# Rust (Language)

## Summary

C and C++ are highly performant and offer low-level control, which is something systems programmers want. But they're not safe since it's easy to access wrong memory locations. Haskell is a lot safer but it doesn't offer low-level control. Go and Java are somewhere in between. In all these languages, trade-offs have been made. Rust is a programming language that's safe, performant, and offers low-level control.

Rust achieves this with strong static typing and compile-time checks. Many problems are caught at compile time rather than at runtime. The concept of ownership leads to memory-safe and thread-safe code. Rust itself is considered a multi-paradigm language with design elements taken from many other languages.

Rust is open source and overseen by the Rust Foundation.

## Discussion

### For what use cases is Rust suitable?

**Systems programming** is the main use case for Rust. Systems programming includes operating systems, file systems, and low-level drivers. We can also include any code that powers other applications, such as web browsers, web frameworks, and game engines. For systems programming, it's important to have safe memory management without runtime overhead. Untrusted code shouldn't be allowed to cause problems. We want low-level access so that we can optimize our code for time and space.

Rust is well-suited for **embedded development**. It can run on bare-metal systems without any RTOS. Pin and peripheral configurations can be enforced at compile time. We can choose to leave out the heap and allocate all memory statically. Concurrency is easy to achieve since Rust ensures that two threads will not accidentally share state. Interoperability and portability are other benefits.

Rust is capable of providing performance close to that of C++. Hence it's seen as a language for **High-Performance Computing (HPC)** and scientific computing.

The Rust community is also adopting Rust in a variety of areas including web development, distributed peer-to-peer computing, game development, GUI development, machine learning, quantum computing, audio processing, and more.

### Which are main design aspects of Rust?

**Ownership** is Rust's most unique feature. Each value can have only one owner. The value is dropped when the owner goes out of scope. Scope is implemented by another feature called **lifetime**. These bring memory safety to Rust programs. Heap memory is safely allocated and deallocated even without a garbage collector. Ownership can be borrowed or moved. For thread-safe code, Rust a thread can borrow ownership from another thread, thus preventing data races.

Most problems in Rust code are caught at **compile time**. As a result, runtime overheads are less. Rust abstractions are not expected to add overhead to equivalent low-level code. Rust calls this **zero-cost abstractions**. Rust doesn't support NULL pointers like in C/C++. Error handling is possible but there's no support for exceptions. Again, the philosophy is to catch most things at compile time.

Variables are **immutable** by default to promote safe coding. Another type-safe feature is that function parameters must include **type annotations**.

### Which are the basic programming constructs available in Rust?

Like most languages, Rust specifies language keywords, variables, data types, functions, function parameters, control flow, expressions, statements and comments. Scalar types include signed/unsigned integers, floating-point numbers, Booleans, and characters. Compound types include tuples and arrays, both of fixed length. Tuples can contain items of different types but array items must be of the same type. Data structures called *collections* are allocated on the heap. Vectors, strings and hash maps are examples.

Custom data types can be defined using `struct` and `enum`. In `struct` definitions we can include associated behaviour using *methods*. With `enum`, we can use the `match` expression to implement powerful behaviours including the `switch-case` construct common in other languages. Generics and traits enable reusable types and behaviours respectively.

A function can accept arguments and can return a value. Anonymous functions can be assigned to variables and passed around. Code blocks (including function bodies) are defined within `{…}`. Control expressions include `if-else`, `while`, `loop`, `if-let` and `while-let`. However, parentheses are rarely used around these expressions.

### Is Rust an object-oriented or a functional language?

Rust combines some aspects of both object-oriented and functional programming paradigms.

Rust provides `struct` and `enum` types that contain data and behaviour. Behaviour is specified using `impl` blocks. Rust provides encapsulation at many levels: modules, types, functions and methods. By default these are private and they're made public using `pub` keyword. Thus, developers can change internal implementations without affecting their users who use the public API.

Inheritance is widely used in OOP but this is not supported in Rust. However, Rust uses traits to achieve code reuse. Trait objects help achieve dynamic dispatch or polymorphism. In fact, trait objects are closer to OOP's objects.

Rust's `enum` and associated pattern matching are similar to algebraic data types seen in functional languages. Closures are supported, that is, we can define anonymous functions that capture their environments, save them into variables and use as function arguments. The use of iterators to process a sequence of items is also influenced by functional programming.

### Who has adopted Rust so far?

Apart from Mozilla that created Rust, the language has been adopted by many companies including Dropbox, Coursera, Figma, npm, Microsoft, Cloudflare, Facebook, Amazon and Discord. Adoption spans standalone software, cloud-hosted software, edge software and even embedded devices.

Dropbox preferred Rust's compile-time checks on static types over Python's dynamic typing. Rust provided high concurrency required by their file synchronization engine. At Coursera, user-submitted code is executed within Docker containers. Being a low-level and type-safe language, Rust offered Coursera more security than C. Figma rewrote its multiplayer syncing engine in Rust for better performance because the older TypeScript code suffered from garbage collection. At Discord, Rust is used for both client-side (via WASM) and server-side logic. Cloudflare is preferring Rust over C at the cloud edge because of its better memory safety.

Facebook's source control team chose Rust over C++ for its higher reliability. By 2019, Rust was widely adopted in Facebook, first for developer tooling and later for small services.

For embedded development, many RTOSes, CPU architectures and boards offer APIs for Rust. Sensirion, Airborne Engineering Ltd. and 49nord are some adopters in the embedded space.

### What are some criticisms of Rust?

Rust has its fair share of criticism. Among them are its complex syntax and a steep learning curve; slow compilations; limited choice of compilers and target architectures compared to C; limited tooling; limited or immature third-party libraries; unsafe and difficult integrations with other languages. Developers can misuse `unsafe` blocks. While its positioned as a systems programming language, not every programming is of this nature.

Rust is too verbose with syntax such as `Vec<Rc<RefCell<Box<Trait>>>>`. There are five types of pointers and it's not trivial to select the right one. Rust lacks a strict description of its semantics. This means that formal verification is not possible. The use of downloadable crates can lead to complex dependency trees. Some consider Rust macros a design mistake or an afterthought to cover up other mistakes.

While performant, Rust is not much better than Go, Java, Scala or Haskell. While C++ is not type safe like Rust, C++ has many static and dynamic analyzers to achieve this. C continues to be better in many aspects: highly portable, formally specified, many implementations, stable ABI. For concurrency and simplicity, some developers prefer Go.

### What tools are available for Rust programming?

Rust tooling is improving all the time. Beginners can note the following:

    + **Installation**: Rust can be installed or updated using `rustup`. This can also install optional components such as `clippy` (linter) and `rustfmt` (code formatter).
    + **Compiler**: The main compiler for Rust is `rustc`. It's based on LLVM compiler toolchain and therefore can target various architectures already supported by LLVM.  The executable program or package at the output of the compiler is called a *crate*. The tool `sccache` can reduce compile times.
    + **IDE**: VSCode, IntelliJ and Vim are some IDEs that support Rust, often via the Rust Language Server (RLS).
    + **Package Manager**: Projects typically have dependencies. *Cargo* is the package manager that fetches project dependencies from a central repository. Cargo is also a build system. After downloading the right packages, it can invoke the `rustc` compiler.
    + **Package Registry**: Crates are typically published at `crates.io`. By default, Cargo searches `crates.io` for dependent packages.
    + **Documentation**: The tool for this is `rustdoc`, which can also be invoked using Cargo. Documentation is generated from doc comments in source files or standalone Markdown files.

## Milestones

2006

Graydon Hoare at Mozilla, who usually works on compilers and tools, starts working on Rust as a hobby project. Later, when he shows this to his manager, Mozilla takes interest in this new language. The idea is to see if Rust could be used to rewrite their browser stack in a more safer and more concurrent way than possible with C++. In a later interview, Hoare notes that Rust's target audience was "frustrated C++ developers".

2009

Mozilla begins sponsoring the development of Rust. Rust is announced to the world in 2010.

2010

A bootstrap **compiler** for Rust becomes available. In 2011, a self-hosted compiler appears. In 2012, 0.3 alpha release of the compiler appears.

Mar
2014

Inspired by Python's PEP, Rust adopts an **RFC process**. Major changes to the language must go through this process. By June 2016, 1632 proposals are submitted, 243 are accepted and 69 are open.

May
2015

**Rust 1.0** is released as the first stable version of the language.

Nov
2017

Mozilla's Firefox Quantum now uses a CSS engine written entirely in Rust. Called *Stylo*, it replaces 160,000 lines of C++ with 85,000 lines of Rust. Due to Rust's excellent support for concurrency, the new engine speeds up page styling. Styling of child DOM elements is done concurrently. Developers could write code without worrying too much about safety. They found Rust's panics easier to deal with than C++ segmentation faults.

2020

In the annual StackOverflow developer survey, Rust is the **most-loved programming language** for the fifth year in a row. These are from survey participants who use Rust and will continue to use it. Rust is in fifth position as the most-wanted language. In July, Rust rises to 18th place in the TIOBE index from 33rd place just a year earlier.

Feb
2021

**The Rust Foundation** is formed with Mozilla coming in as a Platinum Sponsor. It's expected that the board will represent various stakeholders.

Apr
2021

In an article on TechRepublic, Matt Asay writes that it's Rust, not Firefox, that's Mozilla's most important contribution to the world of technology.

Aug
2021

Fulton et al. share results of a survey of 178 Rust developers. While developers like many of Rust's features that lead to safer code, they complain about long compile times, long time to prototype, and poor debugging tools.

Rust (Language)


# 5G NR MAC PDU

## Summary

An RLC PDU (Protocol Data Unit) consists of an RLC header and an RLC payload. At MAC sublayer, such an RLC PDU is called MAC SDU (Service Data Unit). MAC adds a **subheader** to this to construct a **MAC subPDU**.

MAC also sends/receives Control Elements (CEs), each with its own subheader. Signalling via MAC CEs complements RRC signalling by enabling dynamic configuration changes.

Multiple MAC SDUs and CEs can be part of a single **MAC PDU**. A MAC PDU is packaged as a Transport Block (TB) and sent on a transport channel to PHY layer for transmission.

While 5G NR MAC has a general structure for its PDUs, there are differences across downlink, uplink and sidelink channels. Random access procedure has a specialized MAC PDU structure.

## Discussion

### How does a 5G NR MAC PDU differ from a LTE MAC PDU?

A MAC PDU in LTE has a **single header** that has all the necessary information for decoding the entire PDU. In 5G, the MAC PDU has **one or more subheaders**, each subheader providing information to decode its corresponding MAC subPDU.

This redesign reduces latency in 5G NR. In LTE UE, a MAC PDU can't be assembled until uplink grant is available, since this determines the TB size. In 5G, MAC subPDUs can be assembled in advance. As soon as the grant is available, MAC simply adds necessary padding and concatenates subPDUs. NR design also allows MAC to process its PDU from the back.

There's a particular RLC detail that improves latency in 5G NR. In LTE, RLC does concatenation of RLC SDUs into a single RLC PDU. Hence, LTE UE can't construct its RLC PDU until uplink grant is received. **5G NR RLC doesn't do concatenation**. An RLC data PDU contains only one RLC SDU. Multiplexing/demultiplexing of RLC PDUs (regardless of the radio bearer) happens at MAC.

### What are some essential facts about MAC PDUs?

A MAC PDU consists of **one or more MAC subPDUs**. A MAC subPDU always starts with a subheader. Subheader is followed by a MAC SDU, a MAC CE or padding. When a set of MAC subPDUs doesn't exactly fill a TB, a MAC subPDU with padding is included. A MAC subPDU with only a subheader implies zero-length padding. Only one MAC PDU is allowed in a TB.

MAC SDUs, CEs and subheaders are all **byte aligned and in multiples of 8 bits**. Leftmost bit is the most significant bit.

The **order of subPDUs** in a MAC PDU is defined. In sidelink and uplink, the order of concatenation is MAC SDUs, CEs and padding. In downlink, the order is MAC CEs, SDUs and padding. In all cases, padding is the last subPDU.

MAC SDUs are of variable **size**, except for an SDU carrying UL CCCH. Some MAC CEs are of fixed size while others are of variable size.

In **transparent MAC** (BCH, PCH, BCCH on DL-SCH, SL-BCH), there's no MAC subheader. One MAC SDU is aligned to TB size.

### Which are the main fields of a 5G NR MAC subheader?

The MAC subheader consists of the following fields:

    + **Reserved**: R bit is set to 0. It may be used in future updates to MAC.
    + **Format**: F bit indicates size of the Length field L. For F=0, L is 8 bits, else L is 16 bits.
    + **Length**: L field indicates the length in bytes of either a MAC SDU or a variable-sized CE. This field is absent when not necessary, such as fixed-size CE, padding or MAC SDU containing UL CCCH. UL CCCH MAC SDU is of fixed size: 64 bits if LCID=0, 48 bits if LCID=52.
    + **Logical Channel ID (LCID)**: This 6-bit field identifies the logical channel carried in a MAC subPDU, a specific CE or padding.
    + **Extended Logical Channel ID (eLCID)**: This extends the range of the LCID field. It's size is 1 byte if LCID=34, 2 bytes if LCID=33. Two-byte eLCID is used only on IAB backhaul links.

### Could you describe the LCID field carried in a 5G NR MAC PDU?

LCID values and meaning differ for downlink, uplink and sidelink. We note briefly some of these values.

In DL-SCH, LCID=0 indicates CCCH. In UL-SCH, LCID values 0 or 52 indicate CCCH.

In both DL and UL, values 1-32 indicate identity of the logical channel since MAC does the multiplexing/demultiplexing of RLC PDUs coming via logical channels. Many other values indicate that a MAC subPDU contains MAC CE. LCID=63 is for padding. Values 33 or 34 imply that eLCID field is present in the subheader.

Some DL CEs pertain to DRX, Timing Advance, recommended bit rate, UE Contention Resolution Identity, and activation/deactivation of various protocol features. Some UL CEs pertain to Buffer Status Report (BSR), Power Headroom Report (PHR), Listen Before Talk (LBT), C-RNTI and recommended bit rate query.

### What's the structure of a 5G NR MAC PDU for random access procedure?

MAC PDUs have one or more MAC subPDUs and optional padding. There are two types of PDUs:

    + **Random Access Response (RAR)**: Each MAC subPDU has a subheader followed by Backoff Indicator (BI), Random Access Preamble Identifier (RAPID), and RAPID plus RAR. If present, a BI subPDU comes at the start of a MAC PDU and padding comes at the end. Padding is not part of a subPDU. The MAC subheader is different for BI and RAPID.
    + **MsgB**: This is applicable in 2-step procedure. Each MAC subPDU has its own subheader plus BI, fallbackRAR, successRAR, MAC SDU for CCCH or DCCH, or padding. If the PDU contains MAC SDUs, padding is encapsulated within the last subPDU.Among the subheader fields are extension E, type T/T1/T2, reserved bits R, S field, BI, and RAPID. The contents of fallbackRAR and successRAR are defined in the standard. MAC RAR includes Timing Advance Command, UL Grant and Temporary C-RNTI.

During random access procedure, MAC CEs are used to transfer C-RNTI and UE Contention Resolution Identity.

### What's the structure of a 5G NR MAC PDU for the Sidelink Shared Channel?

SL-SCH MAC PDUs are not very different from DL-SCH or UL-SCH MAC PDUs. They too are contain one or more MAC subPDUs, each subPDU containing a subheader. Order of concatenation is same as in uplink: MAC SDUs, MAC CEs and padding.

The main addition is the **SL-SCH subheader**. It's of fixed size (4 bytes) containing the following:

    + **Version Number**: V field is of 4 bits. In Release 15 and 16, this is set to 0.
    + **Reserved**: There are 4 R bits set to 0 in the SL-SCH subheader.
    + **Source**: SRC field if 16 bits long and contains the 16 most significant bits of Source Layer-2 ID given by upper layers.
    + **Destination**: DST field if 8 bits long and contains the 8 most significant bits of Destination Layer-2 ID given by upper layers.SL-SCH subheader doesn't itself have an LCID field but the subheader of each MAC subPDU contains the LCID field. Values 4-19 indicate identity of the logical channel. LCID=62 is for Sidelink CSI Reporting. LCID=63 is for padding. eLCID field is not applicable for sidelink.

## Milestones

Dec
2017

3GPP publishes Release 15 "early drop". MAC specification TS 38.321 is upgraded to version 15.0.0.

Mar
2018

MAC specification version 15.1.0 is published. A change request titled *Introduction of MAC CEs for NR MIMO* adds many MAC Control Elements to this release.

Jul
2020

3GPP publishes Release 16 specifications. Changes include MsgB MAC PDU format and Absolute Timing Advance Command MAC CE for 2-step RACH procedure.

5G NR MAC PDU


# Ransomware

## Summary

Ransomware is a type of malicious software that first infects a computer system. Once infected, users of the system can no longer access the system or parts of it. This means that important data stored on the system will no longer be accessible. If these systems are part of an organization, normal operations will be affected.

Those who control and distribute such ransomware often demand a payment (aka ransom) from the users. Once payment is done, often via untraceable cryptocurrencies, affected users are allowed to regain access to their system. Without a payment, it's often difficult if not impossible to regain access.

Since 2013, ransomware has become more sophisticated with the use of public key cryptography. The best defence is to adopt best practices in computer and network security, as well as user awareness.

## Discussion

### What are the types of ransomware?

There are basically two types of ransomware:

    + **Lockers**: These deny access to the infected device and severely limit user interaction. Screen may display information on how to make payment. Mouse interaction may be disabled and only a few keys on the keyboard may be enabled to enter payment information. System files and user data are usually untouched. With lockers, tech savvy users with the right tools may be able to unlock the device and avoid the ransom. Lockers use *social engineering* to pressurize users into paying up.
    + **Cryptos**: These identify important files on the system and prevent user access to these files. In most cases, they encrypt the files. Cryptos work silently in the background until files have been encrypted and then they inform the user. User can still use the infected device but without access to important data, and without proper backup, they usually have no choice but to pay up.

### What are the steps by which a crypto ransomware infects a system?

Crypto ransomware usually works in stages:

    + **Arrival**: Ransomware gets triggered when user click a link in email or website. It downloads itself into the system and starts running in the background.
    + **Contact**: It contacts its command and control (C&C) server to exchange configuration information. This may include cryptographic keys for later use.
    + **Search**: It searches the system for important files by their file types.
    + **Encryption**: It then generates encryption keys that might involve keys exchanged earlier with C&C. These keys are used to encrypt files identified by its search. Telltale signs include slowdown of the system and flickering of the hard drive light.
    + **Ransom**: User is displayed the ransom messages once all identified files have been encrypted.

### What are the potential entry points for a ransomware?

Ransomware can arrive by email that can contain a link or an attachment. If it's a link, the user is lured to click it, download a file and execute it. If it's an attachment, the user is lured to open it. Attachments could be Microsoft documents, XML document, Zip file containing JavaScript file or a file with multiple extensions. JS script upon execution will download the ransomware. Microsoft documents may contain the ransomware embedded in them as a macro.

Ransomware could also arrive when user visits a malicious or compromised website. This is done using *exploit kits*. Some of these include Angler, Neutrino and Nuclear. These kits probe the user's device for vulnerabilities and exploit them immediately. These can spread more easily since they can infect without users clicking or downloading anything.

A common way to lure unsuspecting users is via what's called *phishing*. An email or website attempts to pass itself off as a trusted service provider. Text is worded in a manner that sounds convincing and legitimate. This is called *social engineering*.

### How is cryptography used by crypto ransomware?

Cryto ransomware uses a combination of symmetric keys and asymmetric keys. Typically, the symmetric key is used to encrypt the files while the asymmetric public key is to encrypt the symmetric key. Thus, to decrypt the files one requires the symmetric, which can be decrypted only when asymmetric private key is available. Asymmetric private key is kept secret at the C&C server.

For example, CryptoDefense uses a randomly generated AES key to encrypt files but this key itself is encrypted using RSA. RSA public key itself is downloaded from the C&C server. CTB-Locker does something similar except that RSA public key is embedded in the ransomware so that the attack can be completed even without an Internet connection. In fact, CTB-Locker uses a combination AES, SHA256 and ECDH (curve25519).

Cerber uses RC4 for encryption and involves an extra step of RSA key-pair generation. Petya uses ECDH (secp192k1) and SALSA20 algorithms.

### What are some variations among ransomware out there?

Ransomware come in many variations. They constantly evolve so that countermeasures are made ineffective. Here are some variations:

    + WannaCry was also a *worm*, able to spread itself to other devices on the network without user intervention.
    + WannaCry gave a deadline for payment and threatened that ransom would go up if not complied.
    + In addition to denying users access, RAA ransomware and MIRCOP stole passwords and sent them to the C&C server.
    + Many used social engineering to confuse and intimidate users, saying that users had broken the law in some way. If ransom is unpaid, they would be reported to the police.
    + While most ransomware were executables (.exe, .dll), others used a scripting language: JScript for Cryptowall 4.0's downloader and RANSOM\_JSRAA.A; PowerShell script for PowerWare.
    + Jigsaw regularly deleted encrypted files until the ransom was paid. CryptoLocker instead threatened to delete private encryption key, which meant that data could never be recovered.
    + Petya, Satana, and GoldenEye modified the hard drive MBR (Master Boot Record) with a custom boot loader.
    + CTB-Locker used partners and revenue sharing to spread faster.

### Could you name some ransomware attacks that caused significant damage?

Ransomware can affect any device including laptops, servers and smartphones. Ransomware can affect home users and lock them out of their personal data. It can affect organizations such as hospitals, schools, government agencies, and more. Attackers don't care who's the target but they do set the ransom based on what they think the victims are likely to pay.

In February 2016, Hollywood Presbyterian Medical Center was infected by Locky ransomware. Ransom was 40 Bitcoins, about $17,000. San Francisco's transit system, Muni, was attacked in November 2016. Ransom was $73,000 in Bitcoins. In January 2017, Austrian hotel Romantik Seehotel Jaegerwirt was attacked. Electronic room keys did not work and the reservation system was paralyzed. The attackers demanded payment of $1,800 in Bitcoins. In June 2017, University College of London was attacked. The city of Atlanta was crippled for five days by ransomware demanding $51,000. Boeing plant in Charleston was hit by WannaCry in March 2018.

### Is the Internet-of-Things (IoT) vulnerable to ransomware?

With IoT, the attack surface widens: thermostats, security cameras, smart locks, connected cars, power grids and other industrial systems can all get infected. Unlike traditional ransomware that prevent users from accessing their data, IoT data is often in the cloud. Instead, ransomware in IoT will be about paralyzing systems: traffic jams, power outages, malfunctioning equipment, etc.

In 2016, Mirai botnet infected more than 600,000 IoT devices and then used these devices to launch a distributed Denial of Service (DDoS) attack on web services. Although Mirai was not a ransomware, it showed the potential of using IoT devices for large scale attacks. Mirai was possible because IoT devices at the time were (and perhaps even now are) less secure than enterprise IT systems. Mostly, routers and cameras were compromised. Users often use default credentials, don't upgrade or even login to these devices.

A variety of IoT devices exist and any ransomware must have variants or mutate on its own to infect this variety. Since many IoT devices lack display, ransomware will also need to figure out emails and phone numbers to notify users about the ransom.

### How can I protect myself from ransomware?

Take regular backups of critical data. Keep your security software and OS updated on a regular basis. Be wary of unexpected mails with links or attachments. Be wary of Microsoft Office attachments that ask you to enable macros.

If infected, disconnect the affected device from your network. Scan all other devices on your network. Identify the ransomware and try recovery if possible. If not, reformat device and restore data from clean backups. Report the incident to local authorities.

## Milestones

1989

Joseph L. Popp distributes 20,000 floppy disks containing what could be the first known ransomware. Called **1989 AIDS Trojan**, it hides folders and encrypts file names. Victims are asked to send $189 to a post office box in Panama.

2009

Fake anti-virus programs become increasingly common. They inform users that they can "fix" problems in their systems for a fee.

2011

Without doing any encryption, **Trojan.Winlock** simply displays a fake Windows Product Activation notice. Users are asked to call a premium international number to obtain an activation key.

Sep
2013

Ransomware gets modern and sophisticated with the release of **CryptoLocker**. It uses RSA public-key cryptography and keeps the private key safe at its command and control (C&C) server. The attack lasts from September 2013 to May 2014, in which period it collects $3 million from its victims. An improved version called **CryptoLocker 2.0** arrives in December. It uses Tor and Bitcoin for anonymity and it's not detected by anti-virus or firewall.

2015

Ransomware that encrypts files on an Android device arrives on the scene. It's called **SimpleLocker**. It uses a trojan downloader. Another one called **LockerPin** resets the PIN on the phone and demands $500 ransom to unlock the device.

2016

The number of variants of ransomware increases dramatically in 2016. From Q4-2015 to Q1-2016, ransomware increases by 3,500% and payments increase tenfold. The US Justice Department states that in 2016 ransomware attacks increased four times to 4,000 a day. MAC OSX gets infected by **KeRanger** via Transmission BitTorrent client.

May
2017

Ransomware **WannaCry** exploits a vulnerability in the SMB protocol, a vulnerability present in old unsupported versions of Windows. The attack is contained within a few days but not before it infects 200,000 computers across 150 countries. Kaspersky Lab reports that 98% of the successful attacks were on computers running Windows 7.

Jun
2017

Using the same SMB vulnerability that WannaCry exploited, once seeded, **NotPetya** spreads to computers on its own without needing spam emails or social engineering. It encrypts the Master Boot Record (MBR) and lot more. It tricks users into paying a ransom but in fact the encryption process is irreversible.

Dec
2017

SophosLabs publishes an article on **Ransomware-as-a-Service (RaaS)**. These are available on the Dark Web, some even offering support. These enable non-technical folks to launch their own ransomware variant. Presumably, RaaS has been available on the Dark Web for a year or two.

Ransomware


# 3D Printing

## Summary

3D printing is an additive manufacturing technology. It creates three dimensional objects using Computer Aided Design software. A 3D printer or fabricator replicates geometric models in the real world by adding materials layer by layer.

3D printing technology is disrupting traditional manufacturing. Manufacturers today are increasingly adopting 3D printing in their processes. With widening range of printable materials available, more companies are following suit. Because 3D printing allows model testing before producing the actual products. Since it adds materials in layers, it can generate intricate interior designs with high precision. It can also produce rapid prototypes in short periods. .

The technology creates an end product as a single piece in quick time instead of assembling composite items. As it's evolving at a rapid pace, 3D printers are expected to become products for home users like the 2D printers.

## Discussion

### How does 3D printing compare against other manufacturing techniques?

Two age-old manufacturing techniques are formative and subtractive. With **formative manufacturing**, we start with a cast or mould and pour material into it. This is cost-effective for high-volume production but requires a stable design. With **subtractive manufacturing (SM)**, we start with a block of material. With the aid of CAD software, we remove excess material via drilling, cutting, and CNC milling. Complex objects can be created. Design changes are possible in software. However, it has high wastage of material.

**Additive manufacturing (AM)** creates an object by adding material to it one layer at a time. This results in less wastage of material. It's flexible since design changes are done in software. It's ideal for prototyping and rapid customization. It can create certain features not possible with SM.

In everyday talk, 3D printing is a term synonymous with AM. AM is often used in industrial settings and refers to the process. 3D printing is often used by hobbyists and refers to the technology.  3D printing may be seen as a type of AM since AM encompasses a broader spectrum of processes.

### What are the basic steps involved in 3D printing?

3D printing broadly involves three steps: Modeling, Printing and Finishing.

Models are generated using Computer Aided Design software. A designer forms shapes by scanning real objects in 3D form and feeds them into the *CAD* software. She connects the shapes meaningfully, makes corrections and creates models in an iterative process. The models are finalized and stored in file formats such as Stereolithography (STL) file and Additive Manufacturing File (AMF).

Before printing the final model, files are checked for errors. . The clean files are processed by another software called *Slicer*. The slicer converts a geometric model into an array of thin layers. The layered output of the slicer is stored in *G-code* files that interact with the client software. G-code files serve as interfaces to pass printing instructions to the 3D printers.

In the last stage, the printed object is given a finishing touch to make it a complete product. The rough surfaces are removed, cleaned, polished, and/or coated, depending on the type of the product printed.

### Could you give some examples of 3D printing process types?

**Stereolithography (SLA)** is one of the first 3D printing types in the industry. The process exposes liquid material to a laser source and forms rigid solid parts layer by layer. It's called photopolymerization. The solid parts are treated further with UV rays to fully solidify their outer surfaces.

**Fused Deposition Modeling (FDM)** is a type suitable to print plastic objects. An extruder forcefully ejects plastic filaments heated to their melting points. Filaments deposit on a platform layer by layer. These layers consolidate to become 3D objects.

**Powdered Bed Fusion (PBF)** is another process where laser beams are directed on powders loaded on designated plates. The powders melt and form solid shapes. Each solid that forms in the next layer blends with the previous layer till the whole model is printed. *Selective Laser Sintering (SLS)*, *Electron Beam Melting (EBM)* and *Selective Heat Sintering (SHS)* are the basic technologies associated with Powdered Bed Fusion.

Some other types are *Digital Light Processing (DLP)*, *Material Jetting (MJ)*, *Laminated Object Manufacturing (LOM)*, *Binder Jetting (BJ)* and *Direct Energy Deposition (DED)*.

### How does one choose a 3D printing process?

Multiple factors may influence the choice of a 3D printing process. Geometric precision, materials used, product appearance, economy and size are some important considerations. .

For example, when the materials used are carbon, Nylon, Carbon fibre and the like, FDM would be suitable. It is cost effective and prints products composite of a variety of items. SLA makes the best fit for clean surface finishing and fine detailing. To produce brittle, multi-colored outputs, designers choose Material Jetting (MJ). Binder Jetting (BJ) that uses liquid agents to bind powder beds is preferred to 3D print metal objects in large volumes.

### Can you discuss some applications of 3D printing?

**Consumer Products**: 3D printing technology can create custom made products. A broad classification of some common consumer products may include jewelry and fashion accessories, consumer electronics, entertainment props and set pieces, sporting goods, and packaging prototypes.

**Architecture and Construction**: 3D printing technology can be applied to construct an entire building or build components of it. Apis Cor Printed House in Russia and Canal House in Amsterdam are 3D printed structures.

**Spare Parts Manufacturing**: Vital parts of obsolete products may become unavailable or hard to find. And they may force us to buy new products. 3D printing of such parts saves money and time.

Other major industries benefiting from 3D printing technology include prosthetics and bio implants, dentistry, pharmaceuticals, automotive, food, aerospace, robotics, and medical and functional textiles.

### How could digital twin technologies support 3D printing?

A digital twin is the virtual representation of an object or a process in a real-time simulation environment. Digital twins facilitate interaction between humans, objects and the virtual spaces connecting them. They make use of Internet of Things (IOT), Artificial Intelligence (AI), cloud computing, Simulation and Modeling, Extended Realities and Networks to function effectively.

Coupling Digital twin technology with 3D printing can enhance performance monitoring and assist in detecting anomalies. The combination of Digital twin and 3D printing offers some advantages:

    + It enables simulations to take temperature and humidity differences which a mere CAD software cannot.
    + Its database allows comparison of designs for future references.
    + Designers can use digital twin systems to verify designs and performance data virtually.
    + Cloud manufacturing environment in the digital twin technology enables real-time data monitoring and troubleshooting.
    + Simulation and early warning systems using digital twin systems can minimize errors and distortions in the final output.
    + It provides reference solutions for other manufacturing equipment online.
    + It enables detection of defects and quality lags during simulation before actual printing. Hence it saves resources and costs.

### What are some of the current challenges of 3d printing technology?

**Material unavailability**: There is no one-size-fits-all solution to printing every product. Some materials may not be available for 3D printing.

**Material incompatibility**: Some materials may not be compatible with the printers. Not all materials fit into the design when they require temperature control.

**Lack of Industry standards**: 3D printing across the world lacks standards that are widely accepted or commonly followed. Standards should be in place to create a comprehensive ecosystem of manufacturers, suppliers and users.

**Post-processing issues**: Most of the 3D printed products need post-processing to become usable. It adds to the costs, consumes extra time and kills consistency.

**Inconsistencies in output**: A 3D printer may not produce the exact output across all geographies. Depending on the atmospheric conditions, physical dimensions such as height, width and depth may show variances.

**Scalability issues**: At present, 3D printing may not offer cost effective solutions to mass production in certain fields. For example, biomedical industry.

## Milestones

1981

Japanese professor Dr. Hideo Kodoma invents Laser beam resin curing system, the first 3D printing system that uses UV rays to harden polymers.

1983

Charles Hull files patent for the first stereolithography apparatus machine.

1986

Charles Hull is granted patent for SLA. He co-founds 3D-systems corporation, the first company to introduce SLA 3D printing.

1987

The first commercial rapid prototyping printer, SLA-1, is released.

1989

Scot and Lisa Crump apply for a patent for Fusion Deposition Modeling (FDM). Hans Langer establishes EOS GmbH in Germany. EOS (Electro Optical Systems) later becomes an industry leader in 3D printing of metals and plastics.

1997

Aeromat introduces 3D printer for metals using Laser Additive Manufacturing (LAM) technique. The printer uses high energy lasers to fuse powdered titanium alloys.

1999

Wake Forest institute of Regenerative Surgery devises the first 3D printer to build a synthetic biodegradable 3D scaffold of human bladder.

2005

Adrian Bowyer developed an open source concept called ReRap to create self replicating 3D printers.

2007

The first 3D printer to be commercially available, Darwin, built on RepRap concept is built. When Scott Crumps' patent on FDM expired in 2009, many low cost FDM printers flooded the 3D printer market. Of them, RepRap or the Replicating Rapid Prototyper is significant. It is an open source machine that can copy itself and replicate its own intricate parts. It also produces prototypes rapidly. Since it is an open source, many companies use RepRap designs to print 3D machines and products. It brought down 3D printing costs considerably.

2009

MakerBot introduces do-it-yourself kits for people to build their own 3D printers and builds Thingiverse file library where one can submit and download 3D printable files.

2010

Kor Ecologic unveils a prototype car with a 3D printed body.

2011

University of Southampton designs and prints the first unmanned 3D printed aircraft called Southampton University Laser Sintered Aircraft (SULSA).

2017

Celink, a Swedish Company, commercializes standardized bio-inks that can be used to print tissue cartilage. The company later introduces the INKREDIBLE 3D printer for bioprinting services

3D Printing


# Code Refactoring

## Summary

Software is rarely perfect. Bugs need to be fixed. Code and its structure can be improved. Even when no new features are added, restructuring code can make it easier to understand and maintain. **Refactoring** is thus about restructuring existing code without changing its behaviour. Refactoring changes internal structures while preserving external behaviour. Refactored code works just as before, passes existing tests but is better in terms of structure and organization.

Refactoring shouldn't be a special task that needs to be scheduled. Refactoring should be a day-to-day programming discipline. Whenever developers see an opportunity to improve existing code, they should refactor.

IDEs can help in automated refactoring. Testing is an essential activity. It ensures that refactored works as before and nothing is broken. Incremental refactoring is preferred over a full-scale code rewrite.

## Discussion

### When does it make sense for me to refactor working code?

Given any working code, developers may be hesitant to change code unnecessarily. But refactoring can still be useful. When program flow is not clear, refactoring improves clarity. Software becomes easier to update and maintain in the long run. We may also refactor to improve performance. Refactoring first can help developers add new features more easily. Sometimes refactoring is done to enable code reuse.

There's a common misconception that refactoring activities need to be scheduled into a project. While planned refactoring is possible, it's better to refactor continuously. Whenever developers detect bad code and they sense an opportunity to make it better, refactoring should be done. When small improvements to code are done continuously, there will hardly be a need to schedule refactoring as a separate task.

A common excuse is that refactoring takes time away from actual development. On the contrary, refactoring saves time in the long run. Software tends to degrade over time as complexity increases. Refactoring is a way to mitigate this.

### What are some indicators that my code may need refactoring?

As multiple developers work on the same code base over many release cycles, complexity increases. There's less cohesion in terms coding styles and design. Some call this **code rot**, characterized by duplicate code, myriad patches, and bad classifications. Other symptoms include unhealthy dependencies between classes or classes doing too many things.

In one project, 20 developers had created 65,000 lines of code over 5 years. The codebase had lot of dead code, code pertaining to many older API versions, and classes with too many dependencies.

When a bug fix is required and the fix has to be made in multiple places, this indicates duplicated code. Refactoring can help here. Another example is when a bug fix itself introduces another bug. This implies fragile code that needs refactoring.

When a new feature request comes in, the current design might make it difficult to build this feature. This is another area where refactoring can help.

### What does it mean to say that refactoring shouldn't change external behaviour?

Preserving external behaviour means that given an input and the current system state, the software should give a predictable output.

However, there are some specialized systems where input-output behaviour is insufficient. Other aspects of behaviour are just as important and must be preserved during refactoring. We note three such systems:

    + **Real-time software**: Execution time is important. Refactoring should preserve all temporal constraints.
    + **Embedded software**: Memory usage and power consumption are important. Refactoring should preserve these constraints.
    + **Safety-critical software**: Concrete notions of safety should be preserved.

### Could you mention some case studies of code refactoring?

One team took a bottom-up approach to code refactoring by "extracting new classes or coercing existing classes to enforce single responsibility, loose coupling, testability, and low complexity". However, one area of the codebase had to be rewritten. They adopted an incremental TDD approach of writing unit tests, making some changes, and testing.

Another project team decided not to bring in new dependencies during refactoring. They identified concept boundaries (Admin, HR, User) and refactored within these boundaries.

A study from 2007 of a small team of mobile app developers showed that refactoring not only improves code quality but also improves productivity. Productivity was measured as lines of code written per hour.

One misconception is that refactoring can reduce performance. One study found that replacing conditional logic with polymorphism improved performance since compilers optimize polymorphic methods.

Martin Fowler explains many use cases with original and refactored code. These are worth reading: loading JSON data returned by another service, calculating and formatting a bill for a video store, and refactoring to manage module dependencies.

### Is there a process that I can follow when refactoring my code?

Those who practice Agile methodology, know that refactoring is part of Test-Driven Development (TDD). Refactoring is done only when current tests pass. This gives developers confidence to go ahead and refactor code. Should the refactored code fail some tests, developers can either fix the problem or revert to the working code. Tests ensure that code behaviour isn't affected by refactoring.

The essence of this approach is **incremental refactoring and testing**. Test after every small refactoring change. Testing after dozens of refactoring changes can be problematic. If tests fail, it will be hard to isolate the faulty refactoring. It's also clear that we shouldn't add new features or change behaviour while also refactoring. The process **isolates adding functionality and refactoring**.

Martin Fowler identifies different refactoring workflows: TDD Refactoring, Litter-Pickup Refactoring, Comprehension Refactoring, Preparatory Refactoring, Planned Refactoring, and Long-Term Refactoring. Frequent planned refactoring might indicate that the team isn't doing enough of the other workflows.

### Which are the different levels of code refactoring?

Refactoring can happen at three different levels:

    + **Code-level**: Remove dead or unused code. Rename variables. Reduce number of method arguments by packaging them into a class. Convert global variables into class data members. Create access methods.
    + **Function-level**: Merge and consolidate duplicated code. Merge similar code blocks into methods.
    + **Architecture-level**: Create new class hierarchy. Reorganize responsibilities and encapsulation between subclasses and superclass. Refactor to make way for future changes. Refactor to interface better with databases, external services or frameworks.Some make the distinction between **primitive refactoring** and **composite refactoring**. The latter is a sequence of primitive refactorings. For example, Rename and Move are primitive refactorings. Others use the terms **low-level refactoring** and **high-level refactoring**, or equivalently in a dental metaphor, **floss refactoring** and **root canal refactoring**.

### What are some techniques to refactor code?

Refactoring Guru explains a number of refactoring techniques, of which we mention a few:

    + **Composing Methods**: Refactor long methods into smaller method calls. Use local variables instead of modifying method parameters. Move duplicated code into a method.
    + **Moving Features between Objects**: If a method/field is called more often by another class, move it into that class. Refactor to multiple single-purpose classes if a class is doing many different things. Remove a method that simply calls another method.
    + **Organizing Data**: Know when to use references and when to use value objects. Make a public field private with access methods.
    + **Simplifying Conditional Expressions**: Instead of many `if-else` statements or complex expressions, use a method call that returns a boolean result. In loops, use `break`, `continue` or `return` instead of control flags.
    + **Simplifying Method Calls**: Remove unused method parameters. Replace methods `fivePercentRaise()` and `tenPercentRaise()` with the parameterized method `raise(percentage)`.
    + **Dealing with Generalization**: Move common methods/fields from subclasses to the superclass. Create a subclass for a feature that's used in only some scenarios.

### How do I prioritize when there's too much to refactor?

Use your best judgement to decide what to refactor now and what could be done later. Refactoring too much at once can impact software delivery. Always use an **incremental approach**.

In one research study, Analytic Hierarchy Process (AHP) was applied to **rank** different refactoring techniques and apply those that work best for the codebase. A multi-objective search-based approach has also been proposed.

### Which are some best practices for code refactoring?

Refactor only if you've good regression tests and the tests are passing. If some tests are lacking, add extra tests. Some existing tests might depend on old program structure and would need to be rewritten.

It's always better to refactor before adding new features since tests exist only for current features. Refactor after delivery and before starting the next release cycle. Kent Beck has summarized it thus,

> For each desired change, make the change easy (warning: this may be hard), then make the easy change.

When team members are working on different feature branches, refactoring can make merges difficult. If some members own some pieces of code, there will be reluctance to refactor their code. These are barriers to refactoring. Work as a team to see how these can be overcome.

Don't refactor just because you love writing new code or wish to use a coding pattern you've just learned.

### Are there tools to automate code refactoring?

Smalltalk's Refactoring Browser (released in 1997) was well-liked and adopted by Smalltalk developers. This was followed by refactoring tools for Java and C#.

By 2020, most IDEs supported code refactoring. This includes Eclipse, Visual Studio, Xcode, Squeak, Visual Studio Code, , IntelliJ-based IDEs (AppCode, IntelliJ IDEA, PyCharm, WebStorm), and more.

Back in 2003, it was noted that creating a refactoring tool for C++ has been difficult. Refactoring makes use of the program's Abstract Syntax Tree (AST) but macros and templates add complexity. In fact, it's been said that any tool that works for the whole of C++ would be AI Complete. A subset of refactoring techniques for C++ is supported by Visual Studio.

Automatic refactoring is aided by static type information. A codebase's development history could be used to identify refactoring opportunities.

## Milestones

Aug
1981

In an article on Smalltalk in BYTE magazine, Ingalls uses the word **factoring** in a software context. He mentions factoring as one of the design principles behind Smalltalk, supported via class inheritance. He defines factoring thus, "Each independent component in a system should appear in only one place." Without factoring, it would be hard to keep interdependent components synchronized and consistent. Factoring makes it easier to locate and maintain the component. The concept of refactoring itself comes from mathematics where a complex algebraic expression might be factored into a simpler and equivalent expression.

1986

R.S. Arnold uses the term **software restructuring** that's about incrementally making changes to software internals as a way to manage its increasing complexity. It's been noted that the term *refactoring* came to be used a little later in the context of object-oriented software development.

1990

William Opdyke and Ralph Johnson present a conference paper titled *Refactoring: An Aid in Designing Application Frameworks and Evolving Object-Oriented Systems*. This is possibly the first use of the term **refactoring** in published literature. Indeed, refactoring is initially adopted for object-oriented programs.

1991

William Griswold publishes his PhD dissertation on the topic of refactoring functional and procedural programs. A year later, William Opdyke's own dissertation does the same for object-oriented programming.

Jul
1999

Fowler et al. publish their book titled *Refactoring: Improving the Design of Existing Code*. After introducing the topic, the book describes over 70 refactoring tips. The word *refactoring* is defined both as a noun and as a verb. In the years to come, this book influences software development. IDEs go on to implement many of the practices to automate refactoring. The second edition of the book appears in 2018.

2006

Although many tools existing, developers might not use them if they're not aligned with refactoring tactics preferred by developers. A survey of 41 users of Eclipse IDE for Java development finds that only a few of them use these tools. Simpler techniques such as Rename and Move are more often used than more complex ones such as IntroduceFactory and PushDown.

Code Refactoring


# Content Management System

## Summary

Content Management System (CMS) is a software used to create and comprehensively manage digital content.

It’s built on top of a set of foundational codes called the framework. The content created with the CMS is stored in a database. The CMS interacts with the database management system (DBMS) to display, add, retrieve, modify and redeposit content back to the database.

Content Management Application (CMA) and Content Delivery Application (CDA) are the basic components of a CMS. CMA is the Graphical User Interface (GUI) that enables users to handle content at the front end. CDA is the back-end component attached to the database.

CMS is easy to use. It permits multiple accesses. Predefined themes, templates and software plugins simplify CMS for a quick setup and smooth operation. CMS reduces or eliminates the need to apply codes to create, alter or publish content digitally.

## Discussion

### How does CMS work?

Using a CMS’s GUI with textual and visual editors, a user creates content. These editors encode the content on the back end. The encoded content get stored in the database as structured files.

In most cases, metadata is embedded inside the content’s codes. When a user makes requests for specific content, the CMS retrieves the corresponding structured file using metadata and generates the digital output. The retrieval and display process may involve applying a template that defines the layout and design of the output.

When the front end and the database are built using a single codebase, data is accessed from within. If the front end and the database are separate components (decoupled), software channels such as middleware integrate the two. Application Programming Interfaces (APIs) move data between decoupled components.

User management feature is added to manage the CMS’ user accesses. User management basically includes mechanisms to identify, approve access to, and authorize users.

Specific plugins are installed to perform useful tasks. For instance, Search Engine Optimization (SEO) and analytics plugins enhance a website’s visibility and provide insights into the user patterns and behavior.

### Can you broadly discuss the basic types of a CMS architecture?

CMS architecture refers to how the front end and back end of a CMS function as a whole.

In a **coupled CMS**, the front-end and back-end processes are tied together. Both the ends share some common resources and rely on the same services to function. Coupled CMSs are simple to deploy but hard to customize.

A **decoupled CMS** has its front end seperated from its back end. A separate back end offers better security. Yet a decoupled CMS is complex to handle.

**A headless CMS** is similar to a decoupled CMS. However, the presentation layer of the CMS is separated further from the front end. Headless CMSs seamlessly integrate content across devices. For instance, we can continue our Facebook activity on a mobile application, from where we left off on a web application.

**A hybrid CMS** is a combination of the above types of architecture. A hybrid CMS offers great freedom to integrate customized front-end components. Anyone can create their own layout using drag and drops or WYSIWYG editors without developer support.

### What are the core features of a CMS?

**User Interface**: An intuitive interface is basic to create, structure, edit, add, remove, publish and distribute digital content.

**Storage and retrieval**: Content created at the interface needs storage and indexing. A CMS should be able to package and transfer content to its database in standard formats (E.g.: XML or JSON). Indexing makes retrieving and managing content easy.

**Access control**: Access control is designed, basing on how a member engages with the CMS. An administrator in the CMS will have complete control over the system. Editors, authors, contributors, subscribers and others will have varying degrees of access and control.

**Security and backups**: A CMS should have mechanisms built and credentials fixed for members to login and logout. When someone inputs wrong ids or passcodes beyond a permitted number of attempts, the account should get locked. This arrangement prevents hackers from easily breaking into the system. Multiple levels of security arrangements can be setup. Creating systems for regular backups and updates can safeguard against any data loss.

Depending on purpose, a good CMS needs additional features to run efficiently. Version controls, SEO tools and support are a few important features.

### Could you discuss some use cases of CMS?

 CMS has a popular use in **E-Commerce**. An E-Commerce CMS enables businesses to sell products online. An E-Commerce business typically needs CMS to manage shopping carts, product pages, payments, orders, analytics, and customer support.

An **Intranet** CMS connects a company’s employees located geographically apart. Companies use Intranet CMSs for employee onboarding, online training, intra-company networking, internal communication, and inter departmental collaboration.

**Mobile application** developers make use of CMS to manage content for mobile apps or mobile responsive websites. Mobile responsive websites share a common back end with mobile apps. The front ends of the mobile app and website interfaces remain detached. A website’s content made editable on the go through a mobile app is also a form of mobile CMS.

Educational institutions use **Library** CMSs to run digital libraries on websites or mobile apps. Apart from managing digital books, the Library CMS also supports additional activity. An institution may also maintain articles, news, blogs and information about digital resources on their library portals.

**News** publishers use CMS to create, edit, publish and update digital news quickly. A News CMS smoothly manages paid subscriptions and handles news content in high volumes.

### Can you explain the different CMSs prevalent in the market?

Two broad CMS categories prevail in the market. They are Open-Source CMS and Commercial CMS.

An **open-source** CMS does not restrict access to a licensed group. People joining the open-source community can alter its source code. Based on the needs of the larger public, member developers volunteer to customize the CMS software. Users with specific needs can use the CMS platform for free. However, they may have to invest on technical assistance, plugins, add-ons, templates, support and regular updates. Popular Open-source CMS platforms in the market include WordPress, Joomla, Drupal, Ghost and Strapi.

A **commercial** CMS is developed and owned by a commercial entity. Users can't access the CMS' source code. Third party plugins and extensions cannot feature in the CMS. Switching the website or application from an existing commerical CMS to another CMS platform poses headaches. A commercial CMS is expensive. However, the CMS is safe, stable, standard and efficient. Dedicated teams monitor, fix issues and support the CMS platform.  Popular Commercial CMSs include SiteCore, Flamelink, ExpressionEngine, Kentico and Adobe Experience Manager.

### How is building a website using CMS different from that of a website builder?

Anyone with zero coding skills can create a website using a website builder. A website builder usually provides a hosting platform, a domain name, and custom themes as a package. Simple drag and drop solutions enable straightforward launch of websites. Website builders don’t permit outside developers to customize. It is restrictive to developers and liberating for the technically unequipped.

In contrast, a CMS solution doesn’t automatically come with a web server, a domain name or readymade themes. Such essential components should be purchased individually. A CMS website can be built from scratch on top of source code. The website’s physical appearance is designed using UI tools such as Figma or Adobe XD. Developers give life to the designs through HTML, Cascading Style Sheets (CSS) and any programming language, say, JavaScript. Else, the interface may have basic themes that coders work further upon. A CMS is constructed manually or automatically, depending on the hosting services. Then a database is created and connected to the system. Coders may also customize features or use custom features. Once the basics are ready, webpages are generated and published.

### How does CMS compare with MS SharePoint, Static Site Generator (SSG), and Document Management System (DMS)?

Microsoft **SharePoint** is a collaboration platform that focuses on team collaboration, intranet or extranet, document management and workflow automation. It also has content management capabilities. A CMS is primarily a content management software that also facilitates collaborations. SharePoint integrates with MS tools and caters primarily to enterprises. CMS focuses on specific content management needs of individuals and entities.

An **SSG** doesn’t need a database or an external data source. The SSG stores simple data as static HTML files in the web server. When a user makes a request, the SSG picks up data files directly from the web server and presents quickly. It is highly secure and requires less computing power. On the other hand, a CMS delivers an interactive and immersive content management.

A **DMS** manages structured data in word, pdf, excel and other document formats. A CMS manages structured as well as unstructured data. The main use case of a DMS is regulatory compliance and workflow management. A CMS has much wider scope than just document management.

### What steps should one generally follow to make their our own CMS?

    + Define the purpose, scope, content types, roles, permissions, features, scalability and other needs of the CMS
    + Run a database client program, let’s say, MYSQL. Set up the database.
    + Create database tables. Form schemas and table names. Add the required fields such as unique Ids, date, titles, content, primary keys and so on.
    + Configure settings using a scripting language such as Vue.js or PHP. The settings shall remain common for all the script files in the CMS. E.g.: Time zone, admin’s username and password, paths and class.
    + Inside the CMS folder, create class folders. Add class files. The class files shall encapsulate the classes’ definition, properties, and methods. The class methods entail archival, retrieval, listing, insertion, updating and deletion of class objects.
    + Write front-end index script. These codes work to manage the UI tasks and actions.
    + Write the back-end script. The script fixes back-end actions.
    + Create HTML template files for the front end. These files handle the header, footer, homepage, archive and so on
    + Create HTML back-end template files. These files handle back-end activity.
    + Make CSS files to control the appearance and feel of the site.

### What are some design considerations for CMS?

    + Define the technical knowledge of the target user. It impacts the CMS design at every stage. For example, will the content editor apply HTML tags or create content directly on a WYSIWYG editor?
    + Determine the extent of control a designer has over the templates. For example, can a designer reshape the entire CMS to suit her design or should she work with the existing templates?
    + Design, assuming that the HTML elements will stack in any order. Preparing for the worse ensures quality outcomes.
    + Keep the versions consistent across all components so that reuse is possible.
    + Create reusable components that are compatible throughout the CMS.
    + Think through various scenarios and design for flexibility. For example, will the text or image slip beyond the layout?
    + Create CSS rules for all the HTML elements in the CMS. It provides flexibility to readjust elements that may later require pre-configured styling.
    + Create and enforce semantics and style guide using CSS to standardize the content throughout the CMS.
    + After developing the design using HTML and CSS codes, test the design by trying different types of content in different sizes to check if it consistently produces the desired output.

## Milestones

1989

Tim Berners-Lee introduces the markup language, **HTML**. He goes on to write browser and server software by 1990. HTML is a derivative of Standard Generalized Markup Language (SGML). HTML is fundamental to building a CMS.

Aug
1991

Tim Berners-Lee launches the world’s first **website** using Hyper Text Transfer Protocol (HTTP) and Uniform Resource Locator (URL). The website contains information about the World Wide Web project. These static webpages later pave the way for dynamic websites and CMSs to emerge.

1994

Roxen Internet Software, a Swedish company, releases **Roxen**, one of the first CMS applications. Roxen CMS is useful to produce, distribute, deploy and maintain internal and external websites.

1995

Vignette corporation launches Vignette, a Web Content Manager (WCM) software. Vignette subsequently launches **StoreBuilder** and coins the term, **Content Management System**.

1995

FileNet creates the world’s first **monolithic** Content Management System. The system is built using Hypertext Preprocessor (PHP), Active Server Pages (ASP) and Java Server Pages (JSP). FileNet introduces an integrated document management suite, combining document imaging, document management and workflow. Many competitors follow suit and flood the market with monolithic CMSs.

2003

Easy-to-build, open source, website-building CMS platforms such as **WordPress** offer readymade templates. Readymade templates remove the need to build every aspect of a website from scratch and therefore, reduce cost. For the first time, anyone without coding skills could launch websites.

2003

DNN corp launches a renamed application called **DotNetNuke**. DotNetNuke is an early open source CMS based on ASP.NET framework. DotNetNuke stands the test of time.

2005

Alfresco launches an open source alternative to enterprise content management. It is embeddable in enterprise applications so that enterprises need not build their CMSs from ground up.

2010

The year ushers in a new era of **Headless CMS** domination. The booming smart phone and tablet market drastically increases the consumption of web content. Developers shift their focus towards headless or decoupled CMSs to deliver the same content on screens of differing sizes.

2013

**Contentful**, a Cloud-based platform offers headless CMS solutions. The platform provides well documented APIs and Command Line Interface (CLI) migration tools. Contentful is one of the best tools to build websites.

May
2016

French company, Strapi launches open source, headless, self-hosted CMS solution. **Strapi** is designed to work with JAMStack (JavaScript, API and Markup) sites and supports both SQL and NoSQL databases. It can be hosted from any server.

Content Management System


# Blockchain

## Summary

Blockchain is an open immutable distributed ledger without centralized control. The ledger is maintained and validated by a peer-to-peer network of computers. Such a ledger could contain any digital asset of value such as cryptocurrencies, land records, birth certificates, insurance claims, concert tickets, the source of diamonds, etc.

Because digital assets can easily be copied, we need a system that prevents fraud. Traditionally, banks, government bodies and private institutions serve as trusted intermediaries. Blockchain aims to bypass them. It does this using cryptography. No one can tamper transactions recorded in the blockchain due to high computation costs. We may therefore say that trust is established implicitly via cryptography.

Blockchain was initially used to create and transact a cryptocurrency called Bitcoin. Today, it's anticipated that blockchain can be used for diverse applications and it's set to revolutionize multiple industries.

## Discussion

### Why was Blockchain invented?

The collapse of Lehmann Brothers back in 2008 triggered a global financial crisis from which many economies are yet to fully recover. Perhaps it was this that prompted Satoshi Nakamoto (pseudonym) to think of a method for peers to exchange currencies without involving centralized control. Centralized institutions such as banks fulfil the role of verifying identity, building trust, executing business logic, maintaining records, validating transactions and performing audits. This also implies that consumers are dependent on this controlled system of trust.

Nakamoto proposed introducing a digital currency called Bitcoin and a peer-to-peer method of transacting bitcoins without involving centralized control. Within such a network, centralized authorities and middlemen are not required. They would not be able to take risky decisions using what belongs to you. Peers can transact with one another directly. Blockchain was the technology that Nakamoto invented to power the creation and transaction of bitcoins, although the term "blockchain" does not appear in his influential paper.

### Could you explain how Blockchain works?

In simple technical terms, transactions/items are grouped into blocks, which are then protected using cryptography. Each block comes with a *hash* that protects the integrity of the block. This hash is computed by *nodes*, which are computers participating in the blockchain network. A completed block is linked to the previous block and this forms a chain of blocks; hence, the name *blockchain*.

Computation of the hash depends on the contents of the current block plus the hash of a previous block. This means that an attacker attempting to tamper a block in the middle will have to recompute the hash values of all subsequent blocks. This is computationally difficult in a distributed system where multiple nodes are working on genuine blocks. Trust in this system is therefore established by the computational complexity of pulling off a successful attack. This complexity is known to be exponential.

If an attacker attempts to create another version of truth (a parallel chain), the rules of the blockchain will allow only the genuine chain to survive. We call the set of rules *consensus mechanism*.

### What are the advantages of using Blockchain?

Blockchain has the following advantages:

    + **Distributed** - Since there's no central control, the government or any other authority cannot bring down the system or suddenly change the rules. Participating nodes in the network are all peers and have equal say in keeping the blockchain operational. Often the term "decentralized" is used but by classical definition, nodes in a decentralized network are connected via a hierarchy whereas those in a distributed network are truly peer to peer. The distributed nature of blockchain makes it robust.
    + **Transparent** - The ledger is public, which means that transactions are visible to everyone participating in the network. Malicious users cannot choose to hide their transactions. Transparency brings with it accountability and verifiability.
    + **Immutable** - Once data goes into the ledger, it cannot be modified. No one can tamper it to serve their personal gains. Thus, blockchain presents a single version of truth. Data is reliable.
    + **Democratic** - Anyone can join or leave the network as they wish. No approvals are required. Nodes are given incentives to validate transactions.

### What are the common criticisms of Blockchain?

Blockchain's first application, Bitcoin, was used to power criminal activities on the darknet via sites such as Silk Road. Users on the Bitcoin network were anonymous and paid for illegal goods using bitcoins.

It's been argued that when Blockchain is applied with access control and to private data, it's integrity is compromised. Likewise, the binding of real world assets to digital equivalents requires some form of centralized authority.

While indeed the chain is immutable, what goes into a block is determined by who controls the private (secret) key. Though the Bitcoin network is distributed, in reality, nodes are assembled into cartels and a few of them could potentially control the network.

Validating transactions is compute intensive with each block taking ten minutes. In comparison, Visa processes 45K transactions per second and Google Ads gets 30 billion impressions per day. A single bitcoin transaction consumes 5,000 times more energy than a credit card payment. In terms of memory, storing the entire chain takes up 100 GB for Bitcoin, which is duplicated on every node.

It's been claimed that transaction costs will go up, the technology is too complex and adoption will not be universal.

### Can Blockchain be compared with TCP/IP?

Just as TCP/IP changed the way we communicate, Blockchain is going to change the way we exchange value. Just as TCP/IP created the Internet as an open public network without centralized control, Blockchain is creating an open distributed ledger system that can enable all sorts of applications.

Blockchain, like TCP/IP, is a technological enabler. It's the apps and solutions built on top of blockchain that are going to add value.

### What could be typical use cases of Blockchain?

Blockchain is being regarded as a foundational technology, poised to create huge impact to our traditional social-economic systems. Use cases are diverse. Depending on the extent of novelty and complexity, they can be categorized as single use, localized use, substitution, and transformation. While many applications are already out there, Blockchain may take a couple of decades to reach its full potential.

Here are some use cases:

    + MUSE platform enables music streaming platforms to offer artists a way to monetize.
    + IBM has partnered with food giants to trace the source of contaminated foods. In general, supply chains are going to be transformed.
    + Blockchain is enabling new sharing services including sharing of compute time, storage, SMS and more.
    + Consumers can sell excess energy to their neighbours directly than sell it to the utility company.
    + Land title registration, birth certificates, medical records and identification documents are some examples where blockchain can lower costs and prevent fraud.
    + In stock trading, settlements that currently take days or weeks can happen in seconds. Middlemen are also eliminated.

### Are there applications where blockchain should not be used?

Blockchain may be an overkill for many applications where a shared database may suffice. For performance and energy efficiency, a database is better.

If your app has multiple readers but only one writer, blockchain is not required. Even if there are multiple writers but they all trust one another and your systems are well protected, blockchain is not required. Even if the writers don't trust one another, but they do trust a third-party, blockchain is not required.

Many have come up with decision models or flowcharts to help you decide if your app requires blockchain or to select the right type of blockchain.

### Is Blockchain standardized?

No, Blockchain is not a standard. There's no standardization body or industry consortium defining it. Blockchain is a technology that's based on cryptography and peer-to-peer network.

While Blockchain as proposed by Satoshi Nakamoto can be used in its original form, anyone can also modify it to suit their application. This implies that applications built with Blockchain will not interwork with one another. For example, Bitcoin and Ethereum are both built with Blockchain technology but these are two independent applications that won't work together.

Having said that, there are attempts to standardize the technology. Overseen by The Linux Foundation, Hyperledger is one such effort. R3 and Enterprise Ethereum Alliance are also standardizing it within their scope of interests. Microsoft's Coco is more of a framework than a standard. It's goal is to enable Blockchain adoption in enterprises.

### What exactly is a block in Blockchain?

A simple analogy is that blocks are like pages in a traditional ledger and the entire blockchain is the ledger. A block therefore encapsulates multiple transactions. In the case of Bitcoin, a block has 500 transactions on average and consumes 1MB space on average.

A block consists of a header, a Merkle summary built from transaction identifiers, and the list of transaction identifiers. The header itself includes hash of the previous block, version info, current timestamp and nonce. Hash of the current block will become part of the next block's header.

As an example, you may study Bitcoin Block #525510, which was generated in March 2018.

### Can you enumerate some technical foundations of Blockchain?

Blockchain has brought together existing technologies in an innovative manner:

    + Computations are not partitioned and distributed to the nodes. All nodes in the network do the same computations.
    + Users sign transactions with their private keys while others verify using the corresponding public keys. These keys are generated using the well-known RSA algorithm.
    + The cryptographic hash computed per block is really a fixed length output based on an input of any length. Bitcoin uses SHA-256 to create a 256-bit hash. Given the hash, it's impractical to determine the contents of the block. It's also almost impossible for different contents to result in the same hash.
    + Each transaction in a block has its own hash and these hashes are arranged into a Merkle tree.
    + Each block contains a nonce. Most computer power at a node is expended in finding a suitable nonce such that the resulting hash on the block is valid.

## Milestones

1991

In a paper titled *How To Time-Stamp a Digital Document*, Haber and Stornetta note two necessary properties of digital timestamps: timestamp the data (not the medium in which it appears) so that it's impossible to change the data without anyone noticing it; make it impossible to falsify the data and its timestamp. Their solution uses cryptographic hash functions, signatures and distributed trust. All these would later play important roles in the invention of Blockchain.

Mar
1992

Bayer et al. improve the efficiency and reliability of digital timestamping. They propose the use of **Merkle trees** (invented in 1980 by R.C. Merkle) instead of linked lists that link transactions. Computation is reduced from \(N\) steps to \(log\_2N\) steps.

2008

Someone going by the pseudonym Satoshi Nakamoto publishes technical details of a new peer-to-peer electronic cash system, one that avoids centralized banks or intermediaries. He calls it *Bitcoin*. The term *Blockchain* is not used in this paper though the idea is clear: chain blocks based on their hashes with timestamps.

Jan
2009

Bitcoin is launched using blockchain technology. It's the first application of blockchain.

Mar
2013

As some nodes on the Bitcoin network upgrade to version 0.8, others continue mining with version 0.7. An incompatibility between the versions creates a *fork*, which is basically an alternative chain. Bitcoin loses values but later regains as nodes rollback to version 0.7.

Blockchain


# QUIC

## Summary

QUIC is a transport protocol that's an alternative to TCP. QUIC sits on top of UDP and uses *TLS 1.3* for securing its payload. It was initially designed for HTTP use case but later evolved to accommodate a variety of use cases. HTTP on top of QUIC is often called *HTTP/3*.

QUIC improves on TCP in a number of aspects: faster connection establishment, reduced head-of-line blocking, better congestion control, improved privacy and flow integrity. While measurements show that QUIC outperforms TCP, there are some scenarios where TCP does better.

QUIC is being standardized by the IETF. As on January 2021, all documents are Internet-Drafts (I-Ds) and none of them are standards yet. Many open source implementations of QUIC are available in various programming languages. QUIC is actively used on the Internet by about 5% of web servers.

## Discussion

### What are the problems with TCP/IP networking stack that QUIC aims to solve?

Each HTTP connection traditionally used a separate TCP connection. However, opening a TCP connection is slow. It requires three round trip times (RTTs): one RTT for first contact and two RTTs for TLS security. Given that increasingly more of web traffic is encrypted these days, RTTs due to TLS can't be eliminated. Though network bandwidth has increased, exchanging short packet that's typical of web traffic is hampered due to these **handshake delays**.

HTTP/2 partly mitigated TCP connection problem by allowing multiple HTTP streams to share a single TCP connection. Thus, multiple HTTP streams can exchange data in parallel. But since there's only one TCP connection, a packet loss would block all HTTP streams. This problem is called **Head-of-Line (HOL) blocking**. It can't be solved unless we make changes to the transport layer. Solving this could be important since more and more of web traffic is coming from smartphones over lossy mobile networks.

### What are the key features of QUIC?

QUIC features follow from its attempt to overcome limitations of TCP/IP:

    + **Connection Setup**: Connection to a known server is setup with *0-RTT*. Setup time increases only for new cryptographic key exchange or version negotiation. By combining cryptographic and transport handshake, setup time is less.
    + **Stream Multiplexing**: Overcomes HOL blocking issue by multiplexing QUIC streams over UDP. Loss of a QUIC packet blocks only streams in that packet.
    + **Flow Control**: Receiver specifies in terms of total bytes that a sender can send per stream and across streams.
    + **Congestion Control**: QUIC sits in the user space, not kernel space. Hence, updates to algorithms can be done more quickly. Different applications can potentially use different algorithms. QUIC has been integrated with CUBIC and BBR algorithms. RTT estimates are better.
    + **Connection Migration**: Connection is preserved even if underlying client IP address changes. Such changes are common with mobile clients, such as switching between Wi-Fi and cellular.Forward Error Correction (FEC) and ACK entropy are two early features of QUIC that were later removed since maintenance costs outweighed the benefits.

### Aren't problems of TCP/IP already solved by TFO and SCTP?

Indeed there are techniques such as TLC Snapstart and TCP Fast Open (TFO) that reduce setup time. In fact, QUIC's 0-RTT is inspired by these earlier approaches. Likewise, Stream Control Transmission Protocol (SCTP) can multiplex at the transport layer.

However, network middleboxes interfere with the end-to-end principle. To optimize delivery of packets within the network, network operators may meddle with TCP headers, drop packets or track connections. Firewalls block unfamiliar packets. Network Address Translators (NATs) rewrite transport headers. These practices made it difficult to introduce changes such as TFO or SCTP across the Internet. In fact, the term **network ossification** is used in this context.

QUIC can also suffer from network ossification. To prevent this, QUIC encrypts most of the protocol information, including some fields of QUIC packet headers. Middleboxes can't know much of what is carried and can't attempt to optimize delivery in non-standard ways. The long term benefit is that QUIC can evolve without worrying if middleboxes will support the changes. QUIC semantics remain end-to-end.

### What are QUIC, gQUIC and iQUIC?

QUIC started in Google in 2012. IETF started standardizing it in 2016 but as of January 2021, it's still a draft. Meanwhile, many implementations of QUIC are already out there, some supporting Google's QUIC and others focusing on IETF's QUIC.

It's common to say *gQUIC* for Google's QUIC. Sometimes the term *iQUIC* has been used to refer to IETF's QUIC. When QUIC becomes a standard and becomes more widely supported, we expect the term *QUIC* to refer to IETF's QUIC. Some already use *QUIC* in this sense. For now, whenever adoption or performance numbers are mentioned, it would be wise to check the version used for the study.

It's worth noting that gQUIC was specified as a monolith. IETF QUIC is more modular. Core QUIC transport, TLS with QUIC, congestion control, header compression, HTTP mapping to QUIC, version negotiation are all separate IETF drafts.

gQUIC's cryptographic handshake was called *QUIC-Crypto*. This inspired the creation of *TLS 1.3* that's used by QUIC.

Clients and servers can support multiple versions and negotiate the version during connection setup. Version numbers `0x00000001-0x0000ffff` are reserved for the standard. gQUIC and iQUIC versions have a separate ranges.

### What are some essentials terms about QUIC?

Here are some essential QUIC terms to know:

    + **Stream**: A lightweight, ordered byte-stream abstraction. A stream can be unidirectional or bidirectional, created by either endpoint. Streams are prioritized but priority is set by the application.
    + **Frame**: A unit of structured protocol information. There are many frame types. Only some of them carry streams, one stream per frame. Other frame types are for control.
    + **Packet**: A complete processable unit of QUIC. Multiple packets can be part of the same UDP datagram. Packets are confidentiality and integrity protection. A packet can include multiple streams but a packet loss blocks all its streams for retransmission. Preferably, a packet carries fewer streams. Packet payload is a sequence of one or more frames. Packet numbers are never reused within a connection, even for retransmissions.
    + **Header**: Part of a QUIC packet. Header can be long (4 types) or short (1 type). Some header fields are encrypted.
    + **Connection**: A shared state between client and server, which are the connection endpoints. Connection parameters are agreed during a *handshake phase*. *Connection ID* helps with correct packet delivery even when lower layer addressing changes.

### What are some criticisms of QUIC?

We note these criticisms or concerns about QUIC (likely to be overcome as QUIC matures):

    + **Security**: Network attacks on UDP are common to the extent that some enterprises and operators block UDP traffic except those arriving on port 53 for DNS. 0-RTT can be misused for replay attacks, which can be a problem with non-idempotent requests. QUIC traffic is also not recognized or analysed by firewalls.
    + **Network Control**: Since transport layer headers are encrypted, network operators can't optimize their networks to manage congestion. For example, they can't know if a packet is an ACK or a retransmission. Estimating RTT is more difficult. The only options appear to be a single *Spin Bit* and IP-level *Explicit Congestion Notification (ECN)*.
    + **Performance**: Compared to TCP, UDP implementations are less performant. QUIC takes up too much CPU time. Low-end smartphones and IoT devices will suffer.
    + **Latency**: 0-RTT works only if load balancers maintain state and route to the same server. Since multiple versions can co-exist, each version negotiation takes an extra RTT.
    + **Fairness**: Since QUIC is in user space, applications and servers could implement more aggressive Congestion Control Algorithms (CCAs) that make it unfair for non-QUIC connections.

### Could you compare the performance of QUIC against TCP/IP?

In one study, gQUIC outperformed TCP+HTTPS in desktop environments, due to 0-RTT and quick loss recovery. In fluctuating bandwidths, QUIC did better due to better ACK handling and more accurate RTT estimates. However, QUIC was sensitive to out-or-order delivery, which it perceives as loss. QUIC is poorer on smartphones since it runs in user space. It's poorer in handling lots of small packets. It's also unfair to TCP by consuming more than its share of bandwidth.

Researchers at RWTH Aachen University compared TCP+TLS1.3+HTTP/2 versus gQUIC performance under different network conditions. TCP parameters were fine-tuned. On a lossy network, QUIC performed better. In another test, visual web page performance was not all that different. They comment that fine-tuning TCP might suffice.

Experiments by Fastly showed that QUIC performed poorly due to expensive memory copies between user space and kernel space. However, they matched TCP's performance by delaying ACK (a QUIC extension), using a Linux feature called Generic Segmentation Offload (GSO), and increasing the Maximum Transmission Unit (MTU) length.

### What are some resources to get started with QUIC?

IETF's QUIC WG webpage is the place to track the latest in standardization, or download current versions of documents.

The QUIC project page at Chromium is worth reading. It's FAQ shows how to test a QUIC server against Chrome or build standalone QUIC server and client.

Chrome browser enables QUIC by default. In other popular browsers, HTTP/3 and QUIC can be enabled by setting specific configuration flags.

Implementers can join the quicdev Slack channel to coordinate interoperability testing. There are already many implementations of QUIC, lists of which are maintained at QUIC WG's Wiki and on Wikipedia. An interoperability matrix is also available online.

We note a few of these implementations: Chromium (C/C++), ngtcp2 (C), nginx (C), quic-go (Go), and quicker (NodeJS/TypeScript).

In 2018, it was commented that only some implementations support all the advanced features. Very few map HTTP/3 to QUIC.

### Could you share some tools for debugging or analysing QUIC traffic?

It's possible to capture QUIC traffic and analyze it offline within Chrome.

Another tool is Wireshark. Since packets are encrypted, it's possible to load the SSL secret and then decrypt the packets. CellStream has released gQUIC and IETF QUIC profiles for Wireshark.

Multiple implementations fragmented across QUIC versions may lead to sub-optimal performance or even buggy behaviour. Since traditional network analysis tools are tuned to TCP, new tools are needed. Hasselt University has created useful tools to analyse QUIC traffic.

Ericsson's Spindump is a tool that makes use of QUIC's Spin Bit to figure out RTT for individual connections and aggregates. It's written in C and supports TCP, QUIC, COAP, DNS, ICMP, and SCTP traffic. It's also available as a library that can be linked with other programs.

## Milestones

2012

Google's work on SPDY protocol becomes the starting point for the standardization of **HTTP/2** by IETF. Previously, Google made improvements to the physical layer by building its own carrier-grade networks and CDNs. While HTTP/2 allows multiple HTTP sessions share a single TCP connection, a single packet loss affects all sessions of that connection. This becomes the motivation to innovate at the transport layer, thus kickstarting QUIC work.

Jun
2013

Google engineer Roskind makes public **QUIC's design document**. He notes that RTT is limited by speed of light. It's high on mobile networks. At best, we can try to reduce the number of RTTs. QUIC is a proposal to do just that. Roskind notes that prototype implementations are ready for real-world experiments.

Jul
2014

**Wireshark 1.12.0** is released. This release introduces support for Google's QUIC. In August 2020, it's reported that Wireshark's support of Google's gQUIC and IETF's QUIC is still evolving.

Jun
2016

**IETF accepts QUIC** as an Internet-Draft. QUIC was proposed to IETF a year earlier in June 2015. IETF also renames the protocol to simply *QUIC* from its original expanded form of *Quick UDP-Based Internet Connection*. Thus, QUIC should not be treated as an acronym. The QUIC Working Group is chartered in October. Version 00 of Internet-Draft titled *QUIC: A UDP-Based Multiplexed and Secure Transport* is published in November.

Jan
2018

In an interview, we come to learn that 3GPP Core Networks and Terminals (CT) Working Groups are interfacing with IETF on how to adopt **QUIC for 5G networks**. QUIC may be considered for 5G Release 16. 3GPP expresses concerns about protocol headers being encrypted. They therefore provide IETF with requirements from network providers who often like to know more about the traffic that they carry. Meanwhile, Openwave Mobility reports more than 20% of video traffic on the networks of 30 mobile operators use QUIC. YouTube is a significant factor in this growth.

Oct
2018

The term **HTTP/3** is proposed in IETF as the new name for HTTP over QUIC, which has also been called HTTP/2 over QUIC. Essentially, it's a mapping of HTTP semantics over QUIC. Its wire format isn't compatible with HTTP/2. IETF Internet-Draft version 17 titled *Hypertext Transfer Protocol Version 3 (HTTP/3)* is published in December.

May
2019

The engineering team at Uber reports that QUIC outperforms TCP. They used *Cronet* networking library for Android. In production apps, they find that QUIC reduces tail-end latencies by 10-30% even on low connectivity networks. Tail-end latencies are a big problem for Uber, being almost six times the median values.

Oct
2020

Google Chrome browser includes IETF's QUIC (v29) in addition to Google's QUIC (Q050). However, IETF QUIC 0-RTT is not yet supported. Google claims that IETF QUIC outperforms HTTP over TLS 1.3 over TCP. Google search latency is less by 2%. YouTube rebuffer time is less by 9%. Client throughput is up by 3% (desktop) and 7% (mobile). Google also notes that QUIC carries a third of Google traffic.

Dec
2020

Measurements collected by W3Techs show that about 5% of web servers use QUIC. This has grown from about 2.8% in January. Of all sites that use QUIC, about 80% use LiteSpeed server.

Jan
2021

Weekly scans at netray.io show that IETF draft version 29 of QUIC is widely supported. Version 29 was published in June 2020. The most recent one is version 34, published in January 2021.

QUIC