Wikipedia co-founder launches Wikitribune to fight fake news

The content below is taken from the original (Wikipedia co-founder launches Wikitribune to fight fake news), to continue reading please visit the site. Remember to respect the Author & Copyright.

Wikipedia co-founder Jimmy Wales hopes to tackle fake news with a journalism outfit of his own. Wikitribune will be free to access and use crowdfunding to hire experienced reporters. They’ll work alongside volunteers who can sub-edit articles, fact-check stories and suggest new topics for the site to pursue. "This will be the first time that professional and citizen journalists will work side-by-side as equals writing stories as they happen, editing them as they develop, and at all times backed by a community checking and rechecking all of the facts," Wales said.

Wikitribune‘s existence (and success) will depend on donations from people who believe in its mission and the journalism it’s producing. The site will cover traditional news beats, such as UK and international politics, as well as science, technology and specialist subjects chosen by subscribers. "If you take as an example the bitcoin community," Wales said, "they’ve a very active and obsessed community. There’s a lot of news that comes out in the field, and I think they’d love to be able to raise money to hire a journalist and put them on the bitcoin/blockchain beat."

Wikitribune articles will include detailed sourcing and link out to full transcripts, video and audio recordings of interviews. Reader submissions will also need to be approved by a full-time editor before they appear on the site. These two mechanisms will, Wales hopes, create a news culture that is both transparent and accurate, leveraging the expertise of reporters and the news gathering, fact-checking scale of the crowd. Controlling such a large group of people will be tricky, however. Reddit users, for instance, wrongly identified one of the Boston Marathon bombers in 2013.

Wales is optimistic, however. Few people thought that Wikipedia would work, and while the site is far from perfect, it has been able to avoid the false news problem, at least for the most part. The hope is that the same culture generated by Wikipedia’s editors will blossom inside Wikitribune. Those values will be helped in part by the site’s business model — with no advertiser funding, the site can avoid the click-chasing and click-bait stories that have plagued other sites and reduced reader trust.

Plenty of technology companies are trying to tackle the ‘fake news’ epidemic. YouTube is holding workshops in the UK to teach young people how to spot bogus stories. Google is showing fact-checkers such as PolitiFact and Snopes more prominently in search results. Facebook bought a bunch of full-page newspaper ads in Germany with basic reader fact-checking tips. Despite these efforts, the problem persists. Politicians in the UK are holding an inquiry into the rise of fake news, and British newspapers have requested a deeper investigation into the role that Facebook and Google play in its distribution.

Clearly, Wales thinks the answer is a new, better-funded and creatively organised newsroom. Joshua Benton, director of Harvard University’s Nieman Journalism Lab, isn’t so sure. "There are a variety of people who – if he does this right – will view it as a trusted platform," he told the BBC. "But another 10 to 20 people are not going to ‘fix the news’."

Via: The Guardian, The BBC

Source: Wikitribune

Posted on April 28 in category News

Tags: Technology

Open-spec networking Mini-ITX has 1, 2.5, and 10 GbE ports

The content below is taken from the original (Open-spec networking Mini-ITX has 1, 2.5, and 10 GbE ports), to continue reading please visit the site. Remember to respect the Author & Copyright.

SolidRun’s “Marvell MacchiatoBIN” is a $349, Mini-ITX networking SBC that runs Linux 4.4 on Marvell’s quad -A72 Armada 8040, and supports ODP, OFP, and NFV. SolidRun, which is known for its NXP i.MX6 based HummingBoard SBCs and Marvell Armada 38x based ClearFog Pro and scaled down ClearFog Base networking boards, has spun a $349 (and […]

Posted on April 28 in category News

Tags: RISC

Azure Billing Reader role and preview of Invoice API

The content below is taken from the original (Azure Billing Reader role and preview of Invoice API), to continue reading please visit the site. Remember to respect the Author & Copyright.

Today, we are pleased to announce the addition of a new in-built role, Billing Reader role. The new Billing Reader role allows you to delegate access to just billing information with no access to services such as VMs and storage accounts. Users in this role can perform Azure billing management operations such as viewing subscription scoped cost reporting data and downloading invoices. Also, today we are releasing the public preview of a new billing API that will allow you to programmatically download subscription’s billing invoices.

Allowing additional users to download invoices

Today, only the account administrator for a subscription can download and view invoices. Now the account administrator can allow users in subscription scoped roles, Owner, Contributor, Reader, User Access Administrator, Billing Reader, Service Administrator and Co-Administrator, to view invoices. The invoice contains personal information and hence the account administrator is required to enable access to allow users in subscription scoped roles to view invoices. The steps to allow users in subscription scoped roles to view invoices are below:

Login to the Azure Management Portal with account administrator credentials.
Select the subscription that you want to allow additional users to download invoices.
From the subscription blade, select the Invoices tab within billing section. Click on Access to invoices command. The feature to allow additional users to download invoices is in preview, not all invoices may be available. The account administrator will have access to all invoices.
Allow subscription scoped roles to download invoice

How to add users to Billing Reader Role

Users who are in administrative roles i.e. Owner, User Access Administrator, Service Administrator and Co-administrator roles can delegate Billing Reader access to other users. Users in Billing Reader can view subscription scoped billing information such as usage and invoices. Note, currently billing information is only viewable for non-enterprise subscription. Support for enterprise subscriptions will be available in the future.

Select the subscription for which you want to delegate Billing Reader access
From the subscription blade, select Access Control (IAM)
Click Add
Select “Billing Reader” role
Select or add user that you want to delegate access to subscription scoped billing information

The full definition of access allowed for user in Billing Reader role is detailed in built in roles documentation.

Downloading invoice using new Billing API

Till now you could only download invoices for your subscription via the Azure management portal. We are enabling users in administrative (Owner, Contributor, Reader, Service Administrator and Co-administrator) and Billing Reader roles to download invoices for a subscription programmatically. The invoice API allows you to download current and past invoices for an Azure subscription. During the API preview some invoices may not be available for download. The detailed API documentation is available and samples can also be downloaded. The feature to download invoices via API is not available for certain subscriptions types such as support, enterprise agreements, or Azure in Open. To be able to download invoices through API the account admin has to enable access for users in subscription scoped roles as outlined above.
You can easily download the latest invoice for your subscription using Azure PowerShell.

Login using Login-AzureRmAccount
Set your subscription context using Set-AzureRmContext -SubscriptionId <subscription Id>
To get the URL of the latest invoice, execute Get-AzureRmBillingInvoice –Latest

The output will give back an invoice link to download the latest invoice document in PDF format, an example is shown below


PS C:\> Get-AzureRmBillingInvoice -Latest
         Id                           : /subscriptions/{subscription ID}/providers/Microsoft.Billing/invoices/2017-02-09-117274100066163
         Name                   : 2017-02-09-117274100066163
         Type                     : Microsoft. Billing/invoices
         InvoicePeriodStartDate : 1/10/2017 12:00:00 AM
         InvoicePeriodEndDate   : 2/9/2017 12:00:00 AM
         DownloadUrl            : http://bit.ly/2qdMiPn identifier}.pdf?sv=2014-02-14&sr=b&sig=XlW87Ii7A5MhwQVvN1kMa0AR79iGiw72RGzQTT% 2Fh4YI%3D&se=2017-03-01T23%3A25%3A56Z&sp=r
         DownloadUrlExpiry      : 3/1/2017 3:25:56 PM

To download invoice to a local directory you can run the following


PS C:\> Get-AzureRmBillingInvoice -Latest
PS C:\> Invoke-WebRequest -Uri $invoice.DownloadUrl -OutFile <directory>\InvoiceLatest.pdf

In the future, you will see additions to this API which will enable expanded programmatic access to billing functionality.

Posted on April 28 in category News

Tags: Technology

Tiny module and Nano-ITX dev board use Qualcomm wearables SoC

The content below is taken from the original (Tiny module and Nano-ITX dev board use Qualcomm wearables SoC), to continue reading please visit the site. Remember to respect the Author & Copyright.

Intrinsyc‘s 31.5 x 15mm “Open‐Q 2100 SOM” and Nano-ITX dev kit for wearables run Android 7.0 or Android Wear on Qualcomm’s Snapdragon Wear 2100 SoC.

Qualcomm’s Snapdragon Wear 2100 SoC, which runs on most Android Wear 2.0 smartwatches, among other wearables, is now open to a wider audience of developers. Intrinsyc is launching a tiny Open‐Q 2100 SOM computer-on-module that showcases its partner’s wearable SoC, as well as an Open‐Q 2100 Development Kit that expands upon it. Other modules in Intrinsyc’s line of mostly Android-focused Open-Q modules have included the Snapdragon 820 based Open-Q 820 and Open-Q 650 IP Camera Reference Design.

Open‐Q 2100 SOM front and back views (left) and angle view
(click images to enlarge)

As befits a wearable module, the 31.5 x 15 x 5mm Open‐Q 2100 SOM is even smaller than the 50 x 25mm

Open-Q 820 µSOM

. It’s designed for smartwatches, sports watches, high-end fitness trackers, connected headsets, smart eyewear, and tracker devices for pets, children, and the elderly, says Intrinsyc. Android 7.0 “Nougat” is the default build, but you can optionally choose Android Wear.

The 1.2GHz, quad-core Cortex-A7 Snapdragon Wear 2100 (APQ8009W) boasts 25 percent longer battery life than the Snapdragon 400 that was used on first gen Android Wear watches. It features an Adreno 304 GPU that supports 640 x 480 resolution and 720p video. The SoC also offers Fluence noise cancellation technology, as well as Snapdragon Voice+ and Voice Activation firmware.

Like the newer, rival Samsung Exynos 7270 wearables SoC, the Wear 2100 is packaged in a 10 x 10mm ePoP configuration. The Open‐Q 2100 SOM uses the lower-end “tethered” version of the SoC, which offers built-in, 2.4GHz 802.11n and Bluetooth 4.1/BLE, but not the 3G or an X5 LTE 4G modem found on the “connected” model.

The Open‐Q 2100 SOM adds a similarly sized 10x10mm ePoP memory module with 512MB of 400MHz LPDDR3 RAM and 4GB of eMMC 4.5 flash. In addition to offering WiFi and Bluetooth, the module provides a Qualcomm WGR7640 location chip with GPS, GLONASS, and compass.

The Open‐Q 2100 SOM is further equipped with 2-lane MIPI-CSI, and supports up to [email protected] video, optimized for wearables. I/O support includes USB 2.0, I2S, GPIO, SDC2, and “MIPI,” all of which are expressed via dual 100-pin connectors. The module supports 3.6V to 4.2V power, controlled by a Qualcomm PM8916-1 PMIC, and can run at -20 to 85°C temperatures.

Open-Q 2100 Development Kit

The Open‐Q 2100 SOM is available as part of a Open-Q 2100 Development Kit that includes a 170 x 170mm, Nano-ITX form factor carrier board. There’s also an optional smartphone-style display and optional camera module.

Open-Q 2100 Development Kit
(click images to enlarge)

The kit is equipped with an Ethernet port, an HDMI port, a micro-USB client port and 4x USB 2.0 host ports. (The product page says 3x, but the datasheet gets it right.) There are MIPI-DSI and -CSI interfaces for display and camera, respectively, as well as SPI, I2S, GPIO.

The Open-Q 2100 Development Kit has both a 12V jack and a Li-Ion battery. The board runs at -10 to 70°C. As usual, Intrinsyc also offers optional turnkey development support.

Further information

The Open‐Q 2100 SOM and Open-Q 2100 Development Kit will be available in May at single-unit pricing of $75 and $595 respectively. More information may be found at the Intrinsyc Technologies Corp. Open‐Q 2100 SOM and Open-Q 2100 Development Kit product pages. Purchases are available at the SOM and Dev Kit shopping pages.

Posted on April 28 in category News

Tags: RISC

Amazon may be using disk drives with hot-swappable components

The content below is taken from the original (Amazon may be using disk drives with hot-swappable components), to continue reading please visit the site. Remember to respect the Author & Copyright.

Amazon may be using disk drives with hot-swappable components

Patent calls for drives in which mechanical bits and electronics aren’t bound together

A figure from Amazon's patent for de-composed disks

Amazon’s illustration of how de-coupled disks might work

Amazon’s won a patent for “Hard disk drive assembly with field-separable mechanical module and drive control”.

In Amazon’s world disk drives have two distinct systems. There’s a “drive mechanical module” comprising a drive’s arms, heads, spindle, motor and platters. And there’s a “control module”, basically the drive’s motherboard.

But as the patent notes, when disk drives fail “Many hard disk drives failures may only involve electrical components (such as a semiconductor chip failure) or only mechanical components (such as an actuator failure). Nevertheless, repairing the data storage system may require removing and replacing both the mechanical components and the electrical components of the hard disk drive.”

Amazon would rather replace one or the other, rather than a whole disk. Hence the patent application’s proposal for disks that the mechanical module or the control module be replaceable. And replaceable in situ without having to remove a disk from a rack.

The application also proposes a rack-mounted system in which control modules and mechanical modules could be discrete. It’s even suggested control modules could serve more than one mechanical module. Building a whole-of-rack system around this idea is said to facilitate easier non-disruptive replacement of either and also offers some cooling advantages.

Amazon filed this patent in 2012 and it appears to have been granted earlier this year and to have bubbled into public view in recent days.

There’s no indication the company has adopted this technology, but it would not surprise if it has done so given the scale at which it operates and the advantages this approach to disk design confers. It’s also likely a cost saver as parts could be cheaper than whole new disks. Being able to replace a disk drive’s motherboard could mean data could be retained with a slight dip in resiliency while a new board is pressed into service.

Amazon’s not alone in wanting exotic disks: Google last year called for disk-makers to build taller drives that fit more platters. Apple’s also added extra pins to drives for the iMac, which irked users as it meant off-the-shelf kit would not work in their computers and Cupertino’s replacements sold well above market prices.

Disk-makers didn’t rush to help Google – in public at least – but Apple had no trouble getting what it wanted, suggesting that if Amazon has, or does, seek its de-composable drives it won’t have much trouble finding someone to build them. ®

Posted on April 28 in category News

Tags: Technology

Best Practices for Deploying StorSimple Virtual Arrays

The content below is taken from the original (Best Practices for Deploying StorSimple Virtual Arrays), to continue reading please visit the site. Remember to respect the Author & Copyright.

Microsoft's VMworld 2013 custard truck/Hyper-V guerrilla marketing vehicle

Let’s look at some of the best practices for using the StorSimple 1200 virtual appliance. It was recently made available by Microsoft to small and medium enterprises (SMEs), as well as small and medium businesses (SMBs).

The Virtual Machine

The virtual appliance can be deployed on-premises as a virtual machine on one of three virtualization platforms:

Windows Server 2012 or later Hyper-V
VMware ESXi 5.5 or later
Windows Server 2008 R2 SP1 Hyper-V

On Hyper-V hosts:

Use Generation 2 virtual machines on Windows Server 2012 or later Hyper-V.
Do not use Dynamic Memory.
Use dynamic disks.
Do not use the differencing disks option for the data disk.
Resizing the disks is not allowed and will lead to data corruption.

On ESXi hosts:

Use virtual machine versions 8 through 11.
Thin provisioning should be used for the data disk.
Resizing the disks is not allowed and will lead to data corruption.

Note that time synchronization for the virtual machine via the VMware Tools or Hyper-V integration services should be enabled.

Sizing the Data Disk

The virtual appliance data disk is where all hot data is stored. This disk must be sized appropriately between 500GiB and 8TiB. This is x1024 instead of 1000. The size of the data disk will directly control how much local plus cloud or total storage can be provisioned in the appliance. Local storage is used as follows:

Approximately 12 percent of the local disk is reserved for each volume (iSCSI) or share (file server).
Roughly 10 percent is also reserved for locally pinned volumes.
Around 15 percent of the local disk is reserved for snapshots.
If you are going to restore from a cloud snapshot, then there should be free space on the local disk. It needs to be at least the size of the local tier of the largest volume. See the first bullet point for more information.
You should try to leave some free space for unexpected growth.

The screenshot below is from Excel. I have calculated the local disk requirements. I used the above requirements for a virtual device hosting 3 shares of 5TiB, 5TiB, and 10TiB.

Calculating the Local Data Disk Requirements of a StorSimple Virtual Appliance [Image Credit: Aidan Finn]

Group Policy

Your virtual appliance can join an Active Directory domain, which is useful for permissible shares. However, it is recommended that the virtual appliance is isolated from group policy. Your policies may have a harmful effect on the function and performance of the storage system. Microsoft recommends:

Place the virtual appliance into its own organizational unit (OU).
Block inheritance on the OU to prevent GPOs from being accidentally applied.

Anti-Virus

When is the last time that you installed anti-virus on your SAN controller? Microsoft also states that anti-virus can adversely affect the operation of the virtual appliance. For example, a scheduled scan of data in the cold tier will be extremely slow. It also might incur unexpected access costs when using blob storage accounts.

This is one of those blanket statements from so-called security experts. They will say, “All Windows machines must have anti-virus and must scan everything.” This can lead to people being fired.

Sponsored

Networking

StorSimple is a cloud-connected solution. This means that Internet bandwidth is going to be important. The nature of your data and access is what determines your true bandwidth requirements. We are told that we should have 5Mbps or more of dedicated, reliable, and persistent bandwidth per appliance.

The amount available impacts how quickly Azure can backup your StorSimple volumes or shares. If you have 18GB of data change in a day, 5Mbps of bandwidth allows a backup to complete in 8 hours.

Any appliance configured as an iSCSI device should have:

A static IP address configuration — not DHCP
A primary and secondary DNS server for local name resolution

If you require multiple NICs for dedicated iSCSI networking, then note that only the first interface, called Ethernet, can reach the cloud. Other NICs should be bound to other networks. This is the same as VLANs or virtual networks.

Do not throttle bandwidth on the hypervisor because this throttles LAN and Internet access. This would be bad for hot data access. Instead, implement traffic shaping for the appliance on the physical network, which includes switches, firewalls, routers, etc. This will help to control bandwidth usage to the cloud for cold data.

Storage Accounts

You can use an automatically created storage account with a virtual appliance. You could also use a manually created one in either the same subscription or another subscription.

A virtual appliance can connect to one storage account but many virtual appliances can connect to a single storage account. When doing the latter, understand that:

The maximum capacity of a virtual appliance is 64TB.
The maximum size of a storage account is 500TB.

That means you can get 7x the fully assigned virtual appliances per storage account.

Regarding the storage account creation:

Place the storage account in the region with the lowest latency to the virtual appliance. Try using the customer site.
You cannot move a storage account between regions.
LRS, GRS, and ZRS are all supported forms of resiliency for StorSimple.
You can choose blob storage accounts, which supports hot or cool blobs. You can also choose general storage account, which supports ZRS.

Volumes and Shares

When planning iSCSI volumes or file server/NAS shares, Microsoft offers a number of best practices:

You can have a maximum of 16 volumes/shares per array. Remember that a share/volume can have permissible subfolders. You can still scale out beyond this apparent limit.
A volume cannot be expanded to size for future growth and the volume cannot be shrunk, either.
The file size is relative to the share size. It can impact the performance of tiering to the cloud. Relatively large files, compared to the share size, tier out more slowly. Microsoft recommends that the largest file is no more than 3 percent the size of the share size.
Volumes that will contain large files of archive data should have the Less Frequently Used Archive Data option enabled. Deduplication is done at 512KB, which is a larger block size than normal. This will speed up the transfer of data to the cloud.
You can perform quick formats.
You can format the volume with an allocation unit size of 64KB.
Do not enable Data Deduplication on any servers connecting to the StorSimple virtual appliance. The appliance will handle data compression and deduplication.

When using StorSimple for iSCSI:

Do not scan volumes or dynamic disks because this is not supported by StorSimple.
Always create at least 1 access control record (ACR) per volume.
Only add multiple ACRS for nodes in a cluster that will share a volume.

When deploying shares in StorSimple:

Configure the default share administrator as a user group instead of a user account.
Use normal Windows share administration tools from your PC to manage the share/permissions after it is created.

Sponsored

Data Security and Encryption

When you enable security features to protect the data on your StorSimple, you should follow the below guidance:

Create an AES-256 cloud-storage encryption key before sending data to the cloud.
Keep a copy of the cloud-storage encryption key somewhere safe, such as Azure Key Vault.
Enable SSL mode when adding storage account credentials to the storage account. This will ensure secure data transfer between the appliance and the cloud.
Whenever administrators change, you should regenerate the storage account keys.

The post Best Practices for Deploying StorSimple Virtual Arrays appeared first on Petri.

Posted on April 28 in category News

Tags: Technology

Scaleway thinks the future of cloud hosting is ARM-based servers

The content below is taken from the original (Scaleway thinks the future of cloud hosting is ARM-based servers), to continue reading please visit the site. Remember to respect the Author & Copyright.

Iliad’s cloud hosting division Scaleway is launching a new type of server today. In just a minute, you can launch your server with its own dedicated ARMv8 processor, 2GB of RAM, 50GB of SSD storage and unlimited bandwidth. And it only costs around $3.25 per month (€2.99).

If you’re not familiar with processor atchitecture, your computer and your smartphone use two different chipsets. Your laptop uses an x86 CPU manufactured by Intel or AMD, while your smartphone uses an ARM-based system-on-a-chip.

ARM-based devices don’t need a lot of cooling and are quite efficient when it comes to power usage. And they are also becoming increasingly powerful. That’s why it’s a smart bet to use those chips for servers.

In many ways, using Scaleway as your cloud hosting provider feels like using DigitalOcean, Linode or any typical VPS provider. But there’s a big difference as Scaleway provides BareMetal servers (and a few virtual server options as well).

For the past few years, the main trend in cloud computing is that you don’t rent actual physical servers if you don’t have insane needs. Cloud hosting companies run multiple virtual servers on the same physical server, and you can rent those virtual servers.

By splitting up servers into tiny chunks and pooling resources, it has become much more flexible for developers. For instance, you can create a virtual server, install a VPN on it while you travel to China and destroy your server a few days later. You’ll only get billed for the hours of usage, making it much more flexible than signing up for servers with a 30-day commitment.

Similarly, if you face big spikes of new users and traffic, you’ll be able to adjust your server infrastructure in no time. I’ve been using Scaleway for my weekend projects and it works well.

Scaleway wants the best of both worlds — the reliability of physical servers with the flexibility of virtual private servers. So it means that you can create a server in just a few seconds, assign an IP address, load up an image and attach SSD storage to it.

But you’re also the only one using your ARMv8 cores. You won’t get any performance surprise as you don’t share your CPU raw power with your server neighbor — you don’t have a neighbor.

Scaleway’s systems-on-a-chip are provided by Cavium ThunderX. For €2.99 per month, you get 2 ARMv8 cores and 2GB of RAM. You can also choose 4 cores with 4GB of RAM or 8 cores with 8GB of RAM for €5.99 and €11.99 respectively. Scaleway already had ARMv7 servers, so this is a major update of these options.

Scaleway is launching its new ARM-based servers in its French data center first with Amsterdam following course in a few days. I hope the company is also planning to launch new data centers in the U.S. and Asia to make it more compelling for users outside of Europe.

Posted on April 28 in category News

Tags: Technology

advanced-renamer (3.77)

The content below is taken from the original (advanced-renamer (3.77)), to continue reading please visit the site. Remember to respect the Author & Copyright.

Advanced Renamer is a free program for renaming multiple files and folders at once. By configuring renaming methods the names can be manipulated in various ways.

Posted on April 28 in category News

Tags: Technology

pibakery (0.3.4)

The content below is taken from the original (pibakery (0.3.4)), to continue reading please visit the site. Remember to respect the Author & Copyright.

The easiest way to setup a Raspberry Pi

Posted on April 28 in category News

Tags: Technology

File Interface to AWS Storage Gateway

The content below is taken from the original (File Interface to AWS Storage Gateway), to continue reading please visit the site. Remember to respect the Author & Copyright.

I should probably have a blog category for “catching up from AWS re:Invent!” Last November we made a really important addition to the AWS Storage Gateway that I was too busy to research and write about at the time.

As a reminder, the Storage Gateway is a multi-protocol storage appliance that fits in between your existing applications and the AWS Cloud. Your applications and your client operating systems see the gateway as (depending on the configuration), a file server, a local disk volume, or a virtual tape library (VTL). Behind the scenes, the gateway uses Amazon Simple Storage Service (S3) for cost-effective, durable, and secure storage. Storage Gateway caches data locally and uses bandwidth management to optimize data transfers.

Storage Gateway is delivered as a self-contained virtual appliance that is easy to install, configure, and run (read the Storage Gateway User Guide to learn more). It allows you to take advantage of the scale, durability, and cost benefits of cloud storage from your existing environment. It reduces the process of moving existing files and directories into S3 to a simple drag and drop (or a CLI-based copy).

As is the case with many AWS services, the Storage Gateway has gained many features since we first launched it in 2012 (The AWS Storage Gateway – Integrate Your Existing On-Premises Applications with AWS Cloud Storage). At launch, the Storage Gateway allowed you to create storage volumes and to attach them as iSCSI devices, with options to store either the entire volume or a cache of the most frequently accessed data in the gateway, all backed by S3. Later, we added support for Virtual Tape Libraries (Create a Virtual Tape Library Using the AWS Storage Gateway). Earlier this year we added read-only file shares, user permission squashing, and scanning for added and removed objects.

New File Interface
At AWS re:Invent we launched a third option, and that’s what I’d like to tell you about today. You can now use the Storage Gateway as a virtual file server that you can mount on your on-premises servers and desktops. After you set it up in your data center or in the cloud, your configured buckets will be available as NFS mount points. Your application simply reads and writes files and directories over NFS; behind the scenes, the gateway turns these operations into object-level requests on your S3 buckets, where they are accessible natively (one S3 object per file). To create a file gateway, you simply visit the Storage Gateway Console, click on Get started, and choose File gateway:

Then choose your host platform: VMware ESXi or Amazon EC2:

I expect many of our customers to host the Storage Gateway on premises and to use it as a permanent or temporary bridge to the cloud. Use cases for this option include simplified backups, migration, archiving, analytics, storage tiering, and compute-intensive cloud-based processing. Once the data is in the cloud, you can take advantage of many features of S3 including multiple storage tiers (Infrequent Access and Glacier are great for archiving), storage analytics, tagging, and the like.

I don’t have much data on-premises so I’m going to run the Storage Gateway on an EC2 instance for this post. I launched the instance and set it up per the instructions on the screen, taking care to create the proper inbound security group rules (port 80 for HTTP access and port 2049 for NFS). I added 150 GiB of General Purpose SSD storage to be used as a cache:

After the instance launched I captured its public IP address and used it to connect to my newly launched gateway:

I set the time zone and assigned a name to my gateway and clicked on Activate gateway:

Then I configured the local storage as a cache, and clicked on Save and continue:

My gateway was up and running, and I could see it in the console:

Next, I clicked on Create file share to create an NFS share and associate it with an S3 bucket:

As you can see, I had the opportunity to choose my storage class (Standard or Standard – Infrequent Access in accord with my needs and my use case). The gateway needs to be able to upload files into my bucket; clicking on Create a new IAM role will create a role and a policy (read Granting Access to an Amazon S3 Destination to learn more).

I review my settings and click on Create file share:

By the way, Root squash is a feature of the AWS Storage Gateway, not a vegetable. When enabled (as it is by default) files that arrive as owned by root (user id 0) are mapped to user id 65534 (traditionally known as nobody). I can also set up default permissions for new files and new directories.

My new share is visible in the console, and available for use within seconds:

The console displays the appropriate mount commands for Linux, Microsoft Windows, and macOS. Those commands use the private IP address of the instance; in many cases you will want to use the public address instead (needless to say, you should exercise extreme care when you create a public NFS share, and maintain close control over the IP addresses that are allowed to connect).

I flipped over to the S3 console and inspected the bucket (jbarr-gw-1), finding it empty, as expected:

Then I turned to my EC2 instance, mounted the share, and copied some files to it:

I returned to the console and found a new folder (jeff_code) in my bucket, as expected. I ventured inside and found the files that I had copied to the share:

As you can see, my files are copied directly into S3 and are simply regular S3 objects. This means that I can use my existing S3 tools, code, and analytics to process them. For example:

Analytics – The new S3 metrics and analytics can be used to analyze the entire bucket or any directory tree within it:
Code – AWS Lambda and Amazon Rekognition can be used to process uploaded images; see Serverless Photo Recognition for some ideas and some code. I could also use Amazon Elasticsearch Service to index some or all of the files or Amazon EMR to process massive amounts of data.
Tools – I can process the existing objects in the bucket and I can also create new ones using the the S3 APIs. Any code or script that creates or removes should call the RefreshCache function to synchronize the contents of any gateways attached to the bucket (I can create a multi-site data distribution workflow by pointing multiple read-only gateways at the same bucket). I can also make use of existing, file-centric backup tools by using the share as the destination for my backups.

The gateway stores all of the file metadata (owner, group, permissions, and so forth) as S3 metadata:

Storage Gateway Resources
Here are some resources that will help you to learn more about the Storage Gateway:

Presentation – Deep Dive on the AWS Storage Gateway:

White Paper – File Gateway for Hybrid Architectures – Overview and Best Practices:

Recent Videos:

Available Now
This cool AWS feature has been available since last November!

— Jeff;

Posted on April 28 in category News

Tags: Technology

Super-secure Pi-stuffed nomx email server box given a good probing

The content below is taken from the original (Super-secure Pi-stuffed nomx email server box given a good probing), to continue reading please visit the site. Remember to respect the Author & Copyright.

Super-secure Pi-stuffed nomx email server box given a good probing • The Register

Security researchers claim to have uncovered a variety of serious security holes in a heavily touted secure email server technology. Nomx, the firm behind the device, strongly disputes the claims and has challenged researchers to a hacking challenge, involving the creation of an email account on a designated remotely hosted nomx device.

Nomx launched its email server hardware at the CES trade show in Las Vegas back in January. Its marketing trumpets that “nomx ensures absolute privacy for personal and commercial email and messaging” adding, “Everything else is insecure”.

After an inspection of the hardware, researcher Scott Helme claimed he had quickly uncovered all sorts of shortcomings.

The device is running standard mail server software on a Raspberry Pi, most of which is outdated, claimed Helme. Worse yet, nomx’s web interface presents a serious CSRF (Cross-Site Request Forgery) vulnerability, he alleged. In addition, the device can’t receive updates, a basic security requirement, he said. These and other flaws are detailed in a long blog post (complete with screenshots and other details) here.

“They make some very bold claims but the device is awful,” Helme told El Reg. “I have a full remote compromise.

“There are three different ways to exploit the CSRF, all of which they claim to have patched but [they] haven’t made a patch available to me.”

The range of potential exploits on the device is extensive, according to Helme.

“I can read your emails, delete your emails, send emails, [or] create my own email address on your device to log in and use,” he said.

Will Donaldson of nomx strongly disputed all of this, claiming that Helme is trying to discredit nomx – which Helme denies. Donaldson said that nomx had addressed the CSRF issue highlighted by Helme, the impact of which he also disputed.

“The CSRF vulnerability he disclosed, if present on any nomx device, could potentially have allowed access if the users were on the management page of the nomx device and visited a hacked page or malware site,” Donaldson told El Reg in a lengthy email. “With routine email use, it did not have any relevance and could not occur unless the management page was accessed while simultaneously going to a third party website.”

He added: “We’ve resolved that issue with any of our users who could have been affected and no longer provide that version of nomx.”

Helme responded: “They claim to have resolved the CSRF issue but haven’t provided me with the update or details on how they did it. I can’t see any update mechanism or feature on the device.”

Professor Alan Woodward, who worked with Helme in analysing the device as part of an investigation initialised by BBC consumer tech branch Click, told El Reg: “The only part that could be considered ‘different’ to normal email servers is the box-to-box communication. However, as far as I can tell this uses a standard part of Postfix: transport tables.

“I had assumed initially that there was going to be some new protocol with out-of-band comms for key exchange or similar. But it’s just an email server using TLS with locally held IP addresses for where to send specify email traffic,” he claimed.

What’s in a name?

The name nomx (no mail exchange) was chosen for the kit because it is designed to skip vulnerable third-party mail exchange servers.

Donaldson offered a description of nomx’s design aims. “Our primary goal is keeping messages off vulnerable third-party servers. We do that by forcing emails to go through certain routes on the internet instead of using traditional email relays that copy these messages and are vulnerable to a host of issues.

“Scott [Helme] has attempted to discredit nomx by stating that is simply ‘Postfix on a Pi’. That doesn’t actually represent nomx – which provides a series of services and protocols that when used together resolve the vulnerabilities of the third party servers.”

The number of nomx accounts that have been compromised since inception is nil, according to Donaldson.

Professor Woodward said the security questions around nomx raise a wider point about whether potential buyers can trust promises made by security vendors in general.

“My concern is that users may take much of what is claimed at face value – it is a classic example of how ‘security’ is unregulated and that the main group holding vendors to account are ethical hackers,” he said. ®

Posted on April 28 in category News

Tags: Technology

A Quick Way to Tell If That Thing on Your To-Do List Is Actually Important

The content below is taken from the original (A Quick Way to Tell If That Thing on Your To-Do List Is Actually Important), to continue reading please visit the site. Remember to respect the Author & Copyright.

With unlimited access to productivity doodads, apps, and planners, knowing our priorities is supposed to be effortless. But what if everything you need to do that day—finish an article, work on that presentation outline, work out, and so on—all feel like a priority?

I once heard on the Tim Ferriss podcast that, when it comes to each item on his to-do list, Ferriss asks himself: “If this were the only thing I accomplished today, would I be satisfied with my day?” If he answers yes, then that’s what he prioritizes.

In our day to day, it can be hard to focus on the truly important things when everything seems…Read more Read more

At the time, I didn’t think much of it. While drowning in a sea of urgent and important tasks—which I often conflated—I was reintroduced to this idea by my highly productive and accomplished friend, who told me about a planner from Intelligent Change (who are also behind the Five-Minute Journal that I use and love).

Well, I bought this planner, and it’s since helped me take much better control of my to-do list. It’s not because I have a nicely organized to-do list, but it’s because the planner has forced me to take a “less is more” approach. I have enough room to write down only five things I need to do that day and only one can be the Most Important Task of the Day, which is guided by the prompt:

If this was the only thing you did today you’d be satisfied.

This has challenged me to ponder whether the thing I thought was super important really was that important; or whether it was merely a distraction from the actual thing that I should be working on. As Intelligent Change points out in their notebook, important work is often the stuff that you tend to procrastinate and makes you feel uncomfortable doing.

You don’t have to go out and buy a planner specifically for this purpose, but to help identify important work you should ask yourself, as Ferriss does, if that one item will make you satisfied with your day:

Will moving this forward make all the other to-do’s unimportant or easier to knock off later?

Since approaching my important tasks this way, I feel a lot less anxiety around all the work I feel like I have to get to and can shove away the clutter to focus on the truly important things that move the needle for me.

Posted on April 28 in category News

Tags: Geeky

Tetris is a Perfect Video Game

The content below is taken from the original (Tetris is a Perfect Video Game), to continue reading please visit the site. Remember to respect the Author & Copyright.

Originally released in Japan like three years ago, the falling block/blob puzzle mash-up Puyo Puyo Tetris finally arrives on Nintendo Switch and PlayStation 4 this week in English. I’ve been playing the Switch version (it’s not Zelda) and having a great time. But while the appeal for most is seeing how well these two classic puzzle formulas go together, to me it’s just a reminder that Alexey Pajitnov’s Tetris may be the only perfect video game.

Tetris isn’t my favorite video game by any means. It’s not the Citizen Kane of video games exploding the medium’s potential wide open like Super Mario Bros. And it’s not the intellectual equal of chess like StarCraft. However, it is perfect. It effortlessly draws the player into a zen state of pure play where they stop thinking consciously about the falling blocks and just start matching them through sheer instinct and reaction. It’s beautiful. Just watch pro players in action as they match without even seeing the blocks.

It’s simple, but it’s also anything but. The variety of tetrominoes, derived from all possible ways to arrange four blocks in two dimensions, means players must constantly and quickly evaluate the strength and weakness of each block in each position before making a move. There’s a reason why the long piece might be the biggest hero in gaming. Since 1984 we’ve proven with science that while it is theoretically possible to play Tetris forever, it would take very specific conditions and a tremendous amount of skill.

Tetris ultimate

By being more complex, other games open themselves up to unforeseen flaws that mar their perfection. You can’t make a game as big and bustling as Grand Theft Auto V without some open-world jank. However, by that definition, most puzzle games should be this excellent. And yet, in my opinion, decades later still none of have dethroned Tetris. They add intriguing new features like RPG elements or in-app purchases or whole other puzzle formulas, but that just makes them different, not better. Even Pajitnov’s later games like Hexic and Tetrisphere don’t compare. Tetris remains a flawless diamond of a video game with the only close runners-up being Bejeweled and more recently Threes (screw 2048).

Even the multiplayer is brilliant. It’s one thing to try and survive against faster-falling pieces but having to form as many Tetris chains as possible to attack your opponent adds a new, incredible layer of strategy and tension. And while getting hit with garbage blocks threatens your run, they also provide their own opportunities for chains and turning the tables on your foe. It’s great!

Tetris is proof of the purity of form and mechanics that can make a game excellent with no story whatsoever. However, it’s also important to mention the history and metanarrative behind the game since no art is without politics. I find Tetris so fascinating as a piece of Russian entertainment that blew up right around the time of the Soviet Union’s collapse and became a hugely successful worldwide product.

But even as Western capitalist pigs enjoyed the game on the go thanks to their fancy new Game Boys from the 1980s Japanese economic menace the game never hid its Russian roots. From its classic theme to its box quote of “From Russia With Fun!” to its Kremlin-like background buildings, Tetris is so Russian it’s controlling the current U.S. government.

And beyond aesthetics, the idea of matching differently shaped blocks to create solid wholes and win is the kind of casual, elegant, metaphorical endorsement for communism that defines the best Russian Constructivist art of the 1910s. It’s like Vladimir Tatlin made a video game. Is Tetris’ perfection obvious now?

Suffice it to say, most of my time playing Puyo Puyo Tetris has been spent in regular-ass Tetris mode. But the game does have other modes worth exploring. Puyo Puyo, for those that don’t know the beloved Japanese series, is a match-4 puzzle game about combining colorful blobs that fall apart and stick back together. The goal is the clear them while also setting off stylish chains. In America, the formula was re-purposed in games like Dr. Robotnik’s Mean Bean Machine and Kirby’s Avalanche. It’s neat, even if it took me playing some in-game lessons to stop being trash, but it’s no Tetris.

If you want to get really fancy, though, you can play the various weird Tetris/Puyo Puyo combinations. One has you playing Tetris for a few seconds and then switching to Puyo Puyo before switching back to Tetris. It splits your brain in an enjoyably stressful way. Even crazier is the mode where Tetris blocks and Puyo Puyo blobs both fall down on the same board keeping their unique attributes. For example, tetrominoes crush Puyos but Puyos fall through crevices tetrominoes leave behind. Players explore the possibilities of this fusion across a surprising amount of varied single- and multi-player modes.

The insane, voice-acted story mode gets most of its mileage from this crazy anime crossover nonsense. Merging worlds. Anthropomorphized blocks. It’s like Street Fighter x Tekken but a puzzle game, and much like Super Bomberman R, who knew Puyo Puyo and/or Tetris had this much lore?

For American Puyo Puyo fans, Puyo Puyo Tetris is a clean and cool glass of water in a desert. Tetris fans aren’t quite as thirsty, but in a world where Ubisoft is making new versions of Tetris with bad framerates some how, this is still an excellent option. It’s not like you can go buy Tetris DS anymore. But no matter how much you dress it up or down, nothing will change the fact that Tetris and Tetris alone is truly a perfect video game. I sure hope that movie works out.

Want to learn more? Here’s everything you need to know about the Nintendo Switch.

Buy it now!

The Legend of Zelda: Breath of the W ind
Nintendo Switch
Essential Nintendo Switch Accessories

Posted on April 28 in category News

Tags: Geeky

Cloudflare’s incredible solution for IoT security: Use our services

The content below is taken from the original (Cloudflare’s incredible solution for IoT security: Use our services), to continue reading please visit the site. Remember to respect the Author & Copyright.

Cloudflare's incredible solution for IoT security: Use our services • The Register

Traffic bouncer Cloudflare has outlined what it claims is the solution to the perennial internet-of-things security problem: pay it.

The company points out what most security experts have been saying for some time: IoT devices are a security disaster, they are going to grow exponentially, and when people can’t even be relied on to update their browsers, having billions of unpatched internet-connected devices is a disaster waiting to happen.

And so Cloudflare has come up with its solution: route everything through us.

This does not come as a huge surprise. The company does tend to offer the same solution to every online problem: Distributed denial of service (DDoS) attack? Route your traffic through us. Man-in-the-middle attack? Pay us to deal with your data. Too many spam comments? We have a paid service for that. Need encryption? Guess what?

But that doesn’t mean that the company’s new Orbit service is a bad idea. In fact, it may very well be a good or even great idea given the state of the current system for securing online devices.

The basic idea is quite simple: in the same way website owners pay Cloudflare to sit in between them and their visitors, IoT manufacturers will pay for the Orbit service to sit between their devices and the public internet.

The manufacturers will configure their devices to only go through Orbit, which gives them (or, most accurately, Cloudflare) the ability to not only shield tech-ignorant consumers from hacking efforts, but also apply virtual security patches across all of its devices at once.

Open-ish

Although this is far from ideal since it introduces a proprietary layer to the open internet, the reality is that it could be a lifesaver for IoT companies, which have persistently shown themselves incapable of carrying out decent security audits on their products and continue to make basic errors, like hard-coding passwords.

And, to be fair to Cloudflare, the company has shown itself to be very capable of handling huge amounts of traffic without lag or collapse.

The million-dollar-question of course is: how much does it cost? Cloudflare told us that the fee was based on the number of devices and the bandwidth required but wouldn’t provide an exact figure.

If the cost is $10 a year per device and an IoT company can offer the extra security as part of a premium package – alongside cloud recording or similar – then it is probably a great deal.

But if the idea is that it will be supplied for free to customers who buy the product and don’t sign up to an ongoing service fee, then the price is going to have to be much, much lower for there to be any kind of significant take-up.

Of course, the biggest security risk comes from companies offering low-price IoT items that don’t require ongoing fees. So while Cloudflare’s new service may help improve mid- to high-end IoT products’ security, the huge risks from the low-end are unlikely go away. So expect plenty more DDoS attacks from zombie webcams.

And then there is the fact that if lots of IoT manufacturers chose to use this service, it would make Cloudflare a single point-of-failure and hence a huge target for hackers. And Cloudflare, like any company using software, is not immune to bugs. Bugs that can provide an enormous wealth of information.

Oh please god no, not another one

One thing we do have to pick on Cloudflare for, however: in the official notice of the new service, the company notes that it is “introducing the industry’s first IoT alliance – made up of a group of IoT companies and experts in the field – that will be committed to forming best practices and standards for protecting connected devices and ensuring the resilience of the Internet of Things.”

Far from this being the “industry’s first IoT alliance,” this effort will only add yet more overhead and confusion to a massively overpopulated world of internet-of-things alliances, consortiums, organizations, groups, working groups, feuding government departments, security experts pushing for laws, legislators and consumer agencies pretending not to hear, and god knows what else.

Below is a partial list of the people working on IoT security and best practices. We wonder why on earth Cloudflare thinks it’s a good idea to add yet another one to the list. ®

That barren landscape of Internet of Things standards bodies

Posted on April 28 in category News

Tags: Technology

OpenSSL.Light (1.1.0.40000000)

The content below is taken from the original (OpenSSL.Light (1.1.0.40000000)), to continue reading please visit the site. Remember to respect the Author & Copyright.

Open Source SSL v2/v3 and TLS v1 toolkit

Posted on April 28 in category News

Tags: Technology

To Deal with Plastic Trash, All You Need is Bugs

The content below is taken from the original (To Deal with Plastic Trash, All You Need is Bugs), to continue reading please visit the site. Remember to respect the Author & Copyright.

Outlawed now in some places, or only available to tote your purchases at a ridiculous premium, the billions of “T-shirt” bags used every year present a serious waste management problem. Whether blowing across the landscape like synthetic tumbleweeds, floating in the ocean as ersatz jellyfish, or clogging up municipal waste streams, finding a way to deal with them could really make a difference. And finding a bug that eats polyethylene and poops antifreeze might be a great first step in bioremediating the mess.

As with many scientific discoveries, learning about the useful and unexpected eating habits of the larval stage of the Greater Wax Moth Galleria mellonella can be chalked up to serendipity. It began when biochemist [Federica Bertocchini] cleaned a wax moth infestation from her beehive. She put the beeswax-loving pests in a plastic bag, later finding they had chewed their way out. Intrigued, she and [Paolo Bombelli] ran some experiments using the bugs. They showed the mechanism wasn’t just mechanical and that the worms were digesting the polyethylene, to the tune of 92 mg consumed for 100 worms in 12 hours. That’s about 1,000 times faster than bioremediation with bacteria.

Furthermore, the bugs excrete ethylene glycol, a useful industrial chemical, in the process. Finally, to see if the process can scale, the researchers showed that a homogenate of wax moth larvae could digest PE sheets. This could lead to an industrial process if the enzymes involved can be isolated and engineered. The letter describing the process is a fascinating read.

While this one may not a classically hackish way to deal with plastic recycling, the potential for this method is huge. We look forward to seeing where this goes.

[Images: César Hernández/CSIC]

Filed under: chemistry hacks, green hacks

Posted on April 28 in category News

Tags: RISC

IGEL Adds Support for Industry-Leading VDI Protocols to IGEL IZ Series Zero Clients

The content below is taken from the original (IGEL Adds Support for Industry-Leading VDI Protocols to IGEL IZ Series Zero Clients), to continue reading please visit the site. Remember to respect the Author & Copyright.

IGEL, a world leader in endpoint management software for the secure enterprise, today announced that it has enhanced the IGEL OS, adding support for the VMware Horizon 4.4 client to its IGEL Zero client IZ2 and IZ3 series hardware. With this announcement, IGEL becomes the industry’s only vendor to integrate the VMware Blast Extreme Protocol on zero client hardware.

“IGEL is committed to helping our channel partners and their customers improve the efficiency and agility of their modern end-user computing environments,” said Simon Clephan, Vice President of Business Development and Strategic Alliances, IGEL. “By adding support for the VMware Horizon 4.4 client and integrating the VMware Blast Extreme Protocol into our zero client hardware, we are able to support an exceptional user experience, while at the same time providing IT organizations with industry-leading manageability and flexibility through the delivery of a true zero client.”

“Zero Touch” Deployment and VDI Optimization Means Zero Compromise

With IGEL’s IZ Series zero clients, IT organizations benefit from “zero touch” deployment due to rule-based configuration during the roll-out phase of the zero client solutions. IGEL’s ability to support profile-based, automated management of zero client settings once deployed also eliminates the need for local management of the zero clients at remote offices and branch locations.

Furthermore, IT organizations no longer have to compromise between functionality and service. Each IGEL IZ Series zero client can be optimized and configured for the organization’s preferred virtualization protocol, whether it is Citrix HDX, Microsoft RDP/Remote FX or VMware Horizon. Using appliance mode, the IGEL IZ Series boots quickly and directly to their virtual session without intervention from IT.

IGEL-IZ2-ZeroClient

Industry-Standard Approach Results in Multimedia-Rich User Experience

The integration of the VMware Blast Extreme Protocol, VMware’s next-generation display protocol that leverages industry-standard H.264 video compression, also means that mobile and remote workers gain uncompromised access to their centrally hosted desktops and multimedia-rich applications via their IGEL OS-powered endpoints.

Key capabilities available through IGEL’s VMware Certified IZ Series endpoints include:

Endpoint hardware-based acceleration for H.264 capable devices
Lossless CODECs that enable images to be compressed/decompressed without a loss in quality
Support for virtual channels

Upgradeable and Future-Proof to Preserve Hardware Investment

IGEL IZ Series zero clients are a cost-effective endpoint solution for organizations of all sizes and require only a one-time, non-recurring hardware investment. Each IGEL IZ Series zero client comes with a license that includes regular and frequent firmware updates to enable IT organizations to preserve their hardware investment while taking advantage of new features and functionality that become available.

The IGEL IZ Series zero clients also come pre-configured to support one industry-standard virtualization protocol per device. Customers can choose from Citrix HDX, Microsoft RDP/Remote FX or VMware Horizon and benefit from the IGEL OS 10’s rich feature set. Through licensing upgrades, organizations can add or re-configure supported virtualization protocols, leveraging the IGEL Universal Management Suite (UMS) to quickly transition between protocols, and make changes for their entire network of zero clients, a group of thin clients, or a specific endpoint. The UMS also enables IT organizations to add and remove endpoint devices, and perform software upgrades as needed or required, to provide the latest available protocol features.

Availability and Support

The IGEL IZ Series zero clients are available in North America through IGEL’s network of IGEL Platinum partners, Authorized IGEL Partners (AIPs) and resellers. Each IGEL IZ Series zero client comes standard with a free three-year hardware warranty.

To experience the capabilities of IGEL OS 10, download the IGEL Universal Desktop Converter (UDC) and IGEL UMS, request a 12-minute demonstration of the IGEL OS or request evaluation hardware visit http://bit.ly/2oPbdVb.

Posted on April 27 in category News

Tags: VMware

CompSci boffins find Reddit is ideal source for sarcasm database

The content below is taken from the original (CompSci boffins find Reddit is ideal source for sarcasm database), to continue reading please visit the site. Remember to respect the Author & Copyright.

Over here at El Reg, we think that chatbots are, like, the best thing ever.

Not.

But would they be any better if they could detect sarcasm and retaliate with their own snide remarks?

A group of computer scientists from Princeton University, USA, certainly think so. Mikhail Khodak, Nikunj Saunshi and Kiran Vodrahalli, all graduate students, have pooled together “a large self-annotated corpus for sarcasm” by trawling through Reddit.

“Since sarcasm often involves humans stating something opposed to their beliefs or wants, it is important for chatbots and intelligent assistants to be able to understand when a person is being sarcastic,” Khodak told The Register.

A paper released on arXiv shows the trio aren’t the first group to collect a bit of internet sass. Other researchers have done it with Twitter. Indeed, IBM last week proclaimed a breakthrough of sorts with a new service that can detect when Twitter users are “frustrated, sad, satisfied, excited, polite, impolite and sympathetic.”

The authors of this paper decided to turn to Reddit, the self-described “front page of the internet” because posts are written more clearly and aren’t restricted by the 140 character limit on Twitter.

Reddit is essentially an online forum that is split into “subreddits” for different topics or themes. Users follow interesting subreddits, and can rate and comment on posts.

Its structure makes it the perfect place to hunt for a bit of sark. Instead of relying on humans to label individual comments as sarcastic or not, geeky users frequently add ‘/s’ to their posts to denote sarcasm (the markup is a nod to a theoretical ‘<sarcasm>…</sarcasm>’ HTML tag. The subreddit feature also allows researchers to sort their data by subject.

Example sarcastic comment in the politics subreddit, marked with ‘/s’.

That markup’s gold for researchers because it means they’ve been able to create a data set of 1.3 million self-described pieces of sarcasm among 500-600 million comments made on Reddit from 2009-2016. Controversial and less moderated subreddits like politics or men’s rights, a thread “for those who wish to discuss men’s rights and the ways said rights are infringed”, contain more sneering statements than games or science.

The goal is to construct a dataset sophisticated enough to follow online conversations and understand the context behind the sarky comments in order to test natural language processing algorithms.

“It is quite difficult for both machines and humans to distinguish sarcasm without context. One of the advantages of our corpus is that we provide the text preceding each statement as well as the author of the statement, so algorithms can see whether it is sarcastic in the context of the conversation or in the context of the author’s past statements,” Khodak explained.

But although context is given, trying to make machines understand it is tricky. “We didn’t provide context to the machine learning algorithms because there is no standard accepted way of doing this,” Khodak added.

So instead, the researchers focused on training some of the simplest existing algorithms to detect sarcasm on single sentences only. In natural language processing, words are often represented as feature vectors in space, using a “support vector machine”, a classifier that sorts labelled data into two different categories – in this case ‘sarcastic’ and ‘not sarcastic’ – by drawing a divide in the space.

Three different word-embedding algorithms were pitted against humans to judge if a remark was acerbic. Some of the models performed better without added context than humans did to the researchers surprise.

But a closer look shows the results are to be taken with a pinch of salt. Humans are obviously better at understanding sarcasm, no machine is complex enough to really understand text and can’t handle the subtleties of satire.

Instead, the algorithms learned by finding patterns between words that were more closely associated with sarcasm such as “clearly” or “totally”. “Common words do seem to provide a strong indication of sarcastic intent,” Khodak admitted.

Oscar Wilde famously said: “Sarcasm is the lowest form of wit”. Although the database might give researchers a better chance at cracking sarcasm, it’ll be a long, long time before machines are smart enough to understand us. ®

Posted on April 24 in category News

Tags: Technology

Flux, a fintech startup founded by ex-Revolut employees, wants to make paper receipts obsolete

The content below is taken from the original (Flux, a fintech startup founded by ex-Revolut employees, wants to make paper receipts obsolete), to continue reading please visit the site. Remember to respect the Author & Copyright.

Flux, a London-based fintech startup founded by three early employees of foreign exchange and banking app Revolut, is on a mission to make store receipts truly digital.

The company, which is de-cloaking this week with a pilot in East London, has built a software platform that bridges the gap between the itemised receipt data captured by a merchant’s point-of-sake (POS) system and what little information typically shows up on your bank statement or mobile banking app.

“Paper receipts are a pain, they are easy to lose, a hassle to keep hold of and a waste of resources. We think it’s insane that today we can go from using 21st Century technology of contactless payments to 100BC tech of paper receipts,” explains co-founder and CEO Matty Cusden-Ross, who was previously Revolut employee number two and the company’s CMO.

“For consumers this [is] about getting rid of paper clutter. That means making receipts easy to find, organised and saving you time across the board which delivers convenience and control. So Flux is on a mission to digitise and organise the world’s receipts”.

Flux is founded by three ex-Revolut employees

To be clear, this isn’t digitising paper receipts with OCR, but — by partnering with merchants, their payment processor/POS systems, and banks — making item level receipts digital in the first place. Flux’s first live integration is with EAT and Bel-Air on the merchant side, and digital-only bank Monzo. But, says the company, even though this is a very tentative first step, the opportunity is huge. That’s because there is a lot of valuable data locked up in receipts that can help merchants better understand who their customers are.

“We are… building a software layer that is agnostic to the financial institution or retailer that it plugs into,” Cusden-Ross says. “We connect retailers via a software plug-in to their point of sale and to the consumer via an integration to their mobile banking app. Flux automagically links receipts to your bank card as you pay. Receipts are stored in the same place your transactions live today, your bank statement. Just open up your bank app and you’ll find all the receipts as well as any loyalty right there, it’s seamless and intuitive”.

The mention of loyalty scheme integration is key to what’s in it for both merchants and consumers. Doing away with stamps and paper coupons saves time for staff who have to process those schemes, whilst putting a merchant’s loyalty scheme at the heart of your existing banking app may well be a much more efficient way of reaching you. Likewise, making it more convenient for you to take part in a loyalty scheme means that you are more likely to remain a loyal customer. This is all enabled by being able to access item-level receipt data linked to your bank card. Just bought your tenth coffee? A push notification will tell you the next one is on the house.

For banks, not only does Flux help to provide new functionality that could be particularly useful for business users who need to file expenses, there is also the potential to significantly reduce chargeback disputes.

Adds Cusden-Ross: “We are getting to the consumer via banks who, particularly in the Open Banking landscape, are looking for ways to increase customer engagement and reduce operational costs. Flux can help on those two things by creating personalised experiences in app and reducing costs of things like low value, high volume chargeback disputes. Those disputes are frequently caused by customers who don’t recognise a transaction in their statement and complain to their bank”.

Meanwhile, Flux isn’t the only fintech going after the item level digital receipt space. Another player is Yocuda, whilst I’m hearing that all-your-cards-in-one app Curve is also eyeing up item level receipts. Undoubtedly, there will be others, thanks in part to recent EU legislation regarding a consumer’s right to access and make portable their personal data.

Posted on April 24 in category News

Tags: Technology

Announcing new Azure Services in the UK

The content below is taken from the original (Announcing new Azure Services in the UK), to continue reading please visit the site. Remember to respect the Author & Copyright.

We’re pleased to announce the following services which are now available in the UK!

HDInsight – HDInsight is a 100% compatible Hadoop service that allows you to easily provision and manage Hadoop clusters for big data processing in Azure.

HDInsight is the only fully-managed cloud Hadoop offering that provides optimized open source analytic clusters for Spark, Hive, MapReduce, HBase, Storm, Kafka, and R Server backed by a 99.9% SLA. Each of these big data technologies and ISV applications are easily deployable as managed clusters with enterprise-level security and monitoring. Learn more about HDInsight.

Azure Import/Export service now also available in UK is the perfect companion service to use with HDInsight – the combination allows you to easily ingest, process and optionally export a limitless amount of data.

Azure Import/Export – Import/Export Service is now live in UK South! The Azure Import/Export Service enables you to move large amounts of on-premises data into and out of your Azure Storage accounts. It does this by enabling you to securely ship hard disk drives directly to our Azure data centers. Once we receive the drives we’ll automatically transfer the data to or from your Azure Storage account. This enables you to import or export massive amounts of data more quickly and cost effectively (and not be constrained by available network bandwidth).

Customers can now use Azure Import/Export Service to copy data to and from Azure Storage by shipping hard disk drives to Azure UK South data center.

For more information about creating import/export jobs see, Use the Microsoft Azure Import/Export Service to transfer data to Blob Storage.

Azure Container Registry – Azure Container Registry is a private registry for hosting container images. Using the Azure Container Registry, customers can store Docker-formatted images for all types of container deployments. Azure Container Registry integrates well with orchestrators hosted in Azure Container Service, including Docker Swarm, DC/OS and Kubernetes. Users can benefit from using familiar tooling capable of working with the open source Docker Registry v2.

Customers can now create one or more container registries in their Azure subscription. Each registry is backed by a standard Azure storage account in the same location. Take advantage of local, network-close storage of your container images by creating a registry in the same Azure location as your deployments. Learn more about Azure Container Registry.

We are excited about these additions, and invite customers using the UK Azure region to try them today!

Posted on April 24 in category News

Tags: Technology

How Azure Security Center detects a Bitcoin mining attack

The content below is taken from the original (How Azure Security Center detects a Bitcoin mining attack), to continue reading please visit the site. Remember to respect the Author & Copyright.

Azure Security Center helps customers deal with myriads of threats using advanced analytics backed by global threat intelligence. In addition, a team of security researchers often work directly with customers to gain insight into security incidents affecting Microsoft Azure customers, with the goal of constantly improving Security Center detection and alerting capabilities.

In the previous blog post "How Azure Security Center helps reveal a Cyberattack", security researchers detailed the stages of one real-world attack campaign that began with a brute force attack detected by Security Center and the steps taken to investigate and remediate the attack. In this post, we’ll focus on an Azure Security Center detection that led researchers to discover a ring of mining activity, which made use of a well-known bitcoin mining algorithm named Cryptonight.

Before we get into the details, let’s quickly explain some terms that you’ll see throughout this blog. “Bitcoin Miners” are a special class of software that use mining algorithms to generate or “mine” bitcoins, which are a form of digital currency. Mining software is often flagged as malicious because it hijacks system hardware resources like the Central Processing Unit (CPU) or Graphics Processing Unit (GPU) as well as network bandwidth of an affected host. Cryptonight is one such mining algorithm which relies specifically on the host’s CPU. In our investigations, we’ve seen bitcoin miners installed through a variety of techniques including malicious downloads, emails with malicious links, attachments downloaded by already-installed malware, peer to peer file sharing networks, and through cracked installers/bundlers.

Initial Azure Security Center alert details

Our initial investigation started when Azure Security Center detected suspicious process execution and created an alert like the one below. The alert provided details such as date and time of the detected activity, affected resources, subscription information, and included a link to a detailed report about hacker tools like the one detected in this case.

We began a deeper investigation, which revealed the initial compromise was through a suspicious download that got detected as “HackTool: Win32/Keygen". We suspect one of the administrators on the box was trying to download tools that are usually used to patch or "crack" some software keys. Malware is frequently installed along with these tools allowing attackers a backdoor and access to the box.

Based on our log analysis, the attack began with the creation of a user account named “*server$”.
The “*server$” account then created a scheduled task called "ngm”. This task launched a batch script named "kit.bat” located in the "C:\Windows\Temp\ngmtx" folder.
We then observed process named "servies.exe“ being launched with cryptonight related parameters.
Note: The ‘bond007.01’ represents the bitcoin user’s account behind this activity and ‘x’ represents the password.

Two days later we observed the same activity with different file names. In the screenshot below, sst.bat has now replaced kit.bat and mstdc.exe has replaced servies.exe . This same cycle of batch file and process execution was observed periodically.

These .bat scripts appear to be used for making connections to the crypto net pool (XCN or Shark coin) and launched by a scheduled task that restarts these connections approximately every hour.

Additional Observation: The downloaded executables used for connecting to the bitcoin service and generating the bitcoins are renamed from the original, 32.exe or 64.exe, to “mstdc.exe” and “servies.exe” respectively. These executable’s naming schemes are based on an old technique used by attackers trying to hide malicious binaries in plain sight. The technique attempts to make files look like legitimate benign-sounding Windows filenames.

Mstdc.exe: “mstdc.exe” looks like “msdtc.exe” which is a legitimate executable on Windows systems, namely Microsoft Distributed Transaction Coordinator required by various applications such as Microsoft Exchange or SQL Server installed in clusters.
Servies.exe: Similarly, “services.exe” is a legitimate Service Control Manager (SCM) is a special system process under the Windows NT family of operating systems, which starts, stops and interacts with Windows service processes. Here again attackers are trying to hide by using similar looking binaries. “Servies.exe” and “services.exe”, they look very similar, don’t they? Great tactic used by attackers.

As we did our timeline log analysis, we noted other activity including wscript.exe using the “VBScript.Encode” to execute ‘test.zip’.

On extraction, it revealed ‘iissstt.dat’ file that was communicating with an IP address in Korea. The ‘mofcomp.exe’ command appears to be registering the file iisstt.dat with WMI. The mofcomp.exe compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository.

Recommended remediation and mitigation steps

The initial compromise was the result of malware installation through cracked installers/bundlers which resulted in complete compromise of the machine. With that, our recommendation was first to rebuild the machine if possible. However, with the understanding that this sometimes cannot be done immediately, we recommend implementing the following remediation steps:

1. Password Policies: Reset passwords for all users of the affected host and ensure password policies meet best practices.

2. Defender Scan: Run a full antimalware scan using Microsoft Antimalware or another solution, which can flag potential malware.

3. Software Update Consideration: Ensure the OS and applications are being kept up to date. Azure Security Center can help you identify virtual machines that are missing critical and security OS updates.

4. OS Vulnerabilities & Version: Align your OS configurations with the recommended rules for the most hardened version of the OS. For example, do not allow passwords to be saved. Update the operating system (OS) version for your Cloud Service to the most recent version available for your OS family. Azure Security Center can help you identify OS configurations that do not align with these recommendations as well as Cloud Services running outdates OS version.

5. Backup: Regular backups are important not only for the software update management platform itself, but also for the servers that will be updated. To ensure that you have a rollback configuration in place in case an update fails, make sure to back up the system regularly.

6. Avoid Usage of Cracked Software: Using cracked software introduces unwanted risk into your home or business by way of malware and other threats that are associated with pirated software. Microsoft highly recommends evading usage of cracked software and following legal software policy as recommended by their respective organization.

More information can be found at:

Educate yourself on software piracy risk.
Learn more by reading “SIRv13: Be careful where you go looking for software and media files”.

7. Email Notification: Finally, configure Azure Security Center to send email notifications when threats like these are detected.

Click on Policy tile in Prevention Section.
On the Security Policy blade, you pick which Subscription you want to configure Email Alerts for.
This brings us to the Security Policy blade. Click on the Email Notifications option to configure email alerting.

An email alert from Azure Security Center will look like the one below.

To learn more about Azure Security Center, see the following:

Azure Security Center detection capabilities — Learn about Azure Security Center’s advanced detection capabilities.
Managing and responding to security alerts in Azure Security Center — Learn how to manage and respond to security alerts.
Managing security recommendations in Azure Security Center — Learn how recommendations help you protect your Azure resources.
Security health monitoring in Azure Security Center — Learn how to monitor the health of your Azure resources.
Monitoring partner solutions with Azure Security Center — Learn how to monitor the health status of your partner solutions.
Azure Security Center FAQ — Find frequently asked questions about using the service.
Azure Security blog — Get the latest Azure security news and information.

Posted on April 24 in category News

Tags: Technology

Deploying a StorSimple Virtual Appliance

The content below is taken from the original (Deploying a StorSimple Virtual Appliance), to continue reading please visit the site. Remember to respect the Author & Copyright.

In this post, I will show you how to deploy a new StorSimple 1200 virtual appliance on Hyper-V. Please note that VMware is quite similar to this. It also includes the StorSimple device manager in the Azure Portal.

StorSimple Device Manager

StorSimple appliances are deployed on-premises but they are managed from the cloud. Some Azure channels, also called Microsoft offers, such as EA or Open will offer management from the Legacy Management Portal. Moving forward, we should use the newer experience in the Azure Portal. I am documenting the latter.

In the Azure Portal, we can manage many StorSimple appliances using the StoreSimple Device Managers. This is really an experience with a grammatically incorrect name that will probably be changed in the ever-fluid Azure Portal. Browse over to More Services and search for StorSimple. Select StorSimple Device Managers and click + Add to create a new resource.

Give the new device manager a name and select/create a resource group to place it in. You can optionally create a new storage account. This storage account will be used in the cloud tier for your on-premises StorSimple appliances. Choosing this option does limit your flexibility. You can create a storage account yourself. This will give you what you want rather than taking the default. Here are the details:

General storage account
GRS
Same resource group as the device manager

You might opt to create a blob storage account for the hot or the cool tier. Afterward, you can add other storage accounts and modify resiliency.

Create a New StorSimple Device Manager [Image Credit: Aidan Finn]

Downloading the StorSimple Virtual Disk

Open the new device manager. Click Virtual Array. The blade that opens will provide links to download Hyper-V and/or VMware images for an on-premises StorSimple 1200 virtual appliance.

Sponsored

The minimum spec for sizing the virtual appliance’s machine is documented and a link to a deployment guide is provided. A service registration key for your associating appliances with this device manager is also provided. Copy this key now. You can always come back to this blade later to copy the key because it does not change.

Download the StorSimple 1200 Virtual Disk Image [Image Credit: Aidan Finn]

Click the download link to the appropriate disk image for your on-premises hypervisor. It is contained in a zip file that is just over 2GB in size. Download the disk to where you will create the virtual machine. If I am going to have a StorSimple appliance called StoreSimple1 stored in E:\Virtual Machines\StorSimple1\, then I will download and extract the disk to a folder called E:\Virtual Machines\StorSimple1\Virtual Hard Disks\.

The Downloaded StorSimple OS Disk [Image Credit: Aidan Finn]

Create an On-Premises Virtual Machine

You will need to create a virtual machine to run as your on-premises StorSimple virtual appliance. If you are working with Hyper-V from Windows Server 2012 or later hosts, then the virtual machine should be Generation 2. In the case of VMware hosts, use version 8–11.

This virtual machine should have 4 virtual CPUs and 8GB of static RAM. Dynamic memory is not supported for this virtual machine. Do not create an OS disk. Use the disk that you downloaded and extracted. In my case, I will connect the machine to the virtual hard disk that I downloaded and extracted to E:\Virtual Machines\StorSimple1\Virtual Hard Disks\.

Using the Downloaded StorSimple OS Disk as the VM OS Disk [Image Credit: Aidan Finn]

There are two variables when you are configuring this virtual machine:

NICs: How many virtual NICs will this machine have? What VLANs or virtual networks will they be connected to? This is more of an issue for iSCSI deployments, where iSCSI traffic is normally isolated.
Data Disk Size: The size of the data disk impacts the total amount of tiered storage that your StorSimple solution will be able to offer to the on-premises network.

Calculating the size of the data disk of the virtual machine is complicated. I will cover it in another post. For now, know that it must be at least 500GB and can be as big as 8TB. In the case of Hyper-V, use dynamic disks and thin provisioned for VMware. Note that resizing the data disk is not supported and will lead to data loss.

Settings of a StorSimple VM on Windows Server 2016 Hyper-V [Image Credit: Aidan Finn]

Configuring Virtual Appliance — Console

Connect to the Hyper-V virtual machine console and boot it up. Wait for the OS to boot. This will not take long. Log into the virtual machine with the default password of Password1. You must change the password at this time. Set it to something secure.

You are logged into a PowerShell prompt. StorSimple appears to be a customized and smaller version of a Windows Server core installation. It has a very small PowerShell module. You can run Get-Command to see the available set of cmdlets and functions.

The most important of these cmdlets is Set-HcsIpAddress. We will use this to configure an IP address, subnet mask, and default gateway for the first management NIC in the virtual machine. DNS settings will be done later in the web console:

Set-HcsIpAddress -Name Ethernet -IpAddress 192.168.0.31 -Netmask 255.255.255.0 -Gateway 192.168.0.1

Now we have the virtual appliance running with enough of a configuration to start managing it remotely. You can press CTRL + ALT + DEL to log out of the StorSimple virtual appliance.

Configuring Virtual Appliance — Browser Interface

We will complete the configuration of the virtual appliance using the browser interface that it hosts. Open up a browser and navigate to https://<IPaddress of the virtual appliance>. You will get a certificate warning, which you can ignore.

Sign in as the default user, which is StorSimpleAdmin. Use the password that you previously configured. You are greeted by a Getting Started page, which will walk you through completing the local configuration of the virtual appliance.

Getting Started In the StorSimple Browser Interface [Image Credit: Microsoft]

The Network Interface page allows you to re-configure the IP configuration (static/DHCP) and now you can customize the DNS server settings.

Network Settings for the StorSimple Appliance [Image Credit: Aidan Finn]

I have found in my testing that if you inherited DNS settings from DHCP, then you cannot rely on them. I have had to do the following:

Temporarily switch the DNS servers to something else such as OpenDNS or Google.
Apply the changes.
Change the DNS settings to my local DNS servers again.
Apply the changes.
A restart might be necessary if there were failed DNS lookups. This will purge the local DNS cache. You can find the restart under Power Settings in the browser interface.

Device Settings is an important page to do the following:

Configure the machine either as a file server (default) or as an iSCSI storage appliance.
Set the computer name.
Join an Active Directory domain. See the above DNS tip if your domain cannot be found.

Configure StorSimple device settings & domain join [Image Credit: Aidan Finn]

Configuring StorSimple Device Settings and Domain Join [Image Credit: Aidan Finn]

Web Proxy Settings will allow the StorSimple appliance to communicate with Azure via a local proxy server. Time Settings will configure the time zone. It also configures a primary and secondary time server. It is set to time.windows.com by default.

Cloud settings is where you will associate this virtual appliance with the StorSimple device manager that was previously created. We need to paste the service registration key from the Add Virtual Array blade here and click Register.

Register the StorSimple Virtual Appliance with Azure [Image Credit: Aidan Finn]

The second field is a Service Data Encryption Key. This is used when we want to associate additional StorSimple appliances with the same StorSimple device manager in Azure. The key is presented to you when you register your first appliance. You can retrieve it later from the Cloud Settings page.

When you are associating additional StorSimple appliances, you need to enter both the Service Registration Key from the Azure Portal and the Service Data Encryption Key from previously registered StorSimple appliances.

It is a good idea to run Diagnostic Tests under Troubleshooting in the browser interface. Unnecessary tests are not run by this tool. If the test passes, you can move on to the final phase of deploying the appliance.

Configuring Virtual Appliance — Azure Portal

Return to the StorSimple Device Manager blade in the Azure Portal and open Devices. Your new virtual appliance should appear with a status of Ready To Set Up. Open the device and click Configure.

By default, StorSimple wants to encrypt the cold data that is kept in an Azure storage account. This requires a 32-character encryption key that you must generate and keep safe. You can optionally disable storage account encryption.

You must associate a storage account with the virtual appliance under Storage Account Credential. We created a storage account earlier so we can complete the wizard to associate the storage account. If you did not create a storage account, open the Azure Portal in another browser tab. Create one there.

Select the storage account and click Add. This will add the credentials of the storage account to the StorSimple virtual appliance.

Configuring a StorSimple Appliance In the Azure Portal [Image Credit: Aidan Finn]

Wait for the storage account credentials job to complete. You can click Configure to finish setting up the virtual appliance. Once that job is complete, your StorSimple virtual appliance is ready to be used.

A Ready StorSimple Virtual Appliance [Image Credit: Aidan Finn]

Sponsored

Next, you will need to configure your iSCSI volumes or your file server shares. We will cover these steps in future posts.

The post Deploying a StorSimple Virtual Appliance appeared first on Petri.

Posted on April 24 in category News

Tags: Technology

Building Your Disaster Recovery Plan

The content below is taken from the original (Building Your Disaster Recovery Plan), to continue reading please visit the site. Remember to respect the Author & Copyright.

Let’s face it, building and testing Disaster Recovery (DR) plans isn’t anyone’s favorite activity. However, it’s like a life boat on a cruise ship — you hope you never need it but if anything happens it can be a lifesaver. Although your DR plan doesn’t help you much in day-to-day operations, the lack of one can be disastrous. This is especially true for small and medium-sized businesses that typically have fewer resources and are often tapped out just covering their daily operations. However, these are the businesses who probably need a DR plan the most because a prolonged failure in their IT infrastructure has the potential to put them out of business permanently. A solid DR plan is essential to businesses of all sizes, as it makes your company more resilient to serious IT outages and enables you to restore your critical services with as little impact on business operations as possible.

DR isn’t without its challenges. Business processes are complex and protecting them is equally complex. Just as important, DR can be expensive. For instance, if your DR plan requires a physical hot site, then you need to buy the computing, networking, storage, and software required to support your mission critical workloads. These types of costs have driven many businesses to look to the cloud to replace the need for a DR hot site.

So how do you go about building a DR plan? It’s not just making regular backups. Although there isn’t room to cover all the aspects of a DR plan in this post, let’s look at the high points that can help you get started building a new DR plan or revamping an existing one.

Identify Your Critical Processes and Their Dependencies

The first step to building an effective DR plan is to identify your organization’s needs as well as your critical IT components and their dependencies. What these are depends entirely on the type of business. For instance, an online retailer such as Amazon needs to make sure the web frontend and backend services that provide their online presence are all protected. The needs of a small manufacturing firm are quite different. There it’s typically more important to keep the local ERP system online. During this identification phase, it’s important to work with management to recognize the most serious vulnerabilities in the data center, as well as reviewing past outages and identifying their causes and resolutions.

Select the Appropriate Technologies Based on Your RTOs and RPOs

The next step is to determine your Recovery Time Objectives (RTOs) and your Recovery Point Objectives (RPOs). Your RTOS and RPOs are the primary drivers for the DR technologies that you choose to implement. To understand your RTOs, you need to ask how long can you go without this service? To understand your RPOs, you need to ask how much data can you stand to lose? While different businesses have different requirements, if your organization requires very short recovery times, then you could consider implementing a replication-based DR strategy where data from your primary site is replicated to the cloud or to another DR site. The data in the DR site is then as current as your replication interval.

Set Up DR Operational Procedures and Document Them

After determining your DR requirements, you need to create operational procedures designed to respond to your critical business outage. You need to identify your emergency response teams and assign them their DR contingency tasks as well as understanding your vendor’s emergency response requirements and capabilities. In addition, you need to document your DR procedures so that all personnel have a clear understanding of their roles and responsibilities.

Sponsored

Testing Your DR Plan

Finally, DR can’t be viewed as a set-it-and-forget-it activity. No DR plan is complete without regular testing. If you don’t test your DR plan, you don’t have a real DR plan. The last place you want to find out your DR plan has a problem is in the middle of a critical recovery. Operational procedures and requirements are in continual flux and regular periodic testing of your DR plan is a necessity if you want that plan to work when you need it to.

The post Building Your Disaster Recovery Plan appeared first on Petri.

Posted on April 21 in category News

Tags: Technology

Turning Office 365 Off at the Weekend

The content below is taken from the original (Turning Office 365 Off at the Weekend), to continue reading please visit the site. Remember to respect the Author & Copyright.

France Weekend

France Says No to Weekend Working

The French El Khomri law that allows “the full exercise by the employee of his right to disconnect and implementation by the company of devices to regulate the use of digital tools” came into effect on January 1, 2017. The law gives employees the right to avoid the use of IT systems, including Office 365, at weekend and holiday periods. The exact details of how employees can disconnect are subject to discussions within individual companies and agreement between management and bodies such as workers’ councils.

The logic behind the new law is that everyone deserves the right not to be disturbed by work interruptions when they are at home or on vacation and should be spending time with their families. It is hard to argue against the intent of the law. It seems like everyone is interrupt-driven today and our lives are governed by the squeaks, beeps, and other noises emitted by PCs and other devices. Tools like MyAnalytics allow people to measure how much time they spend on activities outside normal working hours, but it is unclear how effective this data is in persuading corporate employees to ease back.

Hence the new requirement on companies operating in France to come to some arrangement to protect employees against overwork caused by “digital tools”. It is easy to imagine how to cut off IT for on-premises servers. After all, the easiest thing in the world is to power down all systems over the weekend and during public holidays. Or simply disconnect the external network.

But Office 365 isn’t Designed for France

Things are more complex with Office 365. First, Office 365 is a massive multi-tenant environment where work from different tenants is intermingled on servers. For instance, mailboxes from one tenant can exist in the same database as those from other tenants. Second, although Office 365 operates in different datacenter regions, most of those regions span multiple countries and therefore multiple legislative environments.

Last, it is up to individual companies to discuss and determine arrangements with their staff Every company is different. Some will only have French employees, others will operate inside and outside France. Some will operate on a classic 9-to-5 basis, others must maintain business operations on a 24×7 basis. Some employees will need access at the weekend because of their jobs while others will cheerfully never want to see an IT system on a weekend. And anyway, the lines of what a weekend is have blurred as different cultures combine in heterogeneous societies. All of this proves that it would be terrifically difficult for Office 365 to provide a single out-of-the-box answer for French companies.

PowerShell to the Rescue

Which leaves us with PowerShell. Again!

Conceptually, it is easy to list the steps necessary to block user access for specific periods.

Identify the users to block.
Identify the times for a block to be active.
Block the users’ credentials during the designated periods.

Setting a flag can identify the users to block. For instance, if you use Exchange Online, you could use one of the custom attributes. In this example, we populate the CustomAttribute12 property for a mailbox with “Weekend”.

[PS] C:\> Set-Mailbox -Identity TRedmond -CustomAttribute12 "Weekend"

If you do not use Exchange Online, you must pick an attribute that exists for the user’s Azure Active Directory account and use that. However, most of those attributes are used to hold information like the user’s address and phone numbers that are visible to users, so there is no obvious good answer. In either case, once you have marked the users to block, you then need to have some method to prevent access to Office 365, Fortunately, this is easily done by blocking user credentials. Two steps are required. First, we assemble the set of mailboxes to process. We then block their account credentials. Here is some simple code that does the job.

[PS] C:\> $Mbx = Get-Mailbox -RecipientTypeDetails "UserMailbox" -Filter {CustomAttribute12 -eq "Weekend"}

ForEach ($M in $Mbx)  {

     Write-Host “Blocking access for“ $M.DisplayName

     Set-MsolUser -UserPrincipalName $M.WindowsEmailAddress -BlockCredential $True }

This code relies on the value of the WindowsEmailAddress property for the mailbox being the same as the User Principal Name for the account. This is the desired state, but the two values might not match.

Assuming everything works, Office 365 blocks the user’s credentials. Any attempt to connect results in an “account locked” error (Figure 1).

Figure 1: Office 365 blocks a user account (image credit: Tony Redmond)

To unlock the account, we reverse the process and run the Set-MsolUser cmdlet to set the BlockCredential switch for each account to False. For example:

[PS] C:\> Set-MsolUser -UserPrincipalName [email protected] -BlockCredential $False

More Work to Do

Of course, this is only an outline of the work that’s needed to block users. You’d also have to set the dates to block and schedule scripts to block access. For instance, you might disable access at 6PM on Friday and allow access again at 8AM on Monday. Some error handling and logging would be nice and you’d have to accommodate exceptions and so on. In other words, a few lines of PowerShell are not a complete solution.

Sponsored

Other solutions are suggested elsewhere (here’s one example), some of which are pretty inventive. If you’re in the position where management asks you to implement a block, it is worthwhile checking out what others have done or investigated before making up your mind. Bear in mind that Office 365 now covers a host of different applications and clients, so your solution needs to be workload-independent. That’s why blocking credentials is such a good approach.

One thing’s for sure. Don’t expect Microsoft to offer a solution. They want you to use Office 365 all the time. Even at weekends.

Follow Tony on Twitter @12Knocksinna.

Want to know more about how to manage Office 365? Find what you need to know in “Office 365 for IT Pros”, the most comprehensive eBook covering all aspects of Office 365. Available in PDF and EPUB formats (suitable for iBooks) or for Amazon Kindle.

The post Turning Office 365 Off at the Weekend appeared first on Petri.

Posted on April 20 in category News

Tags: Technology

Allowing additional users to download invoices

How to add users to Billing Reader Role

Downloading invoice using new Billing API

Amazon may be using disk drives with hot-swappable components

Patent calls for drives in which mechanical bits and electronics aren’t bound together

The Virtual Machine

Sizing the Data Disk

Group Policy

Anti-Virus

Networking

Storage Accounts

Volumes and Shares

Data Security and Encryption

What’s in a name?

Buy it now!

Open-ish

Oh please god no, not another one

That barren landscape of Internet of Things standards bodies

Initial Azure Security Center alert details

Recommended remediation and mitigation steps

StorSimple Device Manager

Downloading the StorSimple Virtual Disk

Create an On-Premises Virtual Machine

Configuring Virtual Appliance — Console

Configuring Virtual Appliance — Browser Interface

Configuring Virtual Appliance — Azure Portal

Identify Your Critical Processes and Their Dependencies

Select the Appropriate Technologies Based on Your RTOs and RPOs

Set Up DR Operational Procedures and Document Them

Testing Your DR Plan

France Says No to Weekend Working

But Office 365 isn’t Designed for France

PowerShell to the Rescue

More Work to Do

Recent Posts

Search this site