vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information about the dialog webhook, see [Making a programmatic call from dialog](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-dialog-webhooks).

For environments where private endpoints are in use, keep in mind that a webhook sends traffic over the internet. For more information, see [Private network endpoints](https://cloud.ibm.com/docs/assistant-data?topic=assistant-securitysecurity-private-endpoints).



 Defining the webhook 

You can define one webhook URL to use for preprocessing every incoming message.

The programmatic call to the external service must meet these requirements:



* The call must be a POST HTTP request.
* The request body must be a JSON object (Content-Type: application/json).
* The call must return in 8 seconds or less.



If your external service supports only GET requests, or if you need to specify URL parameters dynamically at run time, consider creating an intermediate service that accepts a POST request with a JSON payload containing any runtime values. The intermediate service can then make a request to the target service, passing these values as URL parameters, and then return the response to the dialog.

Do not set up and test your webhook in a production environment where the assistant is deployed and is interacting with customers.

To add the webhook details, complete the following steps:



1. From your assistant, click the ![Overflow menu](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/kebab.png) icon, and then choose Settings.
2. Click Webhooks > Pre-message webhook.
3. Set the Pre-message webhook switch to Enabled.
4. Decide whether to return an error if the webhook call fails.

When enabled, everything stops until the preprocessing step is completed successfully.
* If you have a critical preprocessing step that must be taken before you want to allow the message to be processed by the assistant, enable this setting.

Take steps to test the process that you are calling on a regular basis so you will know if it's down, and can change this setting to prevent all of your message calls from failing.
* When this setting is disabled, the assistant ignores any errors it encounters and continues to process the incoming message without taking the preprocessing step. If the preprocessing step is helpful but not critical, consider keeping this setting disabled.



6. In the URL field, add the URL for the external application to which you want to send HTTP POST request callouts.

For example, you might write a Cloud Functions web action that checks whether a message is in a language other than English, and if so, send it to the Language Translator service to covert it to English. Specify the URL for your web action, as in this example:

https://us-south.functions.cloud.ibm.com/api/v1/web/my_org_dev/default/translateToEnglish.json

You must specify a URL that uses the SSL protocol, so specify a URL that begins with https.

You cannot use a webhook to call a Cloud Functions action that uses token-based Identity and Access Management (IAM) authentication. However, you can make a call to a Cloud Functions web action or a secured web action.
7. In the Secret field, add a private key to pass with the request that can be used to authenticate with the external service.

The key must be specified as a text string, such as purple unicorn. The maximum length is 1,024 characters. You cannot specify a context variable.

It is the responsibility of the external service to check for and verify the secret. If the external service does not require a token, specify any string you want. You cannot leave this field empty.

If you want to see the secret as you enter it, click on the Show password icon ![view icon](https://cloud.ibm.com/docs-content/v1/content/icons/view.svg) before you start typing.
"world", 0.2598829173456253, 0.5322130804452672]]
]
}

Also, the level of precision for word timings and marks is now reduced to three decimal places. For more information about the new responses, see [Generating word timings](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-timing).

Security vulnerabilities addressed
: The following security vulnerabilities have been fixed:



* [Red Hat CVE-2022-24407](https://access.redhat.com/security/cve/CVE-2022-24407): A flaw was found in the SQL plugin shipped with Cyrus SASL. The vulnerability occurs due to failure to properly escape SQL input and leads to an improper input validation vulnerability. This flaw allows an attacker to execute arbitrary SQL commands and the ability to change the passwords for other accounts allowing escalation of privileges.
* [Security Bulletin: A jwt-go vulnerability affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2020-26160)](https://www.ibm.com/support/pages/node/6574543)
* [Security Bulletin: A vulnerability in Golang Go affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2021-29923)](https://www.ibm.com/support/pages/node/6574545)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)](https://www.ibm.com/support/pages/node/6583151)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution with IBM WebSphere Application Server (CVE-2021-23450)](https://www.ibm.com/support/pages/node/6583149)







 23 February 2022 (Version 4.0.6) 

Version 4.0.6 is now available
// We'll need some super-secret data to use as a symmetric key.
const encoder = new TextEncoder()
const secretKeyData = encoder.encode("my secret symmetric key")
const key = await crypto.subtle.importKey(
"raw", secretKeyData,
{ name: "HMAC", hash: "SHA-256" },
false, [ "verify" ]
)

// Extract the query parameters we need and run the HMAC algorithm on the
// parts of the request we're authenticating: the path and the expiration
// timestamp.
const expiry = Number(url.searchParams.get("expiry"))
const dataToAuthenticate = url.pathname + expiry

// The received MAC is Base64-encoded, so we have to go to some trouble to
// get it into a buffer type that crypto.subtle.verify() can read.
const receivedMacBase64 = url.searchParams.get("mac")
const receivedMac = byteStringToUint8Array(atob(receivedMacBase64))

// Use crypto.subtle.verify() to guard against timing attacks. Since HMACs use
// symmetric keys, we could implement this by calling crypto.subtle.sign() and
// then doing a string comparison -- this is insecure, as string comparisons
// bail out on the first mismatch, which leaks information to potential
// attackers.
const verified = await crypto.subtle.verify(
"HMAC", key,
receivedMac,
encoder.encode(dataToAuthenticate)
)

if (!verified) {
const body = "Invalid MAC"
return new Response(body, { status: 403 })
}

if (Date.now() > expiry) {
const body = URL expired at ${new Date(expiry)}
Managing CIS for optimal security 

The IBM Cloud® Internet Services (CIS) security settings include safe defaults designed to avoid false positives and negative influence on your traffic. However, these safe default settings do not provide the best security posture for every customer. Take the following steps to be sure that your CIS account is configured in a safe and secure way.

Recommendations and best practices:



* Secure your origin IP addresses by proxying and increasing obfuscation
* Configure your security level selectively
* Activate your Web Application Firewall (WAF) safely





 Best practice 1: Secure your origin IP addresses 

When a subdomain is proxied using CIS, all traffic is protected because we actively respond with IP addresses specific to CIS (for example, all of your clients connect to CIS proxies first, and your origin IP addresses are obscured).



 Use CIS proxies for all DNS records for HTTP(S) traffic from your origin 

To improve the security of your origin IP address, you should proxy all HTTP(S) traffic.

See the difference yourself - Query a non-proxied and a proxied record:

dig nonproxied.theburritobot.com +short
1.2.3.4 (The origin IP address)

$ dig proxied.theburritobot.com +short
104.16.22.6 , 104.16.23.6 (CIS IP addresses)





 Obscure non-proxied origin records with non-standard names 

Any records that cannot be proxied through CIS, and that still use your origin IP, such as FTP, can be secured by creating additional obfuscation. In particular, if you require a record for your origin that cannot be proxied by CIS, use a non-standard name. For example, instead of ftp.example.com use [random word or-random characters].example.com. This obfuscation makes dictionary scans of your DNS records less likely to expose your origin IP addresses.





 Use separate IP ranges for HTTP and non-HTTP traffic if possible
This time, the program should be able to successfully 'put' and 'get' messages from the queue manager.

The messages travelling over the network are now encrypted and the client now trusts the server.







 Securing Applications with Mutual (Two Way) TLS 

Standard TLS is commonly used when connecting to servers or websites. Using standard TLS, a client can be sure that it is connecting to the trusted server. In addition, mutual TLS ensures that the server only accepts connections from trusted clients. This is again achieved through the use of security certificates.

Before starting this section, you should have completed the Standard TLS section above. The JMS client application should currently be communicating with a queue manager using standard TLS authentication. You will now enable mutual TLS.



 Step 1: Connect to and configure the queue manager 

First, the queue manager needs to be configured and mutual authentication must be enforced.



1. Run runmqsc -c -u <ADMIN_MQ_USER> -w60 <QUEUE_MANAGER_NAME> to connect to the queue manager where:



* <ADMIN_MQ_USER> - this is 'mqUsername' in the file platformApiKey.json
* <QUEUE_MANAGER_NAME> - this is 'queueManagerName' in the file connection_info.txt



2. Run ALTER CHL('CLOUD.APP.SVRCONN') CHLTYPE(SVRCONN) SSLCIPH(ECDHE_RSA_AES_128_CBC_SHA256) SSLCAUTH(REQUIRED)



* Notice now that SSLCAUTH is changed to 'REQUIRED'. This is configuring the queue manager to only accept communication from trusted clients.









 Step 2: Rerun the JMS application 

Rerun the JMS application.



* On Windows:



* Run java -cp .com.ibm.mq.allclient-9.0.4.0.jar;.javax.jms-api-2.0.1.jar;. com.ibm.mq.samples.jms.JmsPutGet



* On Linux:
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to phishing attacks in Python (CVE-2021-28861)](https://www.ibm.com/support/pages/node/6988075)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Pypa Setuptools (CVE-2022-40897)](https://www.ibm.com/support/pages/node/6988077)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a sensitive information exposure in systemd (CVE-2022-4415)](https://www.ibm.com/support/pages/node/6988079)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Python (CVE-2022-45061)](https://www.ibm.com/support/pages/node/6988081)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Libksba (CVE-2022-47629)](https://www.ibm.com/support/pages/node/6988083)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in GNU Tar (CVE-2022-48303)](https://www.ibm.com/support/pages/node/6988085)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in FasterXML jackson-databind (CVE-2022-42003)](https://www.ibm.com/support/pages/node/6988087)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Perl (CVE-2020-10878)](https://www.ibm.com/support/pages/node/6988089)
The Speech to Text service offers a WebSocket interface and synchronous and asynchronous HTTP Representational State Transfer (REST) interfaces.



* [The WebSocket interface](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-websockets) offers an efficient, low-latency, and high-throughput implementation over a full-duplex connection.
* [The synchronous HTTP interface](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-http) provides a basic interface to transcribe audio with blocking requests.
* [The asynchronous HTTP interface](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-async) provides a non-blocking interface that lets you register a callback URL to receive notifications or poll the service for job status and results.



All interfaces provide the same basic speech recognition capabilities, but you might specify the same parameter as a request header, a query parameter, or a parameter of a JSON object depending on the interface that you use. The service can also return different results depending on the interface and parameters that you use with a request.



* For information about making a speech recognition requests with each of the service's interfaces, see [Making a speech recognition request](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-basic-request).
* For information about the results of a speech recognition request, see [Understanding speech recognition results](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-basic-response).





 Data limits 

The interfaces accept the following maximum amounts of audio data with a single request:



* The WebSocket interface accepts a maximum of 100 MB of audio.
* The synchronous HTTP interface accepts a maximum of 100 MB of audio.
* The asynchronous HTTP interface accepts a maximum of 1 GB of audio.
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a buffer overflow in GNU glibc (CVE-2021-3999)](https://www.ibm.com/support/pages/node/6890837)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security bypass in GNU gzip (CVE-2022-1271)](https://www.ibm.com/support/pages/node/6890841)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-27664)](https://www.ibm.com/support/pages/node/6890843)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-2879)](https://www.ibm.com/support/pages/node/6909749)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to query parameter smuggling in Golang Go (CVE-2022-2880)](https://www.ibm.com/support/pages/node/6890847)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-32189)](https://www.ibm.com/support/pages/node/6890849)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-41715)](https://www.ibm.com/support/pages/node/6890851)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information exposure in OpenSSL (CVE-2022-2097)](https://www.ibm.com/support/pages/node/6890853)







 30 November 2022 (Version 4.6.0)
For more information about data security for cloud applications, see [Security architecture for cloud applications](https://www.ibm.com/cloud/architecture/architectures/securityArchitecture/security-for-data).





 Information security 

The service supports the European Union General Data Protection Regulation (GDPR) to manage user data. You can pass the X-Watson-Metadata header with a request to associate a customer ID with data that the request passes to the service. If necessary, you can then delete the data by using the DELETE /v1/user_data method. For more information about these features and their use, see [Information security](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-information-security).

IBM Cloud

For Premium plans, the service also offers US Health Insurance Portability and Accountability Act (HIPAA) readiness in the Washington, DC, (us-east) and Dallas (us-south) regions.





 Request logging 

IBM Cloud

The service lets you control the default request logging that is performed for all Watson services. The service logs request and response data only to improve the service for future users. The logged data is never shared or made public. No data can be exported from the service. For example, users must retain the data that they use for training custom prompts because it cannot be retrieved from the service.

If you are concerned about the privacy of users' personal information or otherwise do not want your requests to be logged by IBM, you can opt out of the default logging to prevent the service from logging your request and response data. If you opt out, the service logs no user data from your HTTP or WebSocket requests. No user data is written to disk.

You can choose to opt out of logging at either the account level or the API request level. For more information, see [Controlling request logging for Watson services](https://cloud.ibm.com/docs/watson?topic=watson-gs-logging-overview).





 Data separation and encryption 

IBM Cloud

The service's Standard and Premium pricing plans offer different levels of data separation and encryption for users:
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information disclosure or denial of service in OpenSSL (CVE-2021-3712)](https://www.ibm.com/support/pages/node/6829165)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to weakened security in OpenSSL (CVE-2021-4160)](https://www.ibm.com/support/pages/node/6829167)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in OpenSSL (CVE-2022-0778)](https://www.ibm.com/support/pages/node/6829175)







 3 August 2022 (Version 4.5.1) 

Version 4.5.1 is now available
: Text to Speech for IBM Cloud Pak for Data version 4.5.1 is now available. This version supports IBM Cloud Pak for Data version 4.5.x and Red Hat OpenShift versions 4.6, 4.8, and 4.10. For more information, see [Watson Speech services on IBM Cloud Pak for Data](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.5.x?topic=services-watson-speech).

Support for FIPS-enabled clusters
: Both Text to Speech for IBM Cloud Pak for Data and Speech to Text for IBM Cloud Pak for Data now support running on Federal Information Processing Standard (FIPS)-enabled clusters. For more information, see [Services that support FIPS](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.5.x?topic=considerations-services-that-support-fips).

Defect fix: Fixed ephemeral storage calculations to prevent occasional pod evictions
: Defect fix: A defect was fixed and calculation of ephemeral storage limits is now more precise for the Text to Speech for IBM Cloud Pak for Data and Speech to Text for IBM Cloud Pak for Data runtimes.
* [Security Bulletin: A vulnerability in logback-classic affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2021-42550)](https://www.ibm.com/support/pages/node/6575511)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a stack-based buffer overflow in GNU C Library (CVE-2022-23218)](https://www.ibm.com/support/pages/node/6578617)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to stack-based buffer overflow in GNU C Library (CVE-2022-23219)](https://www.ibm.com/support/pages/node/6578619)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a buffer overflow and underflow in GNU C Library (CVE-2021-3999)](https://www.ibm.com/support/pages/node/6578621)







 30 March 2022 (Version 4.0.7) 

Version 4.0.7 is now available
: Text to Speech for IBM Cloud Pak for Data version 4.0.7 is now available. This version supports IBM Cloud Pak for Data version 4.x and Red Hat OpenShift versions 4.6 and 4.8. For more information about installing and managing the service, see [Installing Watson Text to Speech](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.0?topic=speech-installing-watson-text).

Custom resource property for specifying a default voice
: The default voice for speech synthesis and pronunciation requests is en-US_MichaelV3Voice. If you do not install the en-US_MichaelV3Voice, you must either



* Use the voice parameter to pass the voice that is to be used with each request.
* Specify a new default voice for your installation of Text to Speech for IBM Cloud Pak for Data by using the defaultTTSVoice property in the Speech services custom resource.
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in GNU C Library (CVE-2019-19126)](https://www.ibm.com/support/pages/node/6829149)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GNU C Library ( CVE-2020-10029)](https://www.ibm.com/support/pages/node/6829151)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GNU glibc (CVE-2020-1751)](https://www.ibm.com/support/pages/node/6829155)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GNU glibc (CVE-2020-1752)](https://www.ibm.com/support/pages/node/6829157)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information disclosure or denial of service in GNU glibc (CVE-2021-35942)](https://www.ibm.com/support/pages/node/6829159)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to buffer overflow in OpenSSL (CVE-2021-3711)](https://www.ibm.com/support/pages/node/6829161)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information disclosure or denial of service in OpenSSL (CVE-2021-3712)](https://www.ibm.com/support/pages/node/6829165)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to weakened security in OpenSSL (CVE-2021-4160)](https://www.ibm.com/support/pages/node/6829167)