По буквите: Панчева, Личева и Янакиева, Клер, Аристарко

Post Syndicated from Зорница Христова original https://toest.bg/po-bukvite-w2-2022/

В емблематичната си колонка, започната още през 2008 г. във в-к „Култура“, Марин Бодаков ни представяше нови литературни заглавия и питаше с какво точно тези книги ни променят. Вярваме, че е важно тази рубрика да продължи. От човек до човек, с нова книга в ръка.

„Теория на литературата. Новият век“

автори Евгения Панчева, Амелия Личева, Миряна Янакиева, София: изд. „Колибри“, 2021

Представям си няколко мои приятели – съдия, художник, лекар, ИТ специалист, биолог, режисьор, учител, психотерапевт, журналист. Представям си също своите родители и своята дъщеря, студентка в първи курс по социология. Представям си, че съм пред тях и искам да им обясня за какво би могла да им послужи литературната теория.

И си давам сметка колко е трудно – защото последният им сблъсък с литературознанието може да е бил на кандидатстудентския им изпит (в случая с дъщеря ми – на матурата). А изпитите са място на несвобода, място, където мисълта ти е санкционирана от някаква висша инстанция. Тази несвобода се просмуква и в литературното образование, чиято цел е често подменена (с въпросния изпит), чийто език е бюрократизиран, неискрен. Моите приятели обичат да четат и биха бранили любимите си книги от този език.

Преди доста години аз също бях студентка в първи курс – и смаяна открих, че литературознанието изобщо не е това. Че може да бъде любопитно, да се учи от другите области, да използва книгите, за да търси обяснения на света. И обратно, може да обогати другите области с въпроса за творчеството и въображението в тях. Психоанализа, етика, изследвания на медиите, изследвания на обществото, властта, пола, етноса, расата, историята, политиката – оказа се, че да говориш за книги значи да говориш за всичко това. За разлика от другите изкуства, литературата използва езика – същия език, на който коментираме и изследваме целия свят.

През 90-те у нас заниманията с литературна теория носеха опиянение: светът се е сринал, можем да го строим поновому – и да започнем откъм смисъла. Имаше, признавам, и усещане за игра – поне в моята 17-годишна глава. Тогава думата на деня беше „постмодерен“ – идеята за край на културния прогрес, съпътстващ уж настъпилия „край на историята“. Звучеше много успокоително за източноевропейци, свикнали все нещо да наваксват.

После дойдоха Виденовата зима, хиперинфлацията, мутренският преход. Не само думите меняха стойността си. После два самолета се блъснаха в кулите на Търговския център в Манхатън. Сега чета, че една от първите политически реакции в САЩ била „стига с този постмодернизъм“. С други думи, какво ще ми философствате, когато насреща има враг. Литературознанието и културологията въобще започнаха да изглеждат като нещо опасно – нещо, което внася сложност там, където трябва простота. Нещо, което пречи на действието.

От онзи 11 септември минаха над 20 години. Това с простотата… не се оказа толкова просто. Днес търсим начини да си обясним света, който все по-малко разбираме. И не е лошо да погледнем какво става с теорията, която не е спряла да се развива от това, че с лека ръка е била маргинализирана.

Чета „Теория на литературата. Новият век“ на Евгения Панчева, Амелия Личева и Миряна Янакиева. Не като студентка, която трябва да научи кой какво е казал. А като възрастен човек, който има нужда някой да му подскаже в кои четива би могъл да намери ако не отговор, то събеседник, посветил години на въпросите, които го тревожат.

Какво става с ума ми, когато непрекъснато използвам интернет като негов придатък? Защо не мога да се концентрирам в това, което чета? Променил ли се е човекът – и как? Как влияе литературата на споровете ни за климата? За какво говорим, когато говорим за природа? Защо някои групи хора се обиждат от класически произведения – и трябва ли да се прави нещо по този въпрос? Ако пиша за травмата си, само преживелите същата травма ли ще ме разберат? Какво изобщо значи някой да те разбере? Защо имам нужда да разказвам и как помага това? По какъв начин съм подвластен на своите афекти – и мога ли да се наблюдавам, докато чета, за да разбера нещо повече за техния механизъм?
Как можем да говорим с мъртвите, докато четем написаните от тях думи?

Спирам дотук. Вторият том на „Теория на литературата“ (първият, с подзаглавие „От Платон до постмодернизма“, беше публикуван през 2005 г. от същото издателство) не дава отговор на всички тези въпроси, и слава богу. Това би означавало да лъже – да изкриви търсенето и спора до половин изречение „истина“. Вместо това книгата е полезен пътеводител към други книги, които – ако наистина ни интересува – бихме могли да потърсим. В многотията на съвременния книжен пазар, включително и на научна литература, това е много ценно. И да, не е проста работа, но простите решения обикновено се оказват фалшиви.

„Мъжът, който уби Ролан Барт“

автор Тома Клер, превод от френски Радостин Желев, София: изд. „Алтера“, 2021

„Мъжът, който уби Ролан Барт“ е сборник разкази, изграден като концептуалните албуми в музиката.
Ако посегнете към книгата като почитател на „Фрагменти на любовния дискурс“ или на „Дневник на скръбта“, пригответе се да приемете първия разказ като лична обида. Приапиският поток на съзнанието на героя, случаен шофьор на кола от фирма за химическо чистене, случайно блъснал големия френски мислител, няма нищо общо с всичко това. Вътрешно родство, съизмеримост, умисъл, смисъл – няма такова нещо в смъртта. Освен ако не броим тоталната разкаченост между единия и другия вид живеене като някакво предопределение.

Но казах „концептуален албум“ – всеки разказ е вариация по темата „човекът, който уби еди-кого си“, а вариациите са много различни. Едно тъмно „вариете“, както подсказва авторът – а „вариете“ значи „разнообразие“. Стилистиката на всяка история за убийство е друга – понякога обагрена от личността на жертвата, понякога брутално несъизмерима (Анна Политковская). Ироничният, обигран читател би сравнил това стилистично ветрило с Пруст или с Реймон Кьоно – или дори с „К като всичко“ на Яна Букова, където всеки от разказите е нещо като трибют към любим къс литература. Постмодерният читател – ако трябва да се върна към предишната рецензия – би изпитал удоволствие от умението си да надскочи заложените в текста афекти и да се наслади на писателското (и преводаческото!) майсторство, на чистата езикова игра. А тук има много поводи за наслада, например разказът на Кунанан (убиеца на Версаче), който говори два езика: външен (изискан и любезен) и вътрешен (брутален, агресивен, убог) – и то паралелно; докато изрича думата, скобите вече са пробили плътта ѝ. Или пък преплетените нишки в разказите за Линкълн и за Пазолини. Има дори разказ в стихове.

И все пак ми се струва, че този обигран читател ще загуби, ако не се поддаде на първия си инстинкт да чете разказите от гледна точка на доброто и злото. Наивният, емоционален прочит ще му демонстрира нещо интересно за самия него – а именно различните лица на собственото му възмущение, неговата нееднородност. Никой от героите не подканва към идентификация, но в готовността ни да съдим се прокрадват нюанси – тук повече гняв, тук известно разбиране, може би жал, там безпомощно разперване на ръце пред троглодитската логика на мутрата, оттатък пък известно съчувствие. (Дали съчувстваме на убийците с идеология? На образованите? На водилите тежък живот? На неспособните да бъдат други?) Можем да изследваме себе си. Усилва ли се гневът ни, ако убиецът живее в разкош? И т.н.

Последният разказ – „Човекът, който уби моя дядо“, е може би единственият, който предизвиква милост – ще видите сами защо. И този контраст потвърждава предположението ми, че рафинираният прочит не е достатъчен. Под него (в скоби, като в разказа за Версаче) тихо или не толкова тихо псува гневът. А с този вътрешен, тихо псуващ съдия у себе си (по-близък до Линч, отколкото до Нилс Кристи) има смисъл да си поговорим. Белким и той научи нещо.

Специални поздравления за преводача Радостин Желев, включително и за интересния, задълбочен предговор.

„Божествена комедия. Първи стъпки в тъмната гора“

автор Даниеле Аристарко, илюстрации Марко Сома, превод от италиански Паулина Мичева, София: изд. „Колибри“, 2021

Марко Сома е отличен илюстратор с убедително въображение и държеливо чувство за хумор, което не се проваля в усилието да разкажеш комичното подробно. Детайлен, без да е досаден, изненадващ, без да оригиналничи, той рисува красиво, но не и декоративно – въпреки младостта си леко напомня на Олга и Борис Дугини например. Неговата „Кралицата на жабите“ (автор Далиде Кали) неслучайно е издадена на десетина езика. Илюстрациите му са като обвити с хладен пролетен въздух – прибрани в контурите си, но общителни и оживени.

Такива са и в „Божествена комедия. Първи стъпки в тъмната гора“ – една от многото версии на „Данте за начинаещи“, с които изобилства италианското книгоиздаване. Особено напоследък, покрай годишнината на великия поет. Дори преди три години в книжарничката към музея на Данте в Равена човек можеше да избере измежду много версии на „Адът за деца“. Това е, разбира се, нормално в западноевропейското и американското книгоиздаване, където детските адаптации на класиката за възрастни са норма, а не изключение. В този смисъл решението на Марко Сома да представи персонажите с животински лица (самият Данте е може би афганска хрътка?) не е никак радикално, а по-скоро забавно, разточително, покана да се отпуснеш и да погледнеш текста с удоволствие.

На нашия пазар обаче малко подмамва. Българският читател е свикнал да смята илюстрованите книги за детски и се боя, че би преценил изданието като подходящо за деца в начална училищна възраст – а точно за тях ми се струва, че тонът на Даниеле Аристарко ще им бъде чужд. Разказът от първо лице за деветгодишно дете, което с трепет мечтае да се докосне до „Божествена комедия“, сваля я от библиотеката тайно, прочита няколко думи и веднага трябва да спре, за да осмисли книгата… ще звучи просто неискрено. Дори случаят да е точно такъв. Оттам насетне разказът започва един сам по себе си много симпатичен анализ на Дантевата творба – защо е „комедия“, кога е започнала да се нарича „божествена“, кое какво символизира… но честно казано, в текста непрекъснато се усеща възрастният писател, а не уж деветгодишната му версия.

Това, разбира се, не пречи да се снабдите с книгата – „Божествена комедия“ се учи в осми клас и един красив и лежерен „вход“ към нея няма да е излишен на гимназиста вкъщи. Може също да си я вземете като красив предмет на изкуството – за самите вас, или като повод за разговор – какво друго може да се прави с класиката, ако държим на нея, освен да я преподаваме в час? За още идеи може да видите как Роберто Бенини рецитира Данте на площада във Флоренция:

Или ако наистина имате тийнейджър вкъщи, да му пуснете тази рап версия на „Божествена комедия“:

Активните дарители на „Тоест“ получават постоянна отстъпка в размер на 20% от коричната цена на всички заглавия от каталога на „Колибри“, както и на няколко други български издателства в рамките на партньорската програма Читателски клуб „Тоест“. За повече информация прочетете на toest.bg/club.
Заглавна илюстрация: © Александра Димитрова

Източник

Седмицата (10–14 януари)

Post Syndicated from Светла Енчева original https://toest.bg/editorial-10-14-jan-2022/

Януари е като един дълъг понеделник, гласи популярен анекдот. Празниците вече са отминали, а лятото е още далече. И все пак през този безрадостен месец денят вече расте, а не намалява. Междувременно в „Тоест“ може да прочетете както статии, които правят дисекция на социалните проблеми, така и такива, които топлят душата. Или и двете – изборът е ваш.

Надежда Цекулова

Във вторник „Тоест“ публикува статията на Надежда Цекулова „Мястото на децата в пандемичните решения на възрастните“, част от рубриката „Хроники на инфодемията“, която поддържаме съвместно с Асоциацията на европейските журналисти в България. В нея се показва как децата стават жертва на борбата между две враждуващи тези – че трябва да се отменят всички мерки за ограничаване на пандемията и че децата са основни разпространители на вируса. Докато възрастните се карат, все повече деца боледуват тежко от COVID-19, много са и страдащите от постковид синдром, а онлайн обучението води до рискове за психичното здраве и отпадане от училище. В същото време ваксинацията на децата носи повече ползи, отколкото рискове, и е една от възможностите учениците в районите с висок брой заболели от COVID-19 да ходят на училище.

Зорница Христова

„Лято в дълбините на зимата“ е озаглавен отзивът на Зорница Христова от сряда за филма на Камен Калев „Февруари“. Както и януари, февруари има славата на безрадостен месец. Ала носталгичната радост, която филмът носи, сгрява душата. В него се проследява животът на главния герой Петър в три различни периода – детството, военната служба и старостта. Думите на Албер Камю зад кадър вадят на повърхността темата на филма, а музиката на Петър Дундаков влиза в ролята на разказвач.

Светла Енчева

На 12 януари се проведе организираният от „Възраждане“ протест пред парламента. На тази тема е статията ми от петък „Време ни е за проглеждане“. Опитът за римейк на щурма в Капитолия отпреди година може да се обобщи с думите на Карл Маркс, че историята се повтаря като фарс. Фарс са и противоречивите и постоянно променящи се послания на Костадин Костадинов и партията му против мерките за ограничаване на пандемията от COVID-19. Единствената цел е властта – дори с цената на рекордна смъртност.

Зорница Христова

След демонстрацията на политическа нечистоплътност имаме нужда от нещо за душата. И тук отново ни идва на помощ Зорница, този път – с първата за годината колонка „По буквите“. Във фокуса на вниманието ѝ са три нови книги. Първата е „Теория на литературата. Новият век“ на Евгения Панчева, Амелия Личева и Миряна Янакиева, издадена от „Колибри“. Втората е „Мъжът, който уби Ролан Барт“ на Тома Клер. Преводачът е Радостин Желев, издателството е „Алтера“. Третата е „Божествена комедия. Първи стъпки в тъмната гора“ на Даниеле Аристарко, илюстрирана от Марко Сома и преведена от Паулина Мирчева, отново издание на „Колибри“.

Николета Атанасова

В седмия епизод на подкаста „Чути под масата“, озаглавен „Летала над фронта“, Николета Атанасова разговаря с инж. Иван Бориславов – полковник от резерва, пилот, писател и изследовател на българската военна авиация, както и с д-р Александър Въчков, художник и изследовател на войните. Двамата разказват за Балканските войни и Първата световна война през призмата на първите български пилоти и за самолетите, които тогава са се наричали аероплани, а разговорно – летала.

За десерт си позволявам да отправя няколко лични препоръки:

Той е Васил Върбанов, а ние не сме. Ако сте от хората, които вярват в максимата „Кажи ми каква музика слушаш, за да ти кажа кой си“, разходете се наслуки из предаването „Моят плейлист“ по БНТ. Дългогодишният радиоводещ на „Тангра“ и „Тангра мега рок“ Васил Върбанов разговаря с различни личности за (и най-вече по повод на) любимите им песни. А зрителят може да реши за себе си дали с въпросната личност е от една порода, или не. И да разшири хоризонта си – далеч не само в музикално отношение.

През седмицата бившият президент на България Петър Стоянов изрази позициите си за отношенията между България и Северна Македония в предаването „Лице в лице“ по bTV. В него той припомня простички истини, които след толкова години участие на националпопулисти във властта сме забравили. Например че не е в реда на нещата да се държим унизително с югозападната ни съседка. И че трябва да приемем, че за сложните отношения с нея България също носи вина. Да, имали сме и такъв президент. Затова нека не забравяме, че животът ни може да бъде и друг.

Сайтът „Как се пише?“, чиято създателка Павлина Върбанова е част от екипа на „Тоест“, организира класация за думи на годината. От 17 до 19 февруари класацията навлиза в решителната си фаза. В нея ще имате възможност да гласувате за думите, предложени от читателите на „Как се пише?“ в първата фаза и отсети от журито. А то е в състав: авторката на сайта и доктор по български език Павлина Върбанова, медийният експерт доцент Георги Лозанов, журналистката и писателка Веселина Седларска, програмният директор на „Дарик радио“ Константин Вълков и учителката по български език и журналистка Доротея Николова.

Източник

Friday Squid Blogging: The Evolution of Squid Eyes

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2022/01/friday-squid-blogging-the-evolution-of-squid-eyes.html

New research:

The researchers from the FAS Center for Systems Biology discovered a network of genes important in squid eye development that are known to also play a crucial role in limb development across animals, including vertebrates and insects. The scientists say these genes have been repurposed in squid to make camera-lens-type eyes.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Read my blog posting guidelines here.

Metasploit Weekly Wrap-Up

Post Syndicated from Simon Janusz original https://blog.rapid7.com/2022/01/14/metasploit-weekly-wrap-up/

Log4Shell goodness

Metasploit Weekly Wrap-Up

Log4Shell made an unfortunate end to 2021 for many organizations, but it also makes for some great additions to Metasploit Framework. Contributors sempervictus, schierlm, righel, timwr and our very own Spencer McIntyre have collaborated to bring us a Log4Shell module that uses header stuffing to exploit vulnerable HTTP servers, resulting in Remote Code Execution.

SonicWall SSL VPN module for Rapid7-discovered vulnerability

Rapid7 disclosed the technical details of five vulnerabilities discovered by jbaines-r7 affecting SonicWall’s SMA-100 series of SSL VPN devices. The disclosure included landing a Metasploit module that gives remote and authenticated attackers root access to the device using CVE-2021-20039.

Pi-Hole command execution and common exploit library

An exciting new addition has worked its way into Metasploit Framework this week. Contributor h00die has created an authenticated RCE module that takes advantage of improper escaping of characters in Pi-Hole’s Top Domains API’s validDomainWildcard field. H00die has also created a library that aims to make developing future Pi-Hole modules easier.

New module content (5)

  • Pi-Hole Top Domains API Authenticated Exec by SchneiderSec and h00die, which exploits CVE-2021-32706 – This adds an auxiliary module that executes commands against Pi-Hole versions <= 5.5. This also introduces a Pi-Hole library for common functionality required in exploits against the service.

  • SonicWall SMA 100 Series Authenticated Command Injection by jbaines-r7, which exploits CVE-2021-20039 – This adds a module that exploits an authenticated command injection vulnerability in multiple versions of the SonicWALL SMA 100 series web interface. In the SSL certificate deletion functionality, the sanitization logic permits the \n character which acts as a terminator when passed to a call to system(). An authenticated attacker can execute arbitrary commands as the root user.

  • Log4Shell HTTP Header Injection by sinn3r, juan vazquez, Michael Schierl, RageLtMan, and Spencer McIntyre, which exploits CVE-2021-44228 – This adds an exploit for HTTP servers that are affected by the Log4J/Log4Shell vulnerability via header stuffing.

  • Microsoft Windows SMB Direct Session Takeover by usiegl00 – This adds a new exploit module that implements the Shadow Attack, SMB Direct Session takeover. Before running this module, a MiTM attack needs to be performed to let it intercept SMB authentication requests between a client and a server. by using any kind of ARP spoofer/poisoner tools in addition to Metasploit. If the connecting user is an administrator and network logins are allowed to the target machine, this module will execute an arbitrary payload.

  • #12217 from SkypLabs – This adds the f5 load balancer cookie to notes, and cleans up the module (rubocop/documentation/refs)

Enhancements and features

  • #15656 from HynekPetrak – This enables the vmware_vcenter_vmdir_auth_bypass module to create an admin user even if the target is not vulnerable to CVE-2020-3952, assuming we have obtained valid credentials to the vCenter LDAP directory.
  • #16021 from zeroSteiner – This adds additional tests for Meterpreter’s mkdir/rmdir functionality to ensure uniform implementations across all Meterpreters
  • #16024 from sjanusz-r7 – This adds in a new command to Meterpreter that allows the end user to kill all channels at once
  • #16040 from jmartin-r7 – Removes Ruby 2.5 support as it is officially end of life

Bugs fixed

  • #16016 from bwatters-r7 – This fixes an issue in the auxiliary/scanner/dcerpc/hidden module where the RHOSTS datastore option was not available, resulting in hosts not being scanned.
  • #16027 from zeroSteiner – This fixes an issue with tab completion for the generate command. Completion now works with both the -f and -o flags.
  • #16043 from shoxxdj – Fixes crash in the auxiliary/scanner/http/wordpress_scanner.rb module when attempting to scan themes

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
binary installers (which also include the commercial edition).

7Rapid Questions: Stephen Donnelly

Post Syndicated from Rapid7 original https://blog.rapid7.com/2022/01/14/7rapid-questions-stephen-donnelly/

7Rapid Questions: Stephen Donnelly

At Rapid7, there’s no shortage of passionate leaders looking to challenge convention and make an impact. Our “7Rapid Questions” series is a way to highlight some of the amazing work taking place behind the scenes, and the exciting growth opportunities available in our global offices.

For this installment, we spoke with Stephen Donnelly, Rapid7’s Senior Engineering Manager for SOAR in our Belfast office.

7Rapid Questions: Stephen Donnelly
Stephen Donnelly

What does SOAR stand for?

SOAR stands for Security Orchestration Automation Response.

Describe what your teams do in 3 phrases

1. We provide a wide variety of interoperability between our own and other vendors’ products.

2. We accelerate time-intensive, highly manual incident response and vulnerability management processes.

3. We create a consistent automation experience for our customers across our entire Insight Platform, whether they are cloud or on-premise-based.

What are your most important technical goals in 2022?

For 2022, we’re looking at performance at scale, building an open API culture for our customers, and breaking down our work to show value to customers on a regular and consistent cadence.

What is your tech stack?

We use a little bit of everything, primarily Go, Python, Java, Kotlin, React, Typescript, AWS, and Datadog.

What’s a fun fact some people might not know about you?

I once tried out for the National American Football team after playing for the QUB American Football team. It hurts emotionally… and physically.

What was one of your proudest moments at work?

I’d say it’s been seeing our team grow in the last year. We had 13 people join our SOAR practice in 3 months, and seeing how they have all been welcomed and embraced by the teams tells me that Rapid7 is properly focused on our people and their experiences within the organization.

What three words would you use to describe the culture at Rapid7?

Welcoming, authentic, and learning.

Interested in exploring a new role? Stephen and his team are hiring in Belfast! Click here to browse our open jobs at Rapid7.

Upcoming Speaking Engagements

Post Syndicated from Schneier.com Webmaster original https://www.schneier.com/blog/archives/2022/01/upcoming-speaking-engagements-16.html

This is a current list of where and when I am scheduled to speak:

  • I’m giving an online-only talk on “Securing a World of Physically Capable Computers” as part of Teleport’s Security Visionaries 2022 series, on January 18, 2022.
  • I’m speaking at IT-S Now 2022 in Vienna on June 2, 2022.
  • I’m speaking at the 14th International Conference on Cyber Conflict, CyCon 2022, in Tallinn, Estonia on June 3, 2022.
  • I’m speaking at the RSA Conference 2022 in San Francisco, June 6-9, 2022.

The list is maintained on this page.

Building a Diverse and Inclusive Workplace: Our Learnings and Goals

Post Syndicated from Natalie Cook original https://www.backblaze.com/blog/building-a-diverse-and-inclusive-workplace-our-learnings-and-goals/

Backblaze started in a one-bedroom apartment in Palo Alto, California. Today, our products serve customers in more than 175 countries and are available in 11 languages. This would not have been possible without the diversity in culture, perspectives, and experiences within our team. Diversity has helped us understand the needs and expectations of the different markets we’re selling to. As a result of our diversity, we’ve come up with new features, solved interesting problems in an innovative way, and connected with our customers all around the world.

Today, we are sharing some stories of how diversity has helped our business throughout the years as well as our efforts to make our workplace more diverse and inclusive. We know we still have a lot to learn. Our initiatives are always evolving and changing as we strive to foster a diverse environment, and we hope that by sharing these stories we can do our part to promote diversity and inclusion more broadly.

How Diversity Helped Our Business

Building the Storage Pod Was an International Effort

Every true Backblaze fan knows that we built our own Storage Pods. After all, our blog post about how to build cheap cloud storage is one of our most popular posts. What fans may not know is that our staff’s bilingual skills are what helped us make our own Storage Pods. When the founders opened up the disk port multipliers they had just bought, they noticed there was a board inside with the name of the manufacturer: Chyang Fun Industry (CFI Group). This was a Taiwanese company, and they only spoke Mandarin. One of our founders, Billy Ng, spoke to them in Mandarin and explained that we needed 150 boards. These boards were essential pieces to building our Storage Pods.

Not only was Billy able to speak to the manufacturer in their native language, but he also knew the cultural standards so he was aware of what was culturally appropriate. After that initial sale, Backblaze continued to have a great relationship with CFI Group. Over the years, they continued to sell us boards which we used to make our Storage Pods. Brian Wilson, our chief technology officer, said, “Without Billy’s bilingual skills, the company would not have survived because we could not have survived without the Storage Pods.” As a result of Billy’s bilingual skills and bicultural understanding, we were able to build our own Storage Pods and store data from customers all around the world.

Translating the Product Into 11 Languages

Since we are an international company, our products and website are available in 11 languages. When the language features were initially created, our developers internationalized the product/website using Google Translate. However, they quickly realized these translations were not completely accurate. Backblaze then hired an external localization firm, but they were a bit pricey for us at the time—we were still a small, bootstrapped startup. We then looked internally and realized there were employees who were bilingual and even multilingual. These employees began reviewing the translations and fixing any errors. They even roped in friends and family to help with the translations. As a result of our diverse staff, we were able to fix the translations internally rather than spend tens of thousands of dollars on hiring an external localization firm.

Creating a Diverse and Inclusive Workplace

Photo by fauxels from Pexels.

Diversity and inclusion have always been valued at Backblaze. More than half of our founders were born in a country outside the U.S. (Fun fact: some of those countries don’t even exist anymore!) They collectively practice five different religions and speak various languages. Their diverse backgrounds have helped them build the company that Backblaze is today.

In the past year and a half, we’ve made a conscious effort to reinforce and further our commitment to diversity through a number of initiatives. We established a Diversity, Equity, and Inclusion (DEI) Committee made up of staff members from many different teams across the organization who are passionate about creating a safe and diverse workplace for their peers. Of their many initiatives, two we’re highlighting today include our hiring efforts and our inclusivity efforts.

Building Diversity in Hiring

The DEI Committee approached diversity in hiring by building out an internship program, which allowed us to bring on interns at various levels who come from different ethnicities, genders, socioeconomic statuses, etc. As a result of the program, we brought on some of the interns full-time, and we are excited to see them grow their careers at Backblaze!

In addition to the internship program, we’ve also worked with a variety of organizations that help bridge the gap between tech companies and underrepresented talent. These organizations have also provided internal training sessions which contributed to creating a safe and welcoming environment and continuing our positive retention rate.

Fostering a Safe and Inclusive Environment

We realize that it’s not only important to hire diverse employees, but to also create an inclusive and safe environment that supports these team members. The DEI Committee often hosts training sessions such as implicit bias training and gender inclusion training for employees, managers, Human Resources, and executive staff. The DEI Committee also hosts events like virtual panel discussions and movie nights to elevate social justice issues. These events lead to conversations afterward where employees engage in thoughtful discussions about the event, diversity, and social justice.

How Diversity and Inclusion Support a Strong Company Culture

Photo by fauxels from Pexels.

By creating a diverse and inclusive environment, we are enhancing our company culture and reducing employee turnover. According to Gallup, U.S. businesses lose around $3 trillion every year due to employee turnover. As a result of our company culture where we value diversity and employees treat one another with respect, we have a very low attrition rate. Check out our Glassdoor reviews to get a glimpse into our culture!

We’re Always Learning

We understand that as an organization, we still have more to learn. We’re continuously looking for more opportunities to educate our employees and leadership team, whether that be through diversity training sessions or having more open conversations about difficult topics. We’re also listening to our employees and looking into how we can continue to build a workforce that encourages and strengthens our diversity.

We don’t have all the answers yet, but as an organization that encourages learning and development, we are continually refining our approach to diversity and inclusion in the workplace. We look forward to sharing future learnings and using our platform to continue to promote these values to other organizations.

Join Our Team!

We are excited to continue our efforts to make Backblaze a diverse and inclusive environment! If you’d like to join our team, you can check out our careers here. If you don’t see a role you’re looking for, feel free to email jobscontact@backblaze.com. We look forward to hearing from you!

The post Building a Diverse and Inclusive Workplace: Our Learnings and Goals appeared first on Backblaze Blog | Cloud Storage & Cloud Backup.

How Ribbon Communications Built a Scalable, Resilient Robocall Mitigation Platform

Post Syndicated from Siva Rajamani original https://aws.amazon.com/blogs/architecture/how-ribbon-communications-built-a-scalable-resilient-robocall-mitigation-platform/

Ribbon Communications provides communications software, and IP and optical networking end-to-end solutions that deliver innovation, unparalleled scale, performance, and agility to service providers and enterprise.

Ribbon Communications is helping customers modernize their networks. In today’s data-hungry, 24/7 world, this equates to improved competitive positioning and business outcomes. Companies are migrating from on-premises equipment for telephony services and looking for equivalent as a service (aaS) offerings. But these solutions must still meet the stringent resiliency, availability, performance, and regulatory requirements of a telephony service.

The telephony world is inundated with robocalls. In the United States alone, there were an estimated 50.5 billion robocalls in 2021! In this blog post, we describe the Ribbon Identity Hub – a holistic solution for robocall mitigation. The Ribbon Identity Hub enables services that sign and verify caller identity, which is compliant to the ATIS standards under the STIR/SHAKEN framework. It also evaluates and scores calls for the probability of nuisance and fraud.

Ribbon Identity Hub is implemented in Amazon Web Services (AWS). It is a fully managed service for telephony service providers and enterprises. The solution is secure, multi-tenant, automatic scaling, and multi-Region, and enables Ribbon to offer managed services to a wide range of telephony customers. Ribbon ensures resiliency and performance with efficient use of resources in the telephony environment, where load ratios between busy and idle time can exceed 10:1.

Ribbon Identity Hub

The Ribbon Identity Hub services are separated into a data (call-transaction) plane, and a control plane.

Data plane (call-transaction)

The call-transaction processing is typically invoked on a per-call-setup basis where availability, resilience, and performance predictability are paramount. Additionally, due to high variability in load, automatic scaling is a prerequisite.

Figure 1. Data plane architecture

Figure 1. Data plane architecture

Several AWS services come together in a solution that meets all these important objectives:

  1. Amazon Elastic Container Service (ECS): The ECS services are set up for automatic scaling and span two Availability Zones. This provides the horizontal scaling capability, the self-healing capacity, and the resiliency across Availability Zones.
  2. Elastic Load Balancing – Application Load Balancer (ALB): This provides the ability to distribute incoming traffic to ECS services as the target. In addition, it also offers:
    • Seamless integration with the ECS Auto Scaling group. As the group grows, traffic is directed to the new instances only when they are ready. As traffic drops, traffic is drained from the target instances for graceful scale down.
    • Full support for canary and linear upgrades with zero downtime. Maintains full-service availability without any changes or even perception for the client devices.
  3. Amazon Simple Storage Service (S3): Transaction detail records associated with call-related requests must be securely and reliably maintained for over a year due to billing and other contractual obligations. Amazon S3 simplifies this task with high durability, lifecycle rules, and varied controls for retention.
  4. Amazon DynamoDB: Building resilient services is significantly easier when the compute processing can be stateless. Amazon DynamoDB facilitates such stateless architectures without compromise. Coupled with the availability of the Amazon DynamoDB Accelerator (DAX) caching layer, the solution can meet the extreme low latency operation requirements.
  5. AWS Key Management Service (KMS): Certain tenant configuration is highly confidential and requires elevated protection. Furthermore, the data is part of the state that must be recovered across Regions in disaster recovery scenarios. To meet the security requirements, the KMS is used for envelope encryption using per-tenant keys. Multi-Region KMS keys facilitates the secure availability of this state across Regions without the need for application-level intervention when replicating encrypted data.
  6. Amazon Route 53: For telephony services, any non-transient service failure is unacceptable. In addition to providing high degree of resiliency through Multi-AZ architecture, Identity Hub also provides Regional level high availability through its multi-Region active-active architecture. Route 53 with health checks provides for dynamic rerouting of requests within minutes to alternate Regions.

Control plane

The Identity Hub control plane is used for customer configuration, status, and monitoring. The API is REST-based. Since this is not used on a call-by-call basis, the requirements around latency and performance are less stringent, though the requirements around high resiliency and dynamic scaling still apply. In this area, ease of implementation and maintainability are key.

Figure 2. Control plane architecture

Figure 2. Control plane architecture

The following AWS services implement our control plane:

  1. Amazon API Gateway: Coupled with a custom authenticator, the API Gateway handles all the REST API credential verification and routing. Implementation of an API is transformed into implementing handlers for each resource, which is the application core of the API.
  2. AWS Lambda: All the REST API handlers are written as Lambda functions. By using the Lambda’s serverless and concurrency features, the application automatically gains self-healing and auto-scaling capabilities. There is also a significant cost advantage as billing is per millisecond of actual compute time used. This is significant for a control plane where usage is typically sparse and unpredictable.
  3. Amazon DynamoDB: A stateless architecture with Lambda and API Gateway, all persistent state must be stored in an external database. The database must match the resilience and auto-scaling characteristics of the rest of the control plane. DynamoDB easily fits the requirements here.

The customer portal, in addition to providing the user interface for control plane REST APIs, also delivers a rich set of user-customizable dashboards and reporting capability. Here again, the availability of various AWS services simplifies the implementation, and remains non-intrusive to the central call-transaction processing.

Services used here include:

  1. AWS Glue: Enables extraction and transformation of raw transaction data into a format useful for reporting and dashboarding. AWS Glue is particularly useful here as the data available is regularly expanding, and the use cases for the reporting and dashboarding increase.
  2. Amazon QuickSight: Provides all the business intelligence (BI) functionality, including the ability for Ribbon to offer separate author and reader access to their users, and implements tenant-based access separation.

Conclusion

Ribbon has successfully deployed Identity Hub to enable cloud hosted telephony services to mitigate robocalls. Telephony requirements around resiliency, performance, and capacity were not compromised. Identity Hub offers the benefits of a 24/7 fully managed service requiring no additional customer on-premises equipment.

Choosing AWS services for Identity Hub gives Ribbon the ability to scale and meet future growth. The ability to dynamically scale the service in and out also brings significant cost advantages in telephony applications where busy hour traffic is significantly higher than idle time traffic. In addition, the availability of global AWS services facilitates the deployment of services in customer-local geographic locations to meet performance requirements or local regulatory compliance.

Rust 1.58.0 released

Post Syndicated from original https://lwn.net/Articles/881377/rss

Version
1.58.0 of the Rust programming language is available.

Rust 1.58 brings captured identifiers in format strings, a change
to the Command search path on Windows, more
#[must_use] annotations in the standard library, and some
new library stabilizations.

More information on “captured identifiers” (the ability to use in-scope
variables directly in format strings) can be found on this page.

Streamlining Inkscape for the masses (Libre Arts)

Post Syndicated from original https://lwn.net/Articles/881380/rss

Libre Arts has posted an
interview with four Inkscape developers.

From what I understand, what helped was finally porting the user
interface from GTK2 to GTK3. It was just a huge task and brought
many regressions, some of them are still in even after 2
years. Just to compare, 1.0 was in alpha state for 1.5 years; but
for 1.1, it was just 3 months. So if you want a faster release,
don’t port your app. Too late for us though! And we probably need
to port again to GTK4 now if we want to fix performance
regressions.

Being Naughty to See Who Was Nice: Machine Learning Attacks on Santa’s List

Post Syndicated from Erick Galinkin original https://blog.rapid7.com/2022/01/14/being-naughty-to-see-who-was-nice-machine-learning-attacks-on-santas-list/

Being Naughty to See Who Was Nice: Machine Learning Attacks on Santa’s List

Editor’s note: We had planned to publish our Hacky Holidays blog series throughout December 2021 – but then Log4Shell happened, and we dropped everything to focus on this major vulnerability that impacted the entire cybersecurity community worldwide. Now that it’s 2022, we’re feeling in need of some holiday cheer, and we hope you’re still in the spirit of the season, too. Throughout January, we’ll be publishing Hacky Holidays content (with a few tweaks, of course) to give the new year a festive start. So, grab an eggnog latte, line up the carols on Spotify, and let’s pick up where we left off.

Santa’s task of making the nice and naughty list has gotten a lot harder over time. According to estimates, there are around 2.2 billion children in the world. That’s a lot of children to make a list of, much less check it twice! So like many organizations with big data problems, Santa has turned to machine learning to help him solve the issue and built a classifier using historical naughty and nice lists. This makes it easy to let the algorithm decide whether they’ll be getting the gifts they’ve asked for or a lump of coal.

Being Naughty to See Who Was Nice: Machine Learning Attacks on Santa’s List

Santa’s lists have long been a jealously guarded secret. After all, being on the naughty list can turn one into a social pariah. Thus, Santa has very carefully protected his training data — it’s locked up tight. Santa has, however, made his model’s API available to anyone who wants it. That way, a parent can check whether their child is on the nice or naughty list.

Santa, being a just and equitable person, has already asked his data elves to tackle issues of algorithmic bias. Unfortunately, these data elves have overlooked some issues in machine learning security. Specifically, the issues of membership inference and model inversion.

Membership inference attacks

Membership inference is a class of machine learning attacks that allows a naughty attacker to query a model and ask, in effect, “Was this example in your training data?” Using the techniques of Salem et al. or a tool like PrivacyRaven, an attacker can train a model that figures out whether or not a model has seen an example before.

Being Naughty to See Who Was Nice: Machine Learning Attacks on Santa’s List

From a technical perspective, we know that there is some amount of memorization in models, and so when they make their predictions, they are more likely to be confident on items that they have seen before — in some ways, “memorizing” examples that have already been seen. We can then create a dataset for our “shadow” model — a model that approximates Santa’s nice/naughty system, trained on data that we’ve collected and labeled ourselves.

We can then take the training data and label the outputs of this model with a “True” value — it was in the training dataset. Then, we can run some additional data through the model for inference and collect the outputs and label it with a “False” value — it was not in the training dataset. It doesn’t matter if these in-training and out-of-training data points are nice or naughty — just that we know if they were in the “shadow” training dataset or not. Using this “shadow” dataset, we train a simple model to answer the yes or no question: “Was this in the training data?” Then, we can turn our naughty algorithm against Santa’s model — “Dear Santa, was this in your training dataset?” This lets us take real inputs to Santa’s model and find out if the model was trained on that data — effectively letting us de-anonymize the historical nice and naughty lists!

Model inversion

Now being able to take some inputs and de-anonymize them is fun, but what if we could get the model to just tell us all its secrets? That’s where model inversion comes in! Fredrikson et al. proposed model inversion in 2015 and really opened up the realm of possibilities for extracting data from models. Model inversion seeks to take a model and, as the name implies, turn the output we can see into the training inputs. Today, extracting data from models has been done at scale by the likes of Carlini et al., who have managed to extract data from large language models like GPT-2.

Being Naughty to See Who Was Nice: Machine Learning Attacks on Santa’s List

In model inversion, we aim to extract memorized training data from the model. This is easier with generative models than with classifiers, but a classifier can be used as part of a larger model called a Generative Adversarial Network (GAN). We then sample the generator, requesting text or images from the model. Then, we use the membership inference attack mentioned above to identify outputs that are more likely to belong to the training set. We can iterate this process over and over to generate progressively more training set-like outputs. In time, this will provide us with memorized training data.

Note that model inversion is a much heavier lift than membership inference and can’t be done against all models all the time — but for models like Santa’s, where the training data is so sensitive, it’s worth considering how much we might expose! To date, model inversion has only been conducted in lab settings on models for text generation and image classification, so whether or not it could work on a binary classifier like Santa’s list remains an open question.

Mitigating model mayhem

Now, if you’re on the other side of this equation and want to help Santa secure his models, there are a few things we can do. First and foremost, we want to log, log, log! In order to carry out the attacks, the model — or a very good approximation — needs to be available to the attacker. If you see a suspicious number of queries, you can filter IP addresses or rate limit. Additionally, limiting the return values to merely “naughty” or “nice” instead of returning the probabilities can make both attacks more difficult.

For extremely sensitive applications, the use of differential privacy or optimizing with DPSGD can also make it much more difficult for attackers to carry out their attacks, but be aware that these techniques come with some accuracy loss. As a result, you may end up with some nice children on the naughty list and a naughty hacker on your nice list.

Santa making his list into a model will save him a whole lot of time, but if he’s not careful about how the model can be queried, it could also lead to some less-than-jolly times for his data. Membership inference and model inversion are two types of privacy-related attacks that models like this may be susceptible to. As a best practice, Santa should:

  • Log information about queries like:
    • IP address
    • Input value
    • Output value
    • Time
  • Consider differentially private model training
  • Limit API access
  • Limit the information returned from the model to label-only

NEVER MISS A BLOG

Get the latest stories, expertise, and news about security today.

More Hacky Holidays blogs

A Workers optimization that reduces your bill

Post Syndicated from Kenton Varda original https://blog.cloudflare.com/workers-optimization-reduces-your-bill/

A Workers optimization that reduces your bill

A Workers optimization that reduces your bill

Recently, we made an optimization to the Cloudflare Workers runtime which reduces the amount of time Workers need to spend in memory. We’re passing the savings on to you for all your Unbound Workers.

Background

Workers are often used to implement HTTP proxies, where JavaScript is used to rewrite an HTTP request before sending it on to an origin server, and then to rewrite the response before sending it back to the client. You can implement any kind of rewrite in a Worker, including both rewriting headers and bodies.

Many Workers, though, do not actually modify the response body, but instead simply allow the bytes to pass through from the origin to the client. In this case, the Worker’s application code has finished executing as soon as the response headers are sent, before the body bytes have passed through. Historically, the Worker was nevertheless considered to be “in use” until the response body had fully finished streaming.

For billing purposes, under the Workers Unbound pricing model, we charge duration-memory (gigabyte-seconds) for the time in which the Worker is in use.

The change

On December 15-16, we made a change to the way we handle requests that are streaming through the response without modifying the content. This change means that we can mark application code as “idle” as soon as the response headers are returned.

Since no further application code will execute on behalf of the request, the system does not need to keep the request state in memory – it only needs to track the low-level native sockets and pump the bytes through. So now, during this time, the Worker will be considered idle, and could even be evicted before the stream completes (though this would be unlikely unless the stream lasts for a very long time).

Visualized it looks something like this:

A Workers optimization that reduces your bill

As a result of this change, we’ve seen that the time a Worker is considered “in use” by any particular request has dropped by an average of 70%. Of course, this number varies a lot depending on the details of each Worker. Some may see no benefit, others may see an even larger benefit.

This change is totally invisible to the application. To any external observer, everything behaves as it did before. But, since the system now considers a Worker to be idle during response streaming, the response streaming time will no longer be billed. So, if you saw a drop in your bill, this is why!

But it doesn’t stop there!

The change also applies to a few other frequently used scenarios, namely Websocket proxying, reading from the cache and streaming from KV.

WebSockets: once a Worker has arranged to proxy through a WebSocket, as long as it isn’t handling individual messages in your Worker code, the Worker does not remain in use during the proxying. The change applies to regular stateless Workers, but not to Durable Objects, which are not usually used for proxying.

export default {
  async fetch(request: Request) {
    //Do anything before
    const upgradeHeader = request.headers.get('Upgrade')
    if (upgradeHeader || upgradeHeader === 'websocket') {
      return await fetch(request)
    }
    //Or with other requests
  }
}

Reading from Cache: If you return the response from a cache.match call, the Worker is considered idle as soon as the response headers are returned.

export default {
  async fetch(request: Request) {
    let response = await caches.default.match('https://example.com')
    if (response) {
      return response
    }
    // get/create response and put into cache
  }
}

Streaming from KV: And lastly, when you stream from KV. This one is a bit trickier to get right, because often people retrieve the value from KV as a string, or JSON object and then create a response with that value. But if you fetch the value as a stream, as done in the example below, you can create a Response with the ReadableStream.

interface Env {
  MY_KV_NAME: KVNamespace
}

export default {
  async fetch(request: Request, env: Env) {
    const readableStream = await env.MY_KV_NAME.get('hello_world.pdf', { type: 'stream' })
    if (readableStream) {
      return new Response(readableStream, { headers: { 'content-type': 'application/pdf' } })
    }
  },
}

Interested in Workers Unbound?

If you are already using Unbound, your bill will have automatically dropped already.

Now is a great time to check out Unbound if you haven’t already, especially since recently, we’ve also removed the egress fees. Unbound allows you to build more complex workloads on our platform and only pay for what you use.

We are always looking for opportunities to make Workers better. Often that improvement takes the form of powerful new features such as the soon-to-be released Service Bindings and, of course, performance enhancements. This time, we are delighted to make Cloudflare Workers even cheaper than they already were.

The collective thoughts of the interwebz