryption, Encryption

However, encryption cannot be turned on automatically. You will need to opt-in for additional security.



The ring has made end-to-end encryption finally available to all users around the world. The feature is disabled on any device that does not have an enrolled mobile phone. Anyone without an enrolled mobile phone can view recorded footage and live streams.

Ring Unveils End-to-End Encryption, But Not Without Limitations

Ring Blog posted that Amazon-owned company has added an extra layer of security to its line of home security products. Ring released a technical preview in January 2021 of end-to-end encryption in the US. Now the feature is available to all.



All recordings in the cloud are encrypted. Ring’s servers also have encryption. So you can make it harder for malicious actors to access your doorbell’s footage by activating end-to-end encryption.



Ring’s end-to-end encryption has its limitations. Battery-powered Ring devices do not support it, and it isn’t clear why. Only a few wired devices can provide end-to-end encryption, such as the Ring Floodlight Cam, Indoor Cam, and Ring Video Doorbell. Ring’s website has a complete list of compatible devices.



End-to-end encryption cannot be enabled by default. The feature must be enabled via the Control Center in Ring. You can only view your videos on enrolled mobile devices.

Ring Strengthens Security in Other Areas, Too

Ring’s latest update will allow you to use third-party authentication apps to access your Ring account. This makes it safer to log in since the one-time code sent to you via SMS is not always secure.



When you log in to Ring or Neighbors, you will also see CAPTCHAs. These will not be annoying, but they’ll help to prevent bad actors from accessing the apps.



Ring also announced that the new system would make it easier to give away or sell your device. Instead of calling customer service, the new owner will scan the device while setting it up and follow the instructions in the app. This will remove the device and all footage from its previous owner.

Making Your Ring Device More Secure

A live stream that is available 24/7 outside your home can be a great way to catch thieves and prevent theft, but it can also present a threat to your privacy. Ring’s end-to-end encryption can disable certain features, such as the ability to view Live View from multiple devices at once and share videos. However, it is worth it.
Introduction to Cryptography
By: Rittika Sur
Tags: Decryption, Cryptography, Encryption, Cryptosystem

In today’s modern world, internet and digitalization has taken over our lives and modern communication system which has made our life easier but with it the issue of privacy and security are coming over our ways.

In this digital era the issue of data privacy, security and safe communication has become a serious concern for the modern computing system. To fulfil this need, the concept of cryptography has been introduced in the computing systems which is used for storing data safely, secure communication over insecure network and so on.

CRYPTOGRAPHY

It is a mechanism of mathematically converting an information or message into some other format which can be only read or seen by authorized recipient i.e hiding a message from unauthorized access.

The fundamental objective of cryptography is to enable people for a secure communication over a public channel.

Cryptography has basically two parts — 1. Cryptography 2. Cryptanalysis

Types of Cryptography

Symmetric or secret key cryptography — This is any cryptographic algorithm which uses the same key for encryption as well as decryption. It is done by key sharing among the receiver and the sender. Example — Shift cipher, Substitution cipher, Transposition cipher, Stream cipher, DES(Data encryption standard), AES(Advance encryption standard). Asymmetric or public key cryptography — Here the cryptographic algorithm uses two different keys known as public key and private key for encryption and decryption respectively. Example — RSA, Knapsack, El-Gamal, Rabin etc.

OBJECTIVE OF CRYPTOGRAPHY

Modern cryptography concerns has 4 main objective

Confidentiality- Only the intended recipients will be seeing the information Integrity — Information cannot be altered in transit of message. Authenticity — Confirming the identity of all the parties involved. Non — repudiation — The sender cannot deny sending a message after it has reached the receiver.

MECHANISM

The receiver and the sender agrees upon a key which is to be used for encryption and decryption in a secured way. The receiver mathematically transforms the message(plaintext) into an unreadable form known as ciphertext, using a key. This process is known as ENCRYPTION. The ciphertext is then sent over the public channel to the receiver. The receiver again converts the ciphertext into plaintext using the same key. This process is known as DECRYPTION.

The main security here is, if an attacker captures the message in transit he won’t be able to read the original content of the message without knowing the key.

The cryptography algorithm is always made public, the only secret is the key

CRYPTOSYSTEM

It is a tuple of 5 elements (P,C,K,E,D)

P(Plaintext space) — set of all possible plaintext. C(Ciphertext space) — set of all possible ciphertext. K(Key space) — set of all possible keys. E(Encryption algorithm) — set of all possible encryption algorithm { ek(m) = P x K = C} D(Decryption algorithm) — set of all possible decryption algorithm. { dk(c) = C x K = dk(ek(m)) = m}

Condition in a cryptosystem
Healthcare costs from a data breach
By: Jonathan Weicher
Tags: Encryption, Medical Devices, Healthcare, Cybersecurity, Data Breach

If you’re looking for a clear and specific financial impact data breaches have on healthcare organizations, look no further than a new study from the Ponemon Institute, which conducts research on data protection. One statistic that puts things into stark relief is how healthcare providers lose an average of about $2.75 million per data breach, along with 10,000 patient records. And each record inflicts an average cost of $408. When you consider that 54% of vendors have experienced a breach, that is quite the substantial amount of losses.

At the other end of the spectrum, cyber criminals continue to target these providers and vendors because of just how alluring the promise of reward is. Patient information stolen from hospitals, their networks, medical devices, continue to net dark web denizens the highest profits compared to other types of data. In fact, 2018 marked the eighth consecutive year in which the healthcare industry saw the highest costs from data breaches, at a frequency nearly three times higher than other verticals.

From the largest enterprises to the smaller operations, healthcare providers of all kinds are aware, or should be aware, of the risks. Nor is it difficult to see the reason in action. UK Healthcare, an academic medical center, just had to reboot their systems after enduring a cyberattack that lasted a month. Even in this instance, where no patient records were seemingly compromised, day-to-day functioning was apparently impacted enough to exact a cost around $1.5 million, according to a spokesman. Although malware was the culprit here, the infiltrators failed to install any ransomware. Imagine how much higher the cost could have been otherwise.

UK Healthcare has reportedly bolstered their security posture in the wake of this event, but too often miscommunication and poorly defined roles can complicate matters for vendors and providers alike. Around 28% of providers will leave a vendor if a flaw in the latter’s security is found; but at the same time, they can often be lax in how they manage and monitor these third party risks, not caring enough until it’s too late. The relationship between the two is symbiotic as far as data protection is concerned, and both should be taking a proactive approach, not waiting until the other screws up. That will just make it easier for the hackers, in the end.

By: Jonathan Weicher

Originally published at: http://www.netlibsecurity.com

Copyright: NetLib Security
Freedom: Don’t Let Politicians Tell You to EARN IT
By: William Lloyd Garrison Center For Libertarian Advocacy Journalism
Tags: Earn It Act, Encryption

The Wile E. Coyotes of the Internet — US Senators Lindsey Graham (R-SC) and Richard Blumenthal (D-CT) — are sure that THIS time they’ve finally found a made-to-order tool that can take out the Roadrunn … er, those meddling ki … er, the First Amendment and Section 230 of the Communications Decency Act.

Surely, they believe, their latest super duper special Acme rocket — the “Eliminating Abusive and Rampant Neglect of Interactive Technologies Act of 2020, aka “EARN IT” — will finally allow them to deprive you of access to the strong encryption that protects your privacy, so that they (and every hacker on the planet) can snoop on you at will.

Here’s the cartoon character genius and deviousness of the EARN IT Act:

It doesn’t actually OUTLAW strong encryption, nor does it REQUIRE companies to cripple their products with “back doors” for law enforcement.

All it does is create a commission to establish “best practices” for Congress to pass into law.

What could possibly be the harm in that? Well, the EARN IT act would deprive any Internet platform that doesn’t implement those “best practices” of its Section 230 protection from liability for content created by parties other than itself.

What kind of “best practices,” one might ask?

“Best practices” for protecting user security? Nope.

“Best practices” for protecting freedom of speech, promoting vigorous commerce in digital goods and services, etc.? Nope.

“Best practices” for “preventing, identifying, disrupting, and reporting child sexual exploitation.”

You had to know that these cartoon character politicians were going to pull yet another “for the chilllllllldren” gag, and they lay it on thick — the words “child” and “children” appear nearly 300 times in the bill’s text.

And you have to know that among the first set of “best practices” to come down the pike will be demands that platforms prang encryption so that law enforcement can more easily read your emails, your text messages, etc.

If you’ve thought the matter through, you probably also know that the EARN IT Act and its associated “best practices” won’t prevent or disrupt child exploitation. The strong encryption genie has been out of the bottle for decades and no number or type of “best practices” can stuff it back in. People who have something to hide already have, and will continue to use, the tools they need to hide it. The only thing EARN IT will prevent or disrupt is your privacy and freedom.

Only the innocent and law-abiding among us would be affected by the EARN IT Act, and the effects on good and important things like freedom and privacy would be wholly negative.

Graham, Blumenthal et al. certainly know this too. Don’t let them trick you into thinking they’re just harmless idiots like Wile E. Coyote.

Thomas L. Knapp (Twitter: @thomaslknapp) is director and senior news analyst at the William Lloyd Garrison Center for Libertarian Advocacy Journalism (thegarrisoncenter.org). He lives and works in north central Florida.
Alternative to Cryptomator
By: Fran Villalba Segarra
Tags: Security, Encryption, Cloud Computing, Cloud, Cryptomator

Cryptomator is a great, open-source tool that allows anyone to client-side end-to-end encrypt any files uploaded to traditional, less secure cloud storage services (Dropbox, OneDrive, iCloud, etc). You install it on your computer and it encrypts the files before these get uploaded. This, essentially, transforms a cloud service like Dropbox into a more secure service like that offered by Tresorit, Sync, or pCloud. While it’s great, here we want to showcase a better alternative to using Cryptomator.

Cryptomator is a highly technical service, and thus if you aren’t diligent at all times and accidentally upload a set of files unencrypted. This is an unnecessary hassle, given that there are plenty of open-source cloud storage services that are client-side encrypted.

Internxt Drive is a highly secure cloud storage service, that shards files and client-side end-to-end encrypts these. The main advantage of using Internxt Drive instead of using Dropbox + Cryptomator is the ease of use. Unlike Dropbox & co, Internxt Drive already has its encryption mechanism built-in, without the need for third-party apps like Cryptomator. But ease of use isn’t only it.

The fact that files are not only client-side encrypted but also fragmented in a way that and a machine never hosts a whole file, also makes it more secure against hackers.

Make the switch to a more convenient, innovative, eco-friendly, and secure alternative to your current cloud service + Cryptomator. Make the switch to Internxt Drive.
Alternative to Boxcryptor
By: Fran Villalba Segarra
Tags: Security, Encryption, Cloud, Alternative, Crypto

Boxcryptor is a very interesting tool that allows anyone to client-side end-to-end encrypt any files uploaded to traditional, less secure cloud storage services (Dropbox, OneDrive, iCloud, etc). You can install it on your computer and it will encrypt the files before these get uploaded. This will basically transform any cloud service (eg Dropbox) into a more secure service like that offered by Tresorit, Sync, or pCloud. While it’s great, here we want to showcase a better alternative to using Boxcryptor.

Boxcryptor is a highly technical service, and thus if you aren’t diligent at all times and accidentally upload a set of files unencrypted. This is an unnecessary hassle, given that there are plenty of open-source cloud storage services that are client-side encrypted.

Internxt Drive is a highly secure cloud storage service, that shards files and client-side end-to-end encrypts these. The main advantage of using Internxt Drive instead of using Dropbox + Boxcryptor is the ease of use. Unlike Dropbox & co, Internxt Drive already has its encryption mechanism built-in, without the need for third-party apps like Boxcryptor. But that’s not only it.

The fact that files are not only client-side encrypted but also fragmented in a way that and a machine never hosts a whole file, also makes it more secure against hackers.

Make the switch to a more convenient, innovative, eco-friendly and secure cloud service than your traditional cloud service + Boxcryptor. Make the switch to Internxt Drive.
GPG ENCRYPTION
By: Sybren Boland
Tags: Encryption, Gpg, Mac, Private Key, Public Key

Do you feel lost when others talk about encryption? In this post we will get you started with GPG encryption and encrypt/decrypt our deepest secrets. We will install the gpg commandline tool to do so.

GNU Privacy Guard (GPG) is an implementation of the OpenPGP standard. Documentation of the gpg commandline tool can be found here.

Installation

For me the easiest way to install gpg was to use homebrew.

brew install gpg

For me this was not enough and gave some complications further or. So you can install the fix right away or try without.

brew cask install gpg-suite

Gpg should now be installed and can be used from the command line. You also need a public, private key pair to encrypt and decrypt messages.

gpg --full-generate-key

Follow the creation steps (defaults are fine) and enter a passphrase that you can use to access your private key. Both public and private keys are stored in your keychain at ~/.gnupg/pubring.kbx.

Encrypt

To encypt a file you only need the public key. You could import a public key of someone and encypt a message only the person with the corresponding private key could decrypt. For now we will use our own public key. You can list all public keys on your keychain.

gpg --list-keys

This will expose some information off the public key with the key’s fingerprint as the most important property.

We can use this fingerprint to choose with which public key we want to encrypt if we have multiple on our keychain. Let’s encrypt a file named secret.txt with the text “deepest secret” inside.

gpg -r 5C66CD573B5D044B6527DA84FD59B789EAA0677B -e secret.txt

This produces a file named secret.txt.gpg with the encrypted message. Only the one with the private key corresponding to the public key 5C66CD573B5D044B6527DA84FD59B789EAA0677B can decrypt this file now. Fortunately that is use.

gpg -d secret.txt.gpg

Note that we don’t have to specify with which private key we want to decrypt, the corresponding one is found on our keychain.

Our passphrase will be requested for we are going to use the private key. When everything is in order our deepest secret will be decrypted.

Hopefully you can now encrypt and decrypt your secrets with GPG encryption. Happy crypting!
Base64 Explained
By: Ofer Shmueli
Tags: Infosec, Cryptography, Encryption, Base64

Base 64 is used everywhere. It is the most known and famous encoding scheme that is used to represent binary data and transform it into an ASCII representation. Why do we use it? What is the algorithm? And how does it actually work?

We use base 64 as a method to encode binary data into an ASCII representation.

Why?

We do so since many systems and networks just don’t represent binary data as it is supposed to be shown. So how does it actually work?

Let’s do it by example. Let’s take the word FortiGate. Each character has an eight-bit representation.

If we will convert each character into its own ASCII binary presentation,

We will see for example, that the character F has a value of 102,

which’s the decimal value of the character. If we convert it into a binary presentation, we will get 01100110.

Let's convert each character into their binary representation

Now take the different bits, the different character bits, and regroup them in a six binary digit format. That is taking each byte last two bits and add them up to the next eight-bit.

By doing so, we will have six-digit binary groups. more groups than we had before.

Now take each group and convert it into its own decimal number.

So now the first group is actually 25, converting it into its own decimal value, the second group is 38, and so on.

Base64 table

Now, take the base 64 encoding table which you can find just about everywhere ( Google ) And each decimal value has its own representation in base 64.

25 is actually Z 38 is m, converting that way, you will find out that the word FortiGate is actually in base 64 Z M, 9 Y, D G L N Y X R L.

Let’s now do it using a Python script and check it out.

My Book Of secrets — Cryptography Handbook for beginners

https://www.amazon.com/gp/css/order-history/?ref=hud_2_gw_profile&pf_rd_r=V6S41K9CV56PSH9JCFDX&pf_rd_p=74587702-88fd-42c7-8550-0760c67a45f3&pd_rd_r=7e0ee6b5-3c50-46c6-8ccb-153fd78dcb92&pd_rd_w=bVVwr&pd_rd_wg=xRnFn&ref_=pd_gw_unk
Added Security Measures and Changes in TLS 1.3
By: Dorai Ashok S A
Tags: Encryption, Internet, Https, Ssl, Cybersecurity

When a new version of software is released, it could be to patch security vulnerabilities, fix bugs, provide new features and enhancements. Similarly, every few years newer versions of protocols are released. These newer versions largely retain the same goals but incorporate new requirements and challenges.

Some protocols such as SMTP are not even versioned and will likely never have a newer version, while TLS — Transport Layer Security protocol will always will. A fine balance of usability, compatibility and security is maintained in TLS protocol. And, as technology matures, additional security guarantees are provided, such as forward secrecy, and older cryptographic algorithms are deprecated or their weaknesses are addressed.

The changes in TLS 1.3 are significant. This newer version reworks the handshake sequence that establish the encryption parameters, updates the version negotiation mechanism, encrypts all messages (except first two) and provides a new zero round trip time (0-RTT) mode to reduce latency at the cost of security.
The Goldilocks Fundraise. Startup founders — how much should you…
By: Dan Bowyer
Tags: Founder Stories, Startup, Venture Capital, Fundraising, VC

Startup founders — how much should you raise?

It’s fair to say in this crayzay investment world right now you could probably raise a cool mil off the back of a crayon scribbled napkin in a seedy bar. But that aside, how much should you really raise in the early stages?

Not too much, or you may fall into BAU and never have the hunger or discipline to make it (PS don’t give too much to investors and don’t think that money answers everything, it doesn’t).

Not too little or you’ll never catch your flow with too little action and too many fires.

In either event, doing a flat or down round in 18 months is not a fun place to be. So…

𝗧𝗵𝗶𝗻𝗸 𝗶𝗻 𝗺𝗶𝘀𝘀𝗶𝗼𝗻𝘀.

Missions are time-boxed achievable things that milestone your way to your vision e.g. Hit £10k MRR by Dec 21, or sign one banner ICP within 90 days. Contextually — think what secret can you prove about your target market?

So sell us investors on your vision but have a realistic roadmap through each raise that is mission-centric. Always thinking one raise ahead.

If pre-revenue, what can you do on your own without raising? What mission (that you AND investors care about) can you hit with a spreadsheet, no-code platform, and an unlimited mobile phone plan?

Same with pre seed (SEIS). What can you do with the easier £150k that will get you investable for the next round? And again at seed. What mission is essential to raise your seriesA — e.g. £100k MRR.

Another trick is the rule of halves. Have 50% cash in reserve at the right time. Don’t bulk the numbers but instead have a get out of jail plan up your sleeve if you don’t hit target by 50% of the way through, to save 50% of what’s left, to hit your mission. (nb in early stage don’t focus on product, focus on market.)

And finally — check in regularly to make sure it’s mission possible!
Anxiety: Your startup’s first customer
Tags: Entrepeneurship, Founder Stories, Startup, Startup Life, Anxiety

I read somewhere that 72% entrepreneurs have anxiety or mental health issues, compared to the thumb rule of 1 in 4 for the broader population.

One day I am super excited about something as small (to the larger world) as a good meeting with my team on a tentative structure for one part of one of the products (or what we/I think is a product). The next moment, I am in a whirlpool of confusion, self doubt, chaos, scatter brained and blurry about the direction I am headed in. Why am I doing this. Is this right. How is this connected to my earlier work. Should it be connected? Wait, is it not connected? How will I ever find someone to work with. Should I do it alone. What’s next. Am I going too slow. Am I missing crucial steps. Why didn’t that person respond. Am I misinterpreting customer feedback. Why cannot I find that zillionth article I had read by that awesome person about how this should be done? What if I am making the wrong bets. Lull. Sunny day. Gloomy day. I don’t feel like working today, let’s go shopping. Oh my god, it’s 10pm and the partner wants to watch Netflix but I don’t want to stop working! Am I prioritising my time properly? How do I plan my day. Oooh, that person from that social circle seems to be rocking their work. Oh, another person with an awesome life update. What am I doing with my life? I am already late. Why am I doing this. Is this right. How is this connected to my earlier work. Should it be… Wait, this is my story. I should do it my way…right? But… Somebody tell me what’s the right way to do this…?!! Hello…?!

:)

PS. What helps?
Acknowledge the Good Days
By: Aaron Schwartz
Tags: Happiness, Founder Stories, Startup, Abundance, Ecommerce

I’ve been a startup founder for 10 years now. First company was … shitty. Lots of great ideas, awesome people. Tiniest acquisition of all time, though I do have a lucite “tombstone” from it! But, yeah, low on execution and high on stress.

Second company was over 8 years long. More highs. More lows. Another acquisition. Lots of gray hairs. Like, lots of gray hairs.

And that brings me to #3. We’re 18 months in. Great team that executes. No customer churn. Story-market fit. I *think* product-market fit (we’ll know that in retrospect). And, yeah, all of the stresses that come along with starting something from nothing.

Since mid-March 2019, I’ve been truly happy.

Not sure if it’s because things are right on the home-front (2 great kids, most supportive partner in the world who just so happens to be smarter / more successful, which is a pre-tty great perk in the life of an entrepreneur). Or because for the first time in my founder career I’m on a team that (1) has certainty on what we’re doing (2) executes.

But I don’t really care. I’m happy. And I’ve been verbalizing that to anyone who will listen. In the last two weeks, since I noticed this joy, I’ve been comfortable saying, “I’ve been in the shit for 10 years, so I need to celebrate the ups; you don’t know how long it will last for”.

Being a founder is hard. Being anything is hard. Don’t forget to acknowledge when it’s going well.

Written on April 11, 5am b/c I couldn’t sleep last night. Meaning, well, it might start going downhill soon :)

(in case it gets rough and I happen upon this post, just a reminder of the fun)
Leadership Anonymous
By: Kunal Johar
Tags: Leadership, Founder Stories, Entrepreneurship

On August 23, 2011, a magnitude 5.8 earthquake hit the Piedmont region of the Commonwealth of Virginia, United States, at 1:51:04 p.m. local time. The shock wave from that earthquake started causing tremors in Northern Virginia and Washington, DC within minutes.

Tim and I were at a sales meeting at the National Association of Tank Truck Carriers. Mid pitch the room started shaking. Immediately, my mind flashed back to the kindergarten lesson of how to stay safe during an earthquake, and I made a beeline towards the door frame.

Everyone remained in the room and laughed, “you know Kunal this is an office building, the frames are fake… also it was a brand new building built to withstand any east coast earthquake.”

Meanwhile, 7 miles away in our DC office as the tremors shook the 50+ year old building, Zack had a different idea of how to handle the pending crisis. Fearful of the building falling down and our servers getting crushed in the rubble, he spent a few fearless minutes checking in all of his code to the cloud.

This is a screenshot of an email confirmation at the same time the shaking was at its peak.

The thing about Zack is that his entire team knows they can count on him. They can count on him to give the best answer, to be the most fair arbitrator, and to be on hand when they need him. The thing his team doesn’t know about him is that there was a time no one knew he would be a leader.

While I don’t exactly think that sacrificing one’s safety was the best move, it is one of many stories that define who Zack was before he became who he is.
Bootstrapping Selar.co to $550k in annual revenue and $2k MRR
By: Douglas Kendyson
Tags: Founder Stories, Africa, Indiehackers, Startup, Passion Economy

@jackbutcher via Twitter (https://twitter.com/jackbutcher/status/1357549673574187011?s=20)

I remember seeing the above image on Twitter sometime in September 2020. That was two months after we saw a significant uptick in our numbers after almost 4 years of iterating it slowly. The image gave me hope, but the thing with startup work is, where there’s joy and hope, there’s more anxiety. lol.

I often tell my friends that the thing I hate most about startup culture is the discontent and anxiety. Nothing is ever enough; you set a huge milestone, you work hard, you hit it and it’s still not enough. You have to make a new goal and go back to grinding, smh. I don’t want to rant in this post, this is meant to be a thank you post to everyone that helped along the way.

They say startups are a journey, and in this journey of building Selar, so many amazing people have helped, and I just want to say thanks to a few of them.

If I forget anyone’s name here, please forgive me.

To my day ones Yinka, Yomi, Dotun & Early, I definitely couldn’t have started Selar without you guys ❤️

Ezra Olubi, thanks for always being helpful with all the technical issues I had since the beginning, and thanks for always being very kind & supportive.

Iyin Aboyeji, thanks for always saying yes to help me with anything in such a selfless way. Your AWS credits plug is why Selar lasted its first 3 years without much traction or profit. Also, people really don’t know you mean it when you ask “How can I help”.

Flutterwave 🙄, if GB, Jimi or Adejuwon (my account managers at Flutterwave) see this post, they’ll be shocked to see me thanking Flutterwave considering how much I harrass them about their product every three days, but I have to give them credit too. While we’re plugged into multiple payment integrations (Stripe, PayPal, Paystack, e.t.c), Flutterwave built a lot of the infrastructure that powers Selar today, especially the African countries interconnectivity and I don’t think we could’ve gotten this far without them.

Tony Elumelu foundation & GIZ, thanks for giving us a $10k grant in 2018, that really helped.

To my best friends/therapists/advisors/people I pour out my heart to and complain about so much, I love you more than words can explain. Raymond, Mitchelle, Daniel, Michelle, Yinka, Dotun, Tomi & Aisha, thanks for always being there for me in every imaginable way possible. I cannot imagine what my mental health would look like without you guys. 😭❤️

To my amazing team, thank you Charis, Onome, Ibrahim, Lucky & Kelechi. Despite everything above, you’re responsible for taking Selar from 0 to 100.

To our customers, you mean the absolute world to us, you’re the reason. I can’t highlight everyone, but having 1/2/3 customers in the first 3 years was the only reason I found it hard to close the product and move on. Thanks for staying, thanks for trusting us, and thanks for referring Selar to the next person. Your referrals are why we’ve gotten this far.

Finally, thank God! Because He did that!
I really appreciate your work and attempts to drill this down.
By: ה כ, ר ב, א מצ עו ת י חו ס
Tags: Ivory Tower, Physics, Public Relations

I really appreciate your work and attempts to drill this down. I am a fellow Ph.D. and tend to think I have a decent grasp (as much as any pleb can in chasing the developments as of late). I am not certain who your target audience is now or in the end but I, who am no one, wish to pass along constructive feedback on the article (you can stop here if you would like). The goal of the piece is succinct and elegant as it’s here is the problem so I am going to address it. I was truly excited as I went into the piece but you very quickly went from simple and elegant back to ivory tower, journal tone, structure, syntax etc. I know these are not simple topics and concepts in the least but once you equation bombed me to the point the mathML was off screen it was… painful. Equations are a death blow to the public and the droning tone of most physics papers lacks beauty in the same way as the philosopher who publishes on X top and drones on for 20 pages what can be communicated simply and elegantly to the audience. A simple solution could be to push the proofs to the appendix. I do have to call you out on the self citations in paper though. That’s a personal pet peeve of mine. I do hope you bridge this gap as there is so much to be communicated from Physics that is incredible, as well as engage the lay public. That is good for everyone as it leads to interest, investment and new generations of scientists to come. Thank you for the piece and I wish I knew more. I feel as if I know even less… but I look forward to what’s to come. [1] :) -JAM
THINKING OUTSIDE THE BOX
By: Mprm Communications
Tags: Imagination, Technology, Public Relations, Creativity

THINKING OUTSIDE THE BOX

Necessity may be the mother of invention, but creative thinking doesn’t hurt. Over the past year, necessity forced us to rethink many aspects of our lives, leading to entrepreneurial innovation to serve the needs of a mostly homebound society. It propelled trends already emerging — take-out and grocery delivery, streaming media and video conferencing to name a few — as well as provided new offerings like virtual theater, gallery tours and speaker series, which hopefully will continue as it allows a greater audience to participate.

Now that the world is opening up, creativity continues to drive interesting uses of technology that we may not have previously envisioned. Some may have been initially conceived as media stunts, as they have definitely drawn attention, but to a large extent may also have business potential.

The use of TikTok as a recruiting/hiring tool is an excellent example of taking advantage of what has essentially been an entertainment and marketing platform to do something quite different. The necessity part was targeting a young cohort of job seekers to fill openings in retail and hospitality, necessary to reopen or expand business. The creative was TikTok partnering with retailers and hospitality companies to use their platform to not only recruit young talent but screen potential candidates.

Blockchain technology and bitcoins have long been in the news, but recently NFTs, unique, non-replaceable digital assets, are the buzz. They are attracting the attention of deep-pocketed collectors who are snapping up everything from Beeple digital artwork for $69 million to a LeBron James clip for $99,999. Now there are a number of people who are also trying to figure out how to make NFTs accessible to non-millionaires, with Oneof, a company dedicated to minting and releasing NFTs building on a more affordable blockchain platform. And then there is memecoin, a crypto currency inspired by internet jokes. How fitting.

Artificial intelligence is informing everything from the potential for self-driving cars to automating repetitive business tasks. But it has also entered the world of what was once considered creative pursuits, particularly writing. Who would have thought that there would be a competition among AI songwriters!

Social media has long been used by journalists to amplify their reporting, but using it for personal opinion has been problematic. Enter Sidechannel, a community on Discord for platform users to comment on news anonymously. They describe it as akin to hacking into a newsroom Slack.

What’s really interesting about this random sampling is how quickly we continue to adapt technology for new uses, whether it is to reach a specific audience, create community or launch new business models. Often the second or third iteration becomes the big success story. It’s why in a brainstorm a bad first idea can lead to a brilliant final solution. All it takes is a little imagination and a willingness to think outside of the box.
Public Relation (PR) Firm In Mumbai
By: White Horse Agency Pvt Ltd
Tags: Pr In Mumbai, Pr Agency In Mumbai, Public Relations, Pr Agency

What Is Public Relations?

Advertising is a vital correspondence process organizations, people, and associations use to fabricate commonly helpful associations with general society.

An advertising master drafts a particular correspondence plan and uses media and other immediate and backhanded mediums to make and keep up a positive brand picture and a solid relationship with the intended interest group.

Open picture makes up 63% of the estimation of most organizations today. When there’s a setback or when the organization’s notoriety separates, it influences the organization’s whole corporate presence and its members. It takes around 4 to 7 years to conquer a negative notoriety. Henceforth it has gotten significant for an organization to put resources into great advertising systems to keep up a valuable relationship with the general population.

But We Recommend You to Choose Best Pr Agency In Mumbai.

GET YOUR PR

Address: Patankar Residenc, Plot No 113 Office №2, New Sector-50, Seawoods, Navi Mumbai, Maharashtra 400706

Phone: 098335 75761

Appointments: getyourpr.com