diff options
author | Christian Cleberg <hello@cleberg.net> | 2024-04-22 14:07:21 -0500 |
---|---|---|
committer | Christian Cleberg <hello@cleberg.net> | 2024-04-22 14:07:21 -0500 |
commit | 3def68d80edf87e28473609c31970507d9f03467 (patch) | |
tree | a64fb6363727dbfba4125d1b3c9d5c1423019b5e /content | |
parent | 9ad1dcee850864fd2c8564ac90e4154ce68ae2b8 (diff) | |
download | cleberg.net-3def68d80edf87e28473609c31970507d9f03467.tar.gz cleberg.net-3def68d80edf87e28473609c31970507d9f03467.tar.bz2 cleberg.net-3def68d80edf87e28473609c31970507d9f03467.zip |
format a portion of blog posts
Diffstat (limited to 'content')
20 files changed, 1313 insertions, 1533 deletions
diff --git a/content/blog/2018-11-28-cpp-compiler.org b/content/blog/2018-11-28-cpp-compiler.org index 1e2f802..09aeb50 100644 --- a/content/blog/2018-11-28-cpp-compiler.org +++ b/content/blog/2018-11-28-cpp-compiler.org @@ -4,14 +4,13 @@ #+filetags: :dev: * A Brief Introduction -[[https://en.wikipedia.org/wiki/C%2B%2B][C++]] is a general-purpose -programming language with object-oriented, generic, and functional -features in addition to facilities for low-level memory manipulation. +[[https://en.wikipedia.org/wiki/C%2B%2B][C++]] is a general-purpose programming language with object-oriented, generic, and +functional features in addition to facilities for low-level memory manipulation. -The source code, shown in the snippet below, must be compiled before it -can be executed. There are many steps and intricacies to the compilation -process, and this post was a personal exercise to learn and remember as -much information as I can. +The source code, shown in the snippet below, must be compiled before it can be +executed. There are many steps and intricacies to the compilation process, and +this post was a personal exercise to learn and remember as much information as I +can. #+begin_src cpp #include <iostream> @@ -24,51 +23,45 @@ int main() ** Compilation Process *** An Overview -Compiling C++ projects is a frustrating task most days. Seemingly -nonexistent errors keeping your program from successfully compiling can -be annoying (especially since you know you wrote it perfectly the first -time, right?). +Compiling C++ projects is a frustrating task most days. Seemingly nonexistent +errors keeping your program from successfully compiling can be annoying +(especially since you know you wrote it perfectly the first time, right?). -I'm learning more and more about C++ these days and decided to write -this concept down so that I can cement it even further in my own head. -However, C++ is not the only compiled language. Check out -[[https://en.wikipedia.org/wiki/Compiled_language][the Wikipedia entry -for compiled languages]] for more examples of compiled languages. +I'm learning more and more about C++ these days and decided to write this +concept down so that I can cement it even further in my own head. However, C++ +is not the only compiled language. Check out [[https://en.wikipedia.org/wiki/Compiled_language][the Wikipedia entry for compiled +languages]] for more examples of compiled languages. -I'll start with a wonderful, graphical way to conceptualize the C++ -compiler. View -[[https://web.archive.org/web/20190419035048/http://faculty.cs.niu.edu/~mcmahon/CS241/Notes/compile.html][The -C++ Compilation Process]] by Kurt MacMahon, an NIU professor, to see the -graphic and an explanation. The goal of the compilation process is to -take the C++ code and produce a shared library, dynamic library, or an -executable file. +I'll start with a wonderful, graphical way to conceptualize the C++ compiler. +View [[https://web.archive.org/web/20190419035048/http://faculty.cs.niu.edu/~mcmahon/CS241/Notes/compile.html][The C++ Compilation Process]] by Kurt MacMahon, an NIU professor, to see the +graphic and an explanation. The goal of the compilation process is to take the +C++ code and produce a shared library, dynamic library, or an executable file. ** Compilation Phases Let's break down the compilation process. There are four major steps to compiling C++ code. *** Step 1 -The first step is to expand the source code file to meet all -dependencies. The C++ preprocessor includes the code from all the header -files, such as =#include <iostream>=. Now, what does that mean? The -previous example includes the =iostream= header. This tells the computer -that you want to use the =iostream= standard library, which contains -classes and functions written in the core language. This specific header -allows you to manipulate input/output streams. After all this, you'll -end up which a temporary file that contains the expanded source code. +The first step is to expand the source code file to meet all dependencies. The +C++ preprocessor includes the code from all the header files, such as =#include +<iostream>=. Now, what does that mean? The previous example includes the +=iostream= header. This tells the computer that you want to use the =iostream= +standard library, which contains classes and functions written in the core +language. This specific header allows you to manipulate input/output streams. +After all this, you'll end up which a temporary file that contains the expanded +source code. -In the example of the C++ code above, the =iostream= class would be -included in the expanded code. +In the example of the C++ code above, the =iostream= class would be included in +the expanded code. *** Step 2 -After the code is expanded, the compiler comes into play. The compiler -takes the C++ code and converts this code into the assembly language, -understood by the platform. You can see this in action if you head over -to the [[https://godbolt.org][GodBolt Compiler Explorer]], which shows -C++ being converted into assembly dynamically. +After the code is expanded, the compiler comes into play. The compiler takes the +C++ code and converts this code into the assembly language, understood by the +platform. You can see this in action if you head over to the [[https://godbolt.org][GodBolt Compiler +Explorer]], which shows C++ being converted into assembly dynamically. -For example, the =Hello, world!= code snippet above compiles into the -following assembly code: +For example, the =Hello, world!= code snippet above compiles into the following +assembly code: #+begin_src asm .LC0: @@ -113,16 +106,16 @@ _GLOBAL__sub_I_main: #+end_src *** Step 3 -Third, the assembly code generated by the compiler is assembled into the -object code for the platform. Essentially, this is when the compiler -takes the assembly code and assembles it into machine code in a binary -format. After researching this online, I figured out that a lot of -compilers will allow you to stop compilation at this step. This would be -useful for compiling each source code file separately. This saves time -later if a single file changes; only that file needs to be recompiled. +Third, the assembly code generated by the compiler is assembled into the object +code for the platform. Essentially, this is when the compiler takes the assembly +code and assembles it into machine code in a binary format. After researching +this online, I figured out that a lot of compilers will allow you to stop +compilation at this step. This would be useful for compiling each source code +file separately. This saves time later if a single file changes; only that file +needs to be recompiled. *** Step 4 -Finally, the object code file generated by the assembler is linked -together with the object code files for any library functions used to -produce a shared library, dynamic library, or an executable file. It -replaces all references to undefined symbols with the correct addresses. +Finally, the object code file generated by the assembler is linked together with +the object code files for any library functions used to produce a shared +library, dynamic library, or an executable file. It replaces all references to +undefined symbols with the correct addresses. diff --git a/content/blog/2019-01-07-useful-css.org b/content/blog/2019-01-07-useful-css.org index fa5edc5..c3c4b19 100644 --- a/content/blog/2019-01-07-useful-css.org +++ b/content/blog/2019-01-07-useful-css.org @@ -4,34 +4,30 @@ #+filetags: :dev: * Introduction to CSS -[[https://en.wikipedia.org/wiki/CSS][CSS]], the language used to markup -HTML code and make it "pretty", is one of the most effective ways to -increase the attractiveness of a website. It can also lead to increased -user engagement, retention, and satisfaction. In fact, there are whole -career fields are dedicated to the improvement of user experiences, +[[https://en.wikipedia.org/wiki/CSS][CSS]], the language used to markup HTML code and make it "pretty", is one of the +most effective ways to increase the attractiveness of a website. It can also +lead to increased user engagement, retention, and satisfaction. In fact, there +are whole career fields are dedicated to the improvement of user experiences, known as UI design and UX design. -Some web developers are used to the common CSS properties, such as -element sizing, fonts, colors, etc., but are not as well versed in -less-used properties and values such as =flexbox=, =clip-path=, and -=transform=. This article will provide some insight into the less-used -and unique CSS properties. +Some web developers are used to the common CSS properties, such as element +sizing, fonts, colors, etc., but are not as well versed in less-used properties +and values such as =flexbox=, =clip-path=, and =transform=. This article will +provide some insight into the less-used and unique CSS properties. * CSS Variables -The first topic today is CSS variables. Variables are not often used by -smaller developers. CSS variables allow you to give your website a -well-defined structure, where you can easily reuse CSS properties -throughout the project. +The first topic today is CSS variables. Variables are not often used by smaller +developers. CSS variables allow you to give your website a well-defined +structure, where you can easily reuse CSS properties throughout the project. -You can use variables to define things, such as color palettes. Then, -you can use these colors for backgrounds anywhere else in the HTML. This -could be extended, where extra variables could be defined for -=primary-text=, =quoted-text=, etc. Variables can also be used to define -spacing (e.g. =32px= or =2rem=), which can then be applied to margins, -padding, font sizes, and more. +You can use variables to define things, such as color palettes. Then, you can +use these colors for backgrounds anywhere else in the HTML. This could be +extended, where extra variables could be defined for =primary-text=, +=quoted-text=, etc. Variables can also be used to define spacing (e.g. =32px= or +=2rem=), which can then be applied to margins, padding, font sizes, and more. -For example, here are some variables defined at the root of the website, -which allows for any subsequent CSS rules to use those variables: +For example, here are some variables defined at the root of the website, which +allows for any subsequent CSS rules to use those variables: #+begin_src css :root { @@ -46,23 +42,21 @@ body { #+end_src * CSS Box Shadows -Box shadows were once my mortal enemy. No matter how hard I tried, I -just couldn't get them to work how I wanted. Because of this, my -favorite discovery has been CSSMatic's -[[https://www.cssmatic.com/box-shadow][box shadow generator]]. It -provides an excellent tool to generate box shadows using their simple -sliders. Surprisingly, this is the reason I learned how box shadows -work! You can use the sliders and watch how the CSS code changes in the -image that is displayed. Through this, you should understand that the -basic structure for box shadows is: +Box shadows were once my mortal enemy. No matter how hard I tried, I just +couldn't get them to work how I wanted. Because of this, my favorite discovery +has been CSSMatic's [[https://www.cssmatic.com/box-shadow][box shadow generator]]. It provides an excellent tool to +generate box shadows using their simple sliders. Surprisingly, this is the +reason I learned how box shadows work! You can use the sliders and watch how the +CSS code changes in the image that is displayed. Through this, you should +understand that the basic structure for box shadows is: #+begin_src css box-shadow: inset horizontal vertical blur spread color; #+end_src -Now, let's look at some basic examples! You can copy and paste the -following code into a site like CodePen or your own HTML files. Feel -free to play around with the code, experiment, and learn. +Now, let's look at some basic examples! You can copy and paste the following +code into a site like CodePen or your own HTML files. Feel free to play around +with the code, experiment, and learn. *Box Shadow #1* @@ -118,21 +112,19 @@ free to play around with the code, experiment, and learn. } #+end_src -Try these box shadows out on your own and see how changing each shadow -value works. +Try these box shadows out on your own and see how changing each shadow value +works. * CSS Flexbox -Now, let's move on to the best part of this article: flexbox. The -flexbox is by far my favorite new toy. I originally stumbled across this -solution after looking for more efficient ways of centering content -horizontally AND vertically. I had used a few hack-ish methods before, -but flexbox throws those out the window. The best part of it all is that -flexbox is /dead simple/. - -Flexbox pertains to the parent div of any element. You want the parent -to be the flexbox in which items are arranged to use the flex methods. -It's easier to see this in action that explained, so let's see an -example. +Now, let's move on to the best part of this article: flexbox. The flexbox is by +far my favorite new toy. I originally stumbled across this solution after +looking for more efficient ways of centering content horizontally AND +vertically. I had used a few hack-ish methods before, but flexbox throws those +out the window. The best part of it all is that flexbox is /dead simple/. + +Flexbox pertains to the parent div of any element. You want the parent to be the +flexbox in which items are arranged to use the flex methods. It's easier to see +this in action that explained, so let's see an example. *Flexbox* @@ -167,23 +159,20 @@ example. } #+end_src -You may notice that we no longer need to use the =top= property for the -=h3= elements in our code. This is because we set the display box to be -a flex container for the small boxes, AND we made the small boxes flex -containers for their elements (the h3 tags). Flex boxes can be nested -like this to center content that is inside centered content. +You may notice that we no longer need to use the =top= property for the =h3= +elements in our code. This is because we set the display box to be a flex +container for the small boxes, AND we made the small boxes flex containers for +their elements (the h3 tags). Flex boxes can be nested like this to center +content that is inside centered content. -For the example above, we designated the =justify-content= property to -be =flex-start= so that the boxes stack from the left side of the -screen. This property can be changed to =center= to make the boxes -appear in the center of the screen. +For the example above, we designated the =justify-content= property to be +=flex-start= so that the boxes stack from the left side of the screen. This +property can be changed to =center= to make the boxes appear in the center of +the screen. -For an interactive example, -[[https://codepen.io/LandonSchropp/pen/KpzzGo][check out this CodePen]] -from [[https://codepen.io/LandonSchropp/][LandonScropp]]. Resize the +For an interactive example, [[https://codepen.io/LandonSchropp/pen/KpzzGo][check out this CodePen]] from [[https://codepen.io/LandonSchropp/][LandonScropp]]. Resize the window with dice to see how they collapse and re-align. * Even More CSS -For more inspiration, you can visit [[https://www.codepen.io][CodePen]], -[[https://dribbble.com][Dribbble]], or [[https://uimovement.com][UI -Movement]] to browse the collections of many amazing web designers. +For more inspiration, you can visit [[https://www.codepen.io][CodePen]], [[https://dribbble.com][Dribbble]], or [[https://uimovement.com][UI Movement]] to browse +the collections of many amazing web designers. diff --git a/content/blog/2019-09-09-audit-analytics.org b/content/blog/2019-09-09-audit-analytics.org index 77b3082..5621b5f 100644 --- a/content/blog/2019-09-09-audit-analytics.org +++ b/content/blog/2019-09-09-audit-analytics.org @@ -4,111 +4,103 @@ #+filetags: :audit: * What Are Data Analytics? -A quick aside before I dive into this post: =data analytics= is a vague -term that has become popular in recent years. Think of a =data analytic= -as the output of any data analysis you perform. For example, a pivot -table or a pie chart could be a data analytic. - -[[https://en.wikipedia.org/wiki/Data_analysis][Data analysis]] is a -process that utilizes statistics and other mathematical methods to -discover useful information within datasets. This involves examining, -cleaning, transforming, and modeling data so that you can use the data -to support an opinion, create more useful viewpoints, and gain knowledge -to implement into audit planning or risk assessments. - -One of the common mistakes that managers (and anyone new to the process) -make is assuming that everything involved with this process is "data -analytics". In fact, data analytics are only a small part of the -process. - -See *Figure 1** for a more accurate representation of where data analysis -sits within the full process. This means that data analysis does not -include querying or extracting data, selecting samples, or performing -audit tests. These steps can be necessary for an audit (and may even be -performed by the same associates), but they are not data analytics. +A quick aside before I dive into this post: =data analytics= is a vague term +that has become popular in recent years. Think of a =data analytic= as the +output of any data analysis you perform. For example, a pivot table or a pie +chart could be a data analytic. + +[[https://en.wikipedia.org/wiki/Data_analysis][Data analysis]] is a process that utilizes statistics and other mathematical +methods to discover useful information within datasets. This involves examining, +cleaning, transforming, and modeling data so that you can use the data to +support an opinion, create more useful viewpoints, and gain knowledge to +implement into audit planning or risk assessments. + +One of the common mistakes that managers (and anyone new to the process) make is +assuming that everything involved with this process is "data analytics". In +fact, data analytics are only a small part of the process. + +See *Figure 1** for a more accurate representation of where data analysis sits +within the full process. This means that data analysis does not include querying +or extracting data, selecting samples, or performing audit tests. These steps +can be necessary for an audit (and may even be performed by the same +associates), but they are not data analytics. #+caption: The Intelligence Cycle [[https://img.cleberg.net/blog/20190909-data-analysis-in-auditing/intelligence_cycle-min.png]] * Current Use of Analytics in Auditing -While data analysis has been an integral part of most businesses and -departments for the better part of the last century, only recently have -internal audit functions been adopting this practice. The internal audit -function works exclusively to provide assurance and consulting services -to the business areas within the firm (except for internal auditing -firms who are hired by different companies to perform their roles). +While data analysis has been an integral part of most businesses and departments +for the better part of the last century, only recently have internal audit +functions been adopting this practice. The internal audit function works +exclusively to provide assurance and consulting services to the business areas +within the firm (except for internal auditing firms who are hired by different +companies to perform their roles). #+begin_quote -Internal Auditing helps an organization accomplish its objectives by -bringing a systematic, disciplined approach to evaluate and improve the -effectiveness of risk management, control and governance processes. +Internal Auditing helps an organization accomplish its objectives by bringing a +systematic, disciplined approach to evaluate and improve the effectiveness of +risk management, control and governance processes. - The IIA's Definition of Internal Audit #+end_quote -Part of the blame for the slow adoption of data analysis can be -attributed to the fact that internal auditing is strongly based on -tradition and following the precedents set by previous auditors. -However, there can be no progress without auditors who are willing to -break the mold and test new audit techniques. In fact, as of 2018, -[[https://www.cpapracticeadvisor.com/accounting-audit/news/12404086/internal-audit-groups-are-lagging-in-data-analytics][only -63% of internal audit departments currently utilize data analytics]] in -North America. This number should be as close as possible to 100%. I -have never been part of an audit that would not have benefited from data +Part of the blame for the slow adoption of data analysis can be attributed to +the fact that internal auditing is strongly based on tradition and following the +precedents set by previous auditors. However, there can be no progress without +auditors who are willing to break the mold and test new audit techniques. In +fact, as of 2018, [[https://www.cpapracticeadvisor.com/accounting-audit/news/12404086/internal-audit-groups-are-lagging-in-data-analytics][only 63% of internal audit departments currently utilize data +analytics]] in North America. This number should be as close as possible to 100%. +I have never been part of an audit that would not have benefited from data analytics. -So, how do internal audit functions remedy this situation? It's -definitely not as easy as walking into work on Monday and telling your -Chief Audit Executive that you're going to start implementing analytics -in the next audit. You need a plan and a system to make the analysis -process as effective as possible. +So, how do internal audit functions remedy this situation? It's definitely not +as easy as walking into work on Monday and telling your Chief Audit Executive +that you're going to start implementing analytics in the next audit. You need a +plan and a system to make the analysis process as effective as possible. * The DELTA Model One of the easiest ways to experiment with data analytics and gain an -understanding of the processes is to implement them within your own -department. But how do we do this if we've never worked with analysis -before? One of the most common places to start is to research some data -analysis models currently available. For this post, we'll take a look at -the DELTA model. You can take a look at ****Figure 2***** for a quick -overview of the model. +understanding of the processes is to implement them within your own department. +But how do we do this if we've never worked with analysis before? One of the +most common places to start is to research some data analysis models currently +available. For this post, we'll take a look at the DELTA model. You can take a +look at ****Figure 2***** for a quick overview of the model. -The DELTA model sets a few guidelines for areas wanting to implement -data analytics so that the results can be as comprehensive as possible: +The DELTA model sets a few guidelines for areas wanting to implement data +analytics so that the results can be as comprehensive as possible: - *Data*: Must be clean, accessible, and (usually) unique. -- *Enterprise-Wide Focus*: Key data systems and analytical resources - must be available for use (by the Internal Audit Function). -- *Leaders*: Must promote a data analytics approach and show the value - of analytical results. -- *Targets*: Must be set for key areas and risks that the analytics can - be compared against (KPIs). -- *Analysts*: There must be auditors willing and able to perform data - analytics or else the system cannot be sustained. +- *Enterprise-Wide Focus*: Key data systems and analytical resources must be + available for use (by the Internal Audit Function). +- *Leaders*: Must promote a data analytics approach and show the value of + analytical results. +- *Targets*: Must be set for key areas and risks that the analytics can be + compared against (KPIs). +- *Analysts*: There must be auditors willing and able to perform data analytics + or else the system cannot be sustained. #+caption: The Delta Model [[https://img.cleberg.net/blog/20190909-data-analysis-in-auditing/delta-min.png]] * Finding the Proper KPIs -Once the Internal Audit Function has decided that they want to start -using data analytics internally and have ensured they're properly set up -to do so, they need to figure out what they will be testing against. Key -Performance Indicators (KPIs) are qualitative or quantitative factors -that can be evaluated and assessed to determine if the department is -performing well, usually compared to historical or industry benchmarks. -Once KPIs have been agreed upon and set, auditors can use data analytics -to assess and report on these KPIs. This allows the person performing -the analytics the freedom to express opinions on the results, whereas -the results are ambiguous if no KPIs exist. - -It should be noted that tracking KPIs in the department can help ensure -you have a rigorous Quality Assurance and Improvement Program (QAIP) in -accordance with some applicable standards, such as IPPF Standard 1300. +Once the Internal Audit Function has decided that they want to start using data +analytics internally and have ensured they're properly set up to do so, they +need to figure out what they will be testing against. Key Performance Indicators +(KPIs) are qualitative or quantitative factors that can be evaluated and +assessed to determine if the department is performing well, usually compared to +historical or industry benchmarks. Once KPIs have been agreed upon and set, +auditors can use data analytics to assess and report on these KPIs. This allows +the person performing the analytics the freedom to express opinions on the +results, whereas the results are ambiguous if no KPIs exist. + +It should be noted that tracking KPIs in the department can help ensure you have +a rigorous Quality Assurance and Improvement Program (QAIP) in accordance with +some applicable standards, such as IPPF Standard 1300. #+begin_quote -The chief audit executive must develop and maintain a quality assurance -and improvement program that covers all aspects of the internal audit -activity. +The chief audit executive must develop and maintain a quality assurance and +improvement program that covers all aspects of the internal audit activity. - IPPF Standard 1300 @@ -117,103 +109,94 @@ activity. Additionally, IPPF Standard 2060 discusses reporting: #+begin_quote -The chief audit executive must report periodically to senior management -and the board on the internal audit activity's purpose, authority, -responsibility, and performance relative to its plan and on its -conformance with the Code of Ethics and the Standards. Reporting must -also include significant risk and control issues, including fraud risks, -governance issues, and other matters that require the attention of -senior management and/or the board. +The chief audit executive must report periodically to senior management and the +board on the internal audit activity's purpose, authority, responsibility, and +performance relative to its plan and on its conformance with the Code of Ethics +and the Standards. Reporting must also include significant risk and control +issues, including fraud risks, governance issues, and other matters that require +the attention of senior management and/or the board. - IPPF Standard 2060 #+end_quote -The hardest part of finding KPIs is to determine which KPIs are -appropriate for your department. Since every department is different and -has different goals, KPIs will vary drastically between companies. To -give you an idea of where to look, here are some ideas I came up with -when discussing the topic with a few colleagues. +The hardest part of finding KPIs is to determine which KPIs are appropriate for +your department. Since every department is different and has different goals, +KPIs will vary drastically between companies. To give you an idea of where to +look, here are some ideas I came up with when discussing the topic with a few +colleagues. - Efficiency/Budgeting: - - Audit hours to staff utilization ratio (annual hours divided by - total annual work hours). + - Audit hours to staff utilization ratio (annual hours divided by total annual + work hours). - Audit hours compared to the number of audits completed. - - Time between audit steps or to complete the whole audit. E.g., time - from fieldwork completion to audit report issuance. + - Time between audit steps or to complete the whole audit. E.g., time from + fieldwork completion to audit report issuance. - Reputation: - The frequency that management has requested the services of the IAF. - - Management, audit committee, or external audit satisfaction survey - results. - - Education, experience, certifications, tenure, and training of the - auditors on staff. + - Management, audit committee, or external audit satisfaction survey results. + - Education, experience, certifications, tenure, and training of the auditors + on staff. - Quality: - - Number and frequency of audit findings. Assign monetary or numerical - values, if possible. + - Number and frequency of audit findings. Assign monetary or numerical values, + if possible. - Percentage of recommendations issued and implemented. - Planning: - Percentage or number of key risks audited per year or per audit. - Proportion of audit universe audited per year. * Data Analysis Tools -Finally, to be able to analyze and report on the data analysis, auditors -need to evaluate the tools at their disposal. There are many options -available, but a few of the most common ones can easily get the job -done. For example, almost every auditor already has access to Microsoft -Excel. Excel is more powerful than most people give it credit for and -can accomplish a lot of basic statistics without much work. If you don't -know a lot about statistics but still want to see some of the more basic -results, Excel is a great option. - -To perform more in-depth statistical analysis or to explore large -datasets that Excel cannot handle, auditors will need to explore other -options. The big three that have had a lot of success in recent years -are Python, R, and ACL. ACL can be used as either a graphical tool -(point and click) or as a scripting tool, where the auditor must write -the scripts manually. Python and the R-language are solely scripting -languages. - -The general trend in the data analytics environment is that if the tool -allows you to do everything by clicking buttons or dragging elements, -you won't be able to fully utilize the analytics you need. The most -robust solutions are created by those who understand how to write the -scripts manually. It should be noted that as the utility of a tool -increases, it usually means that the learning curve for that tool will -also be higher. It will take auditors longer to learn how to utilize -Python, R, or ACL versus learning how to utilize Excel. +Finally, to be able to analyze and report on the data analysis, auditors need to +evaluate the tools at their disposal. There are many options available, but a +few of the most common ones can easily get the job done. For example, almost +every auditor already has access to Microsoft Excel. Excel is more powerful than +most people give it credit for and can accomplish a lot of basic statistics +without much work. If you don't know a lot about statistics but still want to +see some of the more basic results, Excel is a great option. + +To perform more in-depth statistical analysis or to explore large datasets that +Excel cannot handle, auditors will need to explore other options. The big three +that have had a lot of success in recent years are Python, R, and ACL. ACL can +be used as either a graphical tool (point and click) or as a scripting tool, +where the auditor must write the scripts manually. Python and the R-language are +solely scripting languages. + +The general trend in the data analytics environment is that if the tool allows +you to do everything by clicking buttons or dragging elements, you won't be able +to fully utilize the analytics you need. The most robust solutions are created +by those who understand how to write the scripts manually. It should be noted +that as the utility of a tool increases, it usually means that the learning +curve for that tool will also be higher. It will take auditors longer to learn +how to utilize Python, R, or ACL versus learning how to utilize Excel. * Visualization -Once an auditor has finally found the right data, KPIs, and tools, they -must report these results so that actions can be taken. Performing -in-depth data analysis is only useful if the results are understood by -the audiences of the data. The best way to create this understanding is -to visualize the results of the data. Let's take a look at some of the -best options to visualize and report the results you've found. - -Some of the most popular commercial tools for visualization are -Microsoft PowerBI and Tableau Desktop. However, other tools exist such -as JMP, Plotly, Qlikview, Alteryx, or D3. Some require commercial -licenses while others are simply free to use. For corporate data, you -may want to make sure that the tool does not communicate any of the data -outside the company (such as cloud storage). I won't be going into depth -on any of these tools since visualization is largely a subjective and -creative experience, but remember to constantly explore new options as -you repeat the process. - -Lastly, let's take a look at an example of data visualization. This -example comes from a -[[https://talent.works/2018/03/28/the-science-of-the-job-search-part-iii-61-of-entry-level-jobs-require-3-years-of-experience/][blog -post written by Kushal Chakrabarti]] in 2018 about the percent of -entry-level US jobs that require experience. *Figure 3** shows us an -easy-to-digest picture of the data. We can quickly tell that only about -12.5% of entry-level jobs don't require experience. - -This is the kind of result that easily describes the data for you. -However, make sure to include an explanation of what the results mean. -Don't let the reader assume what the data means, especially if it -relates to a complex subject. /Tell a story/ about the data and why the -results matter. For example, *Figure 4** shows a part of the explanation -the author gives to illustrate his point. +Once an auditor has finally found the right data, KPIs, and tools, they must +report these results so that actions can be taken. Performing in-depth data +analysis is only useful if the results are understood by the audiences of the +data. The best way to create this understanding is to visualize the results of +the data. Let's take a look at some of the best options to visualize and report +the results you've found. + +Some of the most popular commercial tools for visualization are Microsoft +PowerBI and Tableau Desktop. However, other tools exist such as JMP, Plotly, +Qlikview, Alteryx, or D3. Some require commercial licenses while others are +simply free to use. For corporate data, you may want to make sure that the tool +does not communicate any of the data outside the company (such as cloud +storage). I won't be going into depth on any of these tools since visualization +is largely a subjective and creative experience, but remember to constantly +explore new options as you repeat the process. + +Lastly, let's take a look at an example of data visualization. This example +comes from a [[https://talent.works/2018/03/28/the-science-of-the-job-search-part-iii-61-of-entry-level-jobs-require-3-years-of-experience/][blog post written by Kushal Chakrabarti]] in 2018 about the percent +of entry-level US jobs that require experience. *Figure 3** shows us an +easy-to-digest picture of the data. We can quickly tell that only about 12.5% of +entry-level jobs don't require experience. + +This is the kind of result that easily describes the data for you. However, make +sure to include an explanation of what the results mean. Don't let the reader +assume what the data means, especially if it relates to a complex subject. /Tell +a story/ about the data and why the results matter. For example, *Figure 4** +shows a part of the explanation the author gives to illustrate his point. #+caption: Entry-Level Visualization [[https://img.cleberg.net/blog/20190909-data-analysis-in-auditing/vis_example-min.png]] @@ -222,8 +205,7 @@ the author gives to illustrate his point. [[https://img.cleberg.net/blog/20190909-data-analysis-in-auditing/vis_example_explanation-min.png]] * Wrap-Up -While this is not an all-encompassing program that you can just adopt -into your department, it should be enough to get anyone started on the -process of understanding and implementing data analytics. Always -remember to continue learning and exploring new options as your -processes grow and evolve. +While this is not an all-encompassing program that you can just adopt into your +department, it should be enough to get anyone started on the process of +understanding and implementing data analytics. Always remember to continue +learning and exploring new options as your processes grow and evolve. diff --git a/content/blog/2019-12-03-the-ansoff-matrix.org b/content/blog/2019-12-03-the-ansoff-matrix.org index c845b2e..1bee6a8 100644 --- a/content/blog/2019-12-03-the-ansoff-matrix.org +++ b/content/blog/2019-12-03-the-ansoff-matrix.org @@ -4,114 +4,102 @@ #+filetags: :business: * Overview -As the world of business evolves, managers must approach business -planning and strategy with a contemporary mindset. According to Dess, -McNamara, Eisner, and Lee, managers must be willing to adapt to the -modern business environment by going beyond "'incremental management', -whereby they view their job as making a series of small, minor changes -to improve the efficiency of the firm's operations"(2019). +As the world of business evolves, managers must approach business planning and +strategy with a contemporary mindset. According to Dess, McNamara, Eisner, and +Lee, managers must be willing to adapt to the modern business environment by +going beyond "'incremental management', whereby they view their job as making a +series of small, minor changes to improve the efficiency of the firm's +operations"(2019). -One reason that strategic management is crucial is because most -businesses that fail in the United States each year fail due to a lack -of strategic focus or direction(2019). The rate of failure for -businesses with poor strategies shows that strategic planning and -management are crucial to a business's strength and longevity, injecting -the critical factors of growth and direction into a company's business -plan. +One reason that strategic management is crucial is because most businesses that +fail in the United States each year fail due to a lack of strategic focus or +direction(2019). The rate of failure for businesses with poor strategies shows +that strategic planning and management are crucial to a business's strength and +longevity, injecting the critical factors of growth and direction into a +company's business plan. -One of the most significant strategic planning and management frameworks -that companies can use is the -[[https://en.wikipedia.org/wiki/Ansoff_matrix][Ansoff Matrix]]. While -this framework has unique purposes and use-cases, it can effectively -help an organization grow and compete. Specifically, the Ansoff matrix -is one of the most effective frameworks for companies who want to focus -on increasing sales revenue or profitability(2019). +One of the most significant strategic planning and management frameworks that +companies can use is the [[https://en.wikipedia.org/wiki/Ansoff_matrix][Ansoff Matrix]]. While this framework has unique purposes +and use-cases, it can effectively help an organization grow and compete. +Specifically, the Ansoff matrix is one of the most effective frameworks for +companies who want to focus on increasing sales revenue or profitability(2019). -This framework uses a two-by-two figure to show the four strategic -options for companies to use in this framework: market penetration, -market development, product development, and diversification (see -*Figure 1*). The x-axis of the matrix focuses on the firm's markets and -also determines if the firm is looking to enter new markets or innovate -in its current markets. The y-axis of the matrix focuses on the firm's -products and determines if the firm wants to pursue strategies around -their existing products or explore new products. +This framework uses a two-by-two figure to show the four strategic options for +companies to use in this framework: market penetration, market development, +product development, and diversification (see *Figure 1*). The x-axis of the +matrix focuses on the firm's markets and also determines if the firm is looking +to enter new markets or innovate in its current markets. The y-axis of the +matrix focuses on the firm's products and determines if the firm wants to pursue +strategies around their existing products or explore new products. #+caption: The Ansoff Matrix by JaisonAbeySabu, Own work, CC BY-SA 3.0 [[https://img.cleberg.net/blog/20191203-the-ansoff-matrix/ansoff_matrix-min.png]] * Strategic Options ** Market Penetration -The most straightforward strategy in the Ansoff matrix is to focus on -existing products in existing markets, also known as market -penetration(2019). Companies such as Coca-Cola have used market -penetration successfully by investing a lot of money to get further -value out of their current markets. Coca-Cola does this by introducing -new features such as Christmas-themed bottles, personal names on the -bottles, and other marketing schemes. +The most straightforward strategy in the Ansoff matrix is to focus on existing +products in existing markets, also known as market penetration(2019). Companies +such as Coca-Cola have used market penetration successfully by investing a lot +of money to get further value out of their current markets. Coca-Cola does this +by introducing new features such as Christmas-themed bottles, personal names on +the bottles, and other marketing schemes. ** Market Development -Market development extends existing products into new markets in an -attempt to increase the number of buyers. One interesting way that -Coca-Cola used this strategy comes from the stigma that Diet Coke is a -woman's drink(2019). Coca-Cola introduced Coca-Cola Zero, which -contained the same nutritional content as Diet Coke, but was packaged in -a dark black can to appear more "manly"(2019). +Market development extends existing products into new markets in an attempt to +increase the number of buyers. One interesting way that Coca-Cola used this +strategy comes from the stigma that Diet Coke is a woman's drink(2019). +Coca-Cola introduced Coca-Cola Zero, which contained the same nutritional +content as Diet Coke, but was packaged in a dark black can to appear more +"manly"(2019). ** Product Development -Product development uses existing markets to introduce new products so -that the firm can better meet customer needs(2019). The extreme end of -diversification is home to companies such as Johnson & Johnson, a -healthcare company that has developed a business portfolio of more than -60,000 different products(2019). Johnson & Johnson's dedication to -continuous diversification has led them to a balance sheet rating of -"AAA", industry recognition for diversification, and increases in their -investor dividends for 57 consecutive years(2019). +Product development uses existing markets to introduce new products so that the +firm can better meet customer needs(2019). The extreme end of diversification is +home to companies such as Johnson & Johnson, a healthcare company that has +developed a business portfolio of more than 60,000 different products(2019). +Johnson & Johnson's dedication to continuous diversification has led them to a +balance sheet rating of "AAA", industry recognition for diversification, and +increases in their investor dividends for 57 consecutive years(2019). ** Related Diversification -Diversification, the final strategy of the Ansoff Matrix, is more -difficult than the others since it involves exploring both new markets -and new products. Related diversification is a diversification strategy -that closely relates to the firm's core business. Coca-Cola's best -example of related diversification is its acquisition of Glaceau and -Vitamin Water, which expanded their drinking lines of business(2019). +Diversification, the final strategy of the Ansoff Matrix, is more difficult than +the others since it involves exploring both new markets and new products. +Related diversification is a diversification strategy that closely relates to +the firm's core business. Coca-Cola's best example of related diversification is +its acquisition of Glaceau and Vitamin Water, which expanded their drinking +lines of business(2019). ** Unrelated Diversification -Unrelated diversification is a diversification strategy that does not -really relate to the firm's core business but still diversifies their -business portfolio. A good example of this would be a coffee company who -has decided to enter the market for bicycle sales. The main purpose of -this strategy is to an extremely diverse company that will not go -bankrupt if one market goes through difficult times. However, this -requires a lot of independent skills and heavy investments since the -company most likely cannot easily transfer knowledge between the markets -they compete in. +Unrelated diversification is a diversification strategy that does not really +relate to the firm's core business but still diversifies their business +portfolio. A good example of this would be a coffee company who has decided to +enter the market for bicycle sales. The main purpose of this strategy is to an +extremely diverse company that will not go bankrupt if one market goes through +difficult times. However, this requires a lot of independent skills and heavy +investments since the company most likely cannot easily transfer knowledge +between the markets they compete in. * Requirements for Success -To use the Ansoff Matrix framework, managers need to formulate corporate -goals and objectives. Without goals and direction, management frameworks -do not present much practical utility. Further, the Ansoff Matrix -requires the managers involved to make tactical decisions and create a -path for the company to take toward their goals. Lastly, both the Ansoff -Matrix needs to consider both internal and external perspectives -throughout the strategy formulation process. +To use the Ansoff Matrix framework, managers need to formulate corporate goals +and objectives. Without goals and direction, management frameworks do not +present much practical utility. Further, the Ansoff Matrix requires the managers +involved to make tactical decisions and create a path for the company to take +toward their goals. Lastly, both the Ansoff Matrix needs to consider both +internal and external perspectives throughout the strategy formulation process. -One interesting probability is that companies will be using multiple -strategic planning and management frameworks at the same time. While -this may sound like it could crowd the management process, there are -numerous reasons to do so. For example, the Ansoff Matrix and the -Balanced Scorecard are relatively popular, and they cover entirely -different parts of a company's strategy. Using the results from the -Balanced Scorecard could inform a company of the potential product and -market demands, such as from customer or supplier survey results, to -help the company determine which Ansoff Matrix strategy to pursue. -However, a combined approach at this level would require mature -frameworks and focused managers who are able to strategize at a high -level. +One interesting probability is that companies will be using multiple strategic +planning and management frameworks at the same time. While this may sound like +it could crowd the management process, there are numerous reasons to do so. For +example, the Ansoff Matrix and the Balanced Scorecard are relatively popular, +and they cover entirely different parts of a company's strategy. Using the +results from the Balanced Scorecard could inform a company of the potential +product and market demands, such as from customer or supplier survey results, to +help the company determine which Ansoff Matrix strategy to pursue. However, a +combined approach at this level would require mature frameworks and focused +managers who are able to strategize at a high level. -Lastly, it should be noted that the author of the Ansoff matrix, Igor -Ansoff, often used the term -[[https://en.wikipedia.org/wiki/Analysis_paralysis][paralysis by -analysis]] to explain the mistake of companies who overuse analysis and -spend too much time planning. Companies need to understand the utility -of a strategic management framework while ensuring that the company is -poised to execute as efficiently as they have planned. +Lastly, it should be noted that the author of the Ansoff matrix, Igor Ansoff, +often used the term [[https://en.wikipedia.org/wiki/Analysis_paralysis][paralysis by analysis]] to explain the mistake of companies +who overuse analysis and spend too much time planning. Companies need to +understand the utility of a strategic management framework while ensuring that +the company is poised to execute as efficiently as they have planned. diff --git a/content/blog/2019-12-16-password-security.org b/content/blog/2019-12-16-password-security.org index 0ebbb84..465afdc 100644 --- a/content/blog/2019-12-16-password-security.org +++ b/content/blog/2019-12-16-password-security.org @@ -5,117 +5,99 @@ * Users ** Why Does It Matter? -Information security, including passwords and identities, has become one -of the most important digital highlights of the last decade. With -[[https://www.usatoday.com/story/money/2018/12/28/data-breaches-2018-billions-hit-growing-number-cyberattacks/2413411002/][billions -of people affected by data breaches each year]], there's a greater need -to introduce strong information security systems. If you think you've -been part of a breach, or you want to check and see, you can use -[[https://haveibeenpwned.com/][Have I Been Pwned]] to see if your email -has been involved in any public breaches. Remember that there's a -possibility that a company experienced a breach and did not report it to -anyone. +Information security, including passwords and identities, has become one of the +most important digital highlights of the last decade. With [[https://www.usatoday.com/story/money/2018/12/28/data-breaches-2018-billions-hit-growing-number-cyberattacks/2413411002/][billions of people +affected by data breaches each year]], there's a greater need to introduce strong +information security systems. If you think you've been part of a breach, or you +want to check and see, you can use [[https://haveibeenpwned.com/][Have I Been Pwned]] to see if your email has +been involved in any public breaches. Remember that there's a possibility that a +company experienced a breach and did not report it to anyone. ** How Do I Protect Myself? -The first place to start with any personal security check-up is to -gather a list of all the different websites, apps, or programs that -require you to have login credentials. Optionally, once you know where -your information is being stored, you can sort the list from the -most-important items such as banks or government logins to less -important items such as your favorite meme site. You will want to ensure -that your critical logins are secure before getting to the others. +The first place to start with any personal security check-up is to gather a list +of all the different websites, apps, or programs that require you to have login +credentials. Optionally, once you know where your information is being stored, +you can sort the list from the most-important items such as banks or government +logins to less important items such as your favorite meme site. You will want to +ensure that your critical logins are secure before getting to the others. Once you think you have a good idea of all your different authentication -methods, I recommend using a password manager such as -[[https://bitwarden.com/][Bitwarden]]. Using a password manager allows -you to automatically save your logins, create randomized passwords, and -transfer passwords across devices. However, you'll need to memorize your -"vault password" that allows you to open the password manager. It's -important to make this something hard to guess since it would allow -anyone who has it to access every password you've stored in there. +methods, I recommend using a password manager such as [[https://bitwarden.com/][Bitwarden]]. Using a +password manager allows you to automatically save your logins, create randomized +passwords, and transfer passwords across devices. However, you'll need to +memorize your "vault password" that allows you to open the password manager. +It's important to make this something hard to guess since it would allow anyone +who has it to access every password you've stored in there. -Personally, I recommend using a -[[https://en.wikipedia.org/wiki/Passphrase][passphrase]] instead of a -[[https://en.wikipedia.org/wiki/Password][password]] for your vault -password. Instead of using a string of characters (whether random or -simple), use a phrase and add in symbols and a number. For example, your -vault password could be =Racing-Alphabet-Gourd-Parrot3=. Swap the -symbols out for whichever symbol you want, move the number around, and -fine-tune the passphrase until you are confident that you can remember -it whenever necessary. +Personally, I recommend using a [[https://en.wikipedia.org/wiki/Passphrase][passphrase]] instead of a [[https://en.wikipedia.org/wiki/Password][password]] for your vault +password. Instead of using a string of characters (whether random or simple), +use a phrase and add in symbols and a number. For example, your vault password +could be =Racing-Alphabet-Gourd-Parrot3=. Swap the symbols out for whichever +symbol you want, move the number around, and fine-tune the passphrase until you +are confident that you can remember it whenever necessary. -Once you've stored your passwords, make sure you continually check up on -your account and make sure you aren't following bad password practices. -Krebs on Security has a great -[[https://krebsonsecurity.com/password-dos-and-donts/][blog post on -password recommendations]]. Any time that a data breach happens, make -sure you check to see if you were included, and if you need to reset any -account passwords. +Once you've stored your passwords, make sure you continually check up on your +account and make sure you aren't following bad password practices. Krebs on +Security has a great [[https://krebsonsecurity.com/password-dos-and-donts/][blog post on password recommendations]]. Any time that a data +breach happens, make sure you check to see if you were included, and if you need +to reset any account passwords. * Developers ** What Are the Basic Requirements? -When developing any password-protected application, there are a few -basic rules that anyone should follow even if they do not follow any -official guidelines such as NIST. The foremost practice is to require -users to use passwords that are at least 8 characters and cannot easily -be guessed. This sounds extremely simple, but it requires quite a few -different strategies. First, the application should check the potential -passwords against a dictionary of insecure passwords such =password=, -=1234abc=, or =application_name=. +When developing any password-protected application, there are a few basic rules +that anyone should follow even if they do not follow any official guidelines +such as NIST. The foremost practice is to require users to use passwords that +are at least 8 characters and cannot easily be guessed. This sounds extremely +simple, but it requires quite a few different strategies. First, the application +should check the potential passwords against a dictionary of insecure passwords +such =password=, =1234abc=, or =application_name=. -Next, the application should offer guidance on the strength of passwords -being entered during enrollment. Further, NIST officially recommends -*not** implementing any composition rules that make passwords hard to -remember (e.g. passwords with letters, numbers, and special characters) -and instead encouraging the use of long pass phrases which can include -spaces. It should be noted that to be able to keep spaces within -passwords, all unicode characters should be supported, and passwords -should not be truncated. +Next, the application should offer guidance on the strength of passwords being +entered during enrollment. Further, NIST officially recommends *not** +implementing any composition rules that make passwords hard to remember (e.g. +passwords with letters, numbers, and special characters) and instead encouraging +the use of long pass phrases which can include spaces. It should be noted that +to be able to keep spaces within passwords, all unicode characters should be +supported, and passwords should not be truncated. ** What Does NIST Recommend? -The National Institute of Standards and Technology -([[https://www.nist.gov][NIST]]) in the US Department of Commerce -regularly publishes information around information security and digital -identity guidelines. Recently, NIST published -[[https://pages.nist.gov/800-63-3/sp800-63b.html][Special Publication +The National Institute of Standards and Technology ([[https://www.nist.gov][NIST]]) in the US Department +of Commerce regularly publishes information around information security and +digital identity guidelines. Recently, NIST published [[https://pages.nist.gov/800-63-3/sp800-63b.html][Special Publication 800-63b]]: Digital Identity Guidelines and Authentication and Lifecycle Management. #+begin_quote -A Memorized Secret authenticator - commonly referred to as a password -or, if numeric, a PIN - is a secret value intended to be chosen and -memorized by the user. Memorized secrets need to be of sufficient -complexity and secrecy that it would be impractical for an attacker to -guess or otherwise discover the correct secret value. A memorized secret -is something you know. +A Memorized Secret authenticator - commonly referred to as a password or, if +numeric, a PIN - is a secret value intended to be chosen and memorized by the +user. Memorized secrets need to be of sufficient complexity and secrecy that it +would be impractical for an attacker to guess or otherwise discover the correct +secret value. A memorized secret is something you know. - NIST Special Publication 800-63B #+end_quote -NIST offers a lot of guidance on passwords, but I'm going to highlight -just a few of the important factors: +NIST offers a lot of guidance on passwords, but I'm going to highlight just a +few of the important factors: -- Require passwords to be a minimum of 8 characters (6 characters if - randomly generated and be generated using an approved random bit - generator). -- Compare potential passwords against a list that contains values known - to be commonly-used, expected, or compromised. +- Require passwords to be a minimum of 8 characters (6 characters if randomly + generated and be generated using an approved random bit generator). +- Compare potential passwords against a list that contains values known to be + commonly-used, expected, or compromised. - Offer guidance on password strength, such as a strength meter. - Implement a rate-limiting mechanism to limit the number of failed authentication attempts for each user account. -- Do not require composition rules for passwords and do not require - passwords to be changed periodically (unless compromised). -- Allow pasting of user identification and passwords to facilitate the - use of password managers. +- Do not require composition rules for passwords and do not require passwords to + be changed periodically (unless compromised). +- Allow pasting of user identification and passwords to facilitate the use of + password managers. - Allow users to view the password as it is being entered. -- Use secure forms of communication and storage, including salting and - hashing passwords using a one-way key derivation function. +- Use secure forms of communication and storage, including salting and hashing + passwords using a one-way key derivation function. -NIST offers further guidance on other devices that require specific -security policies, querying for passwords, and more. All the information -discussed so far comes from -[[https://pages.nist.gov/800-63-3/sp800-63b.html][NIST SP800-63b]] but -NIST offers a lot of information on digital identities, enrollment, -identity proofing, authentication, lifecycle management, federation, and -assertions in the total [[https://pages.nist.gov/800-63-3/][NIST -SP800-63 Digital Identity Guidelines]]. +NIST offers further guidance on other devices that require specific security +policies, querying for passwords, and more. All the information discussed so far +comes from [[https://pages.nist.gov/800-63-3/sp800-63b.html][NIST SP800-63b]] but NIST offers a lot of information on digital +identities, enrollment, identity proofing, authentication, lifecycle management, +federation, and assertions in the total [[https://pages.nist.gov/800-63-3/][NIST SP800-63 Digital Identity +Guidelines]]. diff --git a/content/blog/2020-01-25-linux-software.org b/content/blog/2020-01-25-linux-software.org index 8397483..54d7b85 100644 --- a/content/blog/2020-01-25-linux-software.org +++ b/content/blog/2020-01-25-linux-software.org @@ -8,24 +8,22 @@ #+caption: Etcher Screenshot [[https://img.cleberg.net/blog/20200125-the-best-linux-software/etcher.png]] -[[https://www.balena.io/etcher/][Etcher]] is a quick and easy way to -burn ISO images to CDs and USB devices. There are two different ways you -can install this program. First, you can navigate to the -[[https://www.balena.io/etcher/][official website]] and download the -AppImage file, which can run without installation. - -However, AppImage files are not executable by default, so you'll either -need to right-click to open the properties of the file and click the -"Allow executing file as program" box in the Permissions tab or use the -following command: +[[https://www.balena.io/etcher/][Etcher]] is a quick and easy way to burn ISO images to CDs and USB devices. There +are two different ways you can install this program. First, you can navigate to +the [[https://www.balena.io/etcher/][official website]] and download the AppImage file, which can run without +installation. + +However, AppImage files are not executable by default, so you'll either need to +right-click to open the properties of the file and click the "Allow executing +file as program" box in the Permissions tab or use the following command: #+begin_src sh chmod u+x FILE_NAME #+end_src -If you don't like AppImage files or just prefer repositories, you can -use the following commands to add the author's repository and install it -through the command-line only. +If you don't like AppImage files or just prefer repositories, you can use the +following commands to add the author's repository and install it through the +command-line only. First, you'll have to echo the repo and write it to a list file: @@ -45,8 +43,7 @@ Finally, update the repositories and install the app. sudo apt update && sudo apt install balena-etcher-electron #+end_src -Using Arch, Manjaro, or another distro using the AUR? Use this command -instead: +Using Arch, Manjaro, or another distro using the AUR? Use this command instead: #+begin_src sh sudo pacman -S etcher @@ -56,11 +53,9 @@ sudo pacman -S etcher #+caption: Atom Screenshot [[https://img.cleberg.net/blog/20200125-the-best-linux-software/atom.png]] -[[https://atom.io][Atom]] is the self-proclaimed "hackable text editor -for the 21st century". This text editor is made by GitHub, -[[https://news.microsoft.com/2018/06/04/microsoft-to-acquire-github-for-7-5-billion/][now -owned by Microsoft]], and has some of the best add-ons available to -customize the layout and abilities of the app. +[[https://atom.io][Atom]] is the self-proclaimed "hackable text editor for the 21st century". This +text editor is made by GitHub, [[https://news.microsoft.com/2018/06/04/microsoft-to-acquire-github-for-7-5-billion/][now owned by Microsoft]], and has some of the best +add-ons available to customize the layout and abilities of the app. First, add the Atom repository to your sources. @@ -74,26 +69,23 @@ Next, update your package listings and install atom. sudo apt update && sudo apt install atom #+end_src -If you have issues updating your packages with the Atom repository, -you'll need to use the snap package described below instead of the -repository. To remove the repository we just added, use this command: +If you have issues updating your packages with the Atom repository, you'll need +to use the snap package described below instead of the repository. To remove the +repository we just added, use this command: #+begin_src sh sudo add-apt-repository -r ppa:webupd8team/atom #+end_src -You can also install Atom as a snap package, but it must be installed -with the =--classic= flag. A -[[https://language-bash.com/blog/how-to-snap-introducing-classic-confinement][full -explanation is available]] if you'd like to read more about why you need -the classic flag. +You can also install Atom as a snap package, but it must be installed with the +=--classic= flag. A [[https://language-bash.com/blog/how-to-snap-introducing-classic-confinement][full explanation is available]] if you'd like to read more +about why you need the classic flag. #+begin_src sh snap install atom --classic #+end_src -Using Arch, Manjaro, or another distro using the AUR? Use this command -instead: +Using Arch, Manjaro, or another distro using the AUR? Use this command instead: #+begin_src sh sudo pacman -S atom @@ -103,28 +95,23 @@ sudo pacman -S atom #+caption: Visual Studio Code Code [[https://img.cleberg.net/blog/20200125-the-best-linux-software/vscode.png]] -[[https://code.visualstudio.com][Visual Studio Code]] is yet another -fantastic choice for programming on Linux, especially if you need those -extra add-ons to spice up your late-night coding sessions. The theme -used in the screenshot is -[[https://marketplace.visualstudio.com/items?itemName=EliverLara.mars][Mars]] -by theme creator [[https://github.com/EliverLara][Eliver Lara]], who -makes a ton of great themes for VS Code, Atom, and various Linux desktop +[[https://code.visualstudio.com][Visual Studio Code]] is yet another fantastic choice for programming on Linux, +especially if you need those extra add-ons to spice up your late-night coding +sessions. The theme used in the screenshot is [[https://marketplace.visualstudio.com/items?itemName=EliverLara.mars][Mars]] by theme creator [[https://github.com/EliverLara][Eliver Lara]], +who makes a ton of great themes for VS Code, Atom, and various Linux desktop environments. -To install VS Code, you'll need to download the =.deb= file from the -official website. Once you've downloaded the file, either double-click -it to install through the Software Center or run the following command: +To install VS Code, you'll need to download the =.deb= file from the official +website. Once you've downloaded the file, either double-click it to install +through the Software Center or run the following command: #+begin_src sh sudo dpkg -i FILE_NAME.deb #+end_src -You can also install VS Code as a snap package, but it must be installed -with the =--classic= flag. A -[[https://language-bash.com/blog/how-to-snap-introducing-classic-confinement][full -explanation is available]] if you'd like to read more about why you need -the classic flag. +You can also install VS Code as a snap package, but it must be installed with +the =--classic= flag. A [[https://language-bash.com/blog/how-to-snap-introducing-classic-confinement][full explanation is available]] if you'd like to read more +about why you need the classic flag. #+begin_src sh snap install code --classic @@ -141,19 +128,18 @@ sudo pacman -S yay binutils make gcc pkg-config fakeroot yay -S visual-studio-co #+caption: Gnome Tweaks Screenshot [[https://img.cleberg.net/blog/20200125-the-best-linux-software/gnome-tweaks.png]] -[[https://gitlab.gnome.org/GNOME/gnome-tweaks][Gnome Tweaks]] is the -ultimate tool to use if you want to customize your GNOME desktop -environment. This is how you can switch application themes (GTK), shell -themes, icons, fonts, and more. To install GNOME Tweaks on Ubuntu, you -just need to install the official package. +[[https://gitlab.gnome.org/GNOME/gnome-tweaks][Gnome Tweaks]] is the ultimate tool to use if you want to customize your GNOME +desktop environment. This is how you can switch application themes (GTK), shell +themes, icons, fonts, and more. To install GNOME Tweaks on Ubuntu, you just need +to install the official package. #+begin_src sh sudo apt install gnome-tweaks #+end_src -If you've installed Manjaro or Arch with Gnome, you should have the -tweak tool pre-installed. If you're on Fedora, this tool is available as -an official package: +If you've installed Manjaro or Arch with Gnome, you should have the tweak tool +pre-installed. If you're on Fedora, this tool is available as an official +package: #+begin_src sh sudo dnf install gnome-tweaks @@ -163,22 +149,20 @@ sudo dnf install gnome-tweaks #+caption: Steam Screenshot [[https://img.cleberg.net/blog/20200125-the-best-linux-software/steam.png]] -[[https://steampowered.com][Steam]] is one of the most popular gaming -libraries for computers and is one of the main reasons that many people -have been able to switch to Linux in recent years, thanks to Steam -Proton, which makes it easier to play games not officially created for -Linux platforms. +[[https://steampowered.com][Steam]] is one of the most popular gaming libraries for computers and is one of +the main reasons that many people have been able to switch to Linux in recent +years, thanks to Steam Proton, which makes it easier to play games not +officially created for Linux platforms. -To install Steam on Ubuntu, you just need to install the official -package. +To install Steam on Ubuntu, you just need to install the official package. #+begin_src sh sudo apt install steam-installer #+end_src -For Arch-based systems, you'll simply need to install the =steam= -package. However, this requires that you enable the =multilib= source. -To do so, use the following command: +For Arch-based systems, you'll simply need to install the =steam= package. +However, this requires that you enable the =multilib= source. To do so, use the +following command: #+begin_src sh sudo nano /etc/pacman.conf @@ -210,27 +194,25 @@ Click Here.]] #+caption: Neofetch Screenshot [[https://img.cleberg.net/blog/20200125-the-best-linux-software/neofetch.png]] -[[https://github.com/dylanaraps/neofetch][Neofetch]] is a customizable -tool used in the command-line to show system information. This is -exceptionally useful if you want to see your system's information -quickly without the clutter of some resource-heavy GUI apps. +[[https://github.com/dylanaraps/neofetch][Neofetch]] is a customizable tool used in the command-line to show system +information. This is exceptionally useful if you want to see your system's +information quickly without the clutter of some resource-heavy GUI apps. -This is an official package if you're running Ubuntu 17.04 or later, so -simply use the following command: +This is an official package if you're running Ubuntu 17.04 or later, so simply +use the following command: #+begin_src sh sudo apt install neofetch #+end_src -If you're running Ubuntu 16.10 or earlier, you'll have to use a series -of commands: +If you're running Ubuntu 16.10 or earlier, you'll have to use a series of +commands: #+begin_src sh sudo add-apt-repository ppa:dawidd0811/neofetch; sudo apt update; sudo apt install neofetch #+end_src -Using Arch, Manjaro, or another distro using the AUR? Use this command -instead: +Using Arch, Manjaro, or another distro using the AUR? Use this command instead: #+begin_src sh sudo pacman -S neofetch @@ -240,31 +222,27 @@ sudo pacman -S neofetch #+caption: yt-dlp Screenshot [[https://img.cleberg.net/blog/20200125-the-best-linux-software/yt-dlp.png]] -[[https://github.com/yt-dlp/yt-dlp][yt-dlp]] is an extremely handy -command-line tool that allows you to download video or audio files from -various websites, such as YouTube. There are a ton of different options -when running this package, so be sure to run =yt-dlp --help= first to -look through everything you can do (or give up and search for the best +[[https://github.com/yt-dlp/yt-dlp][yt-dlp]] is an extremely handy command-line tool that allows you to download video +or audio files from various websites, such as YouTube. There are a ton of +different options when running this package, so be sure to run =yt-dlp --help= +first to look through everything you can do (or give up and search for the best config online). -While this shouldn't be a problem for most users, yt-dlp requires Python -2.6, 2.7, or 3.2+ to work correctly, so install Python if you don't have -it already. You can check to see if you have Python installed by -running: +While this shouldn't be a problem for most users, yt-dlp requires Python 2.6, +2.7, or 3.2+ to work correctly, so install Python if you don't have it already. +You can check to see if you have Python installed by running: #+begin_src sh python -V #+end_src -To get the youtube-dl package, simply curl the URL and output the -results. +To get the youtube-dl package, simply curl the URL and output the results. #+begin_src sh sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp #+end_src -Finally, make the file executable so that it can be run from the -command-line. +Finally, make the file executable so that it can be run from the command-line. #+begin_src sh sudo chmod a+rx /usr/local/bin/yt-dlp diff --git a/content/blog/2020-01-26-steam-on-ntfs.org b/content/blog/2020-01-26-steam-on-ntfs.org index f453ab9..6dffb3d 100644 --- a/content/blog/2020-01-26-steam-on-ntfs.org +++ b/content/blog/2020-01-26-steam-on-ntfs.org @@ -7,28 +7,28 @@ #+caption: Steam Screenshot [[https://img.cleberg.net/blog/20200125-the-best-linux-software/steam.png]] -If you want to see how to install Steam on Linux, see my other post: -[[../linux-software/][Linux Software]]. +If you want to see how to install Steam on Linux, see my other post: [[../linux-software/][Linux +Software]]. -Are you having trouble launching games, even though they've installed -correctly? This may happen if you're storing your games on an -NTFS-formatted drive. This shouldn't be an issue if you're storing your -games on the same drive that Steam is on, but some gamers prefer to put -Steam on their main drive and game files on another SSD or HDD. +Are you having trouble launching games, even though they've installed correctly? +This may happen if you're storing your games on an NTFS-formatted drive. This +shouldn't be an issue if you're storing your games on the same drive that Steam +is on, but some gamers prefer to put Steam on their main drive and game files on +another SSD or HDD. -To fix this problem, you'll need to try a few things. First, you'll need -to install the =ntfs-3g= package, which is meant for better -interoperability with Linux. +To fix this problem, you'll need to try a few things. First, you'll need to +install the =ntfs-3g= package, which is meant for better interoperability with +Linux. #+begin_src sh sudo apt install ntfs-3g #+end_src -Next, you should set up the =/etc/fstab= file to automatically mount -your drives on boot. To automatically mount your drives when the -computer boots up, you'll have to create the folders you want to mount -your drive to first. I store mine in the =/mnt= folder using names that -I'll recognize, but you can create your folders wherever you want. +Next, you should set up the =/etc/fstab= file to automatically mount your drives +on boot. To automatically mount your drives when the computer boots up, you'll +have to create the folders you want to mount your drive to first. I store mine +in the =/mnt= folder using names that I'll recognize, but you can create your +folders wherever you want. #+begin_src sh mkdir /path/to/folder @@ -40,14 +40,13 @@ For example: mkdir /mnt/steam_library #+end_src -To automatically mount drives upon system boot, you will need to collect -a few items. The UUID is the identification number connected to -whichever drive you're using to store Steam games. +To automatically mount drives upon system boot, you will need to collect a few +items. The UUID is the identification number connected to whichever drive you're +using to store Steam games. -Drives are usually labeled similar to =/dev/nvme0n1p1= or =/dev/sda1=, -so you'll need to find the line in the output of the command below that -correlates to your drive and copy the UUID over to the =/etc/fstab= -file. +Drives are usually labeled similar to =/dev/nvme0n1p1= or =/dev/sda1=, so you'll +need to find the line in the output of the command below that correlates to your +drive and copy the UUID over to the =/etc/fstab= file. #+begin_src sh sudo blkid | grep UUID= @@ -60,8 +59,8 @@ command: id -u && id -g #+end_src -Now that you have collected the necessary information, open the -=/etc/fstab= file: +Now that you have collected the necessary information, open the =/etc/fstab= +file: #+begin_src sh sudo nano /etc/fstab @@ -74,9 +73,8 @@ Each drive you want to mount on boot should have its own line in the UUID=B64E53824E5339F7 /mnt/steam_library ntfs-3g uid=1000,gid=1000 0 0 #+end_src -Now all you need to do is unmount your drive and re-mount it. You can -unmount the drive by doing this (be sure to use the correct drive name -here): +Now all you need to do is unmount your drive and re-mount it. You can unmount +the drive by doing this (be sure to use the correct drive name here): #+begin_src sh sudo umount /dev/sdxX @@ -88,6 +86,6 @@ You can re-mount all your drives by executing the following: sudo mount -a #+end_src -If you don't know what your drive name is, or you're nervous about -unmounting and re-mounting, simply reboot your computer, and it will be -done for you automatically. +If you don't know what your drive name is, or you're nervous about unmounting +and re-mounting, simply reboot your computer, and it will be done for you +automatically. diff --git a/content/blog/2020-02-09-cryptography-basics.org b/content/blog/2020-02-09-cryptography-basics.org index 366239a..43229da 100644 --- a/content/blog/2020-02-09-cryptography-basics.org +++ b/content/blog/2020-02-09-cryptography-basics.org @@ -4,168 +4,155 @@ #+filetags: :security: * Similar Article Available -If you haven't already, feel free to read my post on -[[../aes-encryption/][AES Encryption]]. +If you haven't already, feel free to read my post on [[../aes-encryption/][AES Encryption]]. * What is Cryptography? In layman's terms, cryptography is a process that can change data from a -readable format into an unreadable format (and vice-versa) through a -series of processes and secrets. More technically, this is the Internet -Security Glossary's definition: +readable format into an unreadable format (and vice-versa) through a series of +processes and secrets. More technically, this is the Internet Security +Glossary's definition: #+begin_quote -[Cryptography is] the mathematical science that deals with transforming -data to render its meaning unintelligible (i.e., to hide its semantic -content), prevent its undetected alteration, or prevent its unauthorized -use. If the transformation is reversible, cryptography also deals with -restoring encrypted data to an intelligible form. - -- [[https://tools.ietf.org/html/rfc2828][Internet Security Glossary - (2000)]] +[Cryptography is] the mathematical science that deals with transforming data to +render its meaning unintelligible (i.e., to hide its semantic content), prevent +its undetected alteration, or prevent its unauthorized use. If the +transformation is reversible, cryptography also deals with restoring encrypted +data to an intelligible form. +- [[https://tools.ietf.org/html/rfc2828][Internet Security Glossary (2000)]] #+end_quote -Cryptography cannot offer protection against the loss of data; it simply -offers encryption methods to protect data at-rest and data in-traffic. -At a high-level, encrypted is when plaintext data is encrypted to -ciphertext (a secure form of text that cannot be understood unless -decrypted back to plaintext). The encryption process is completed -through the use of a mathematical function that utilizes one or more -values called keys to encrypt or decrypt the data. +Cryptography cannot offer protection against the loss of data; it simply offers +encryption methods to protect data at-rest and data in-traffic. At a high-level, +encrypted is when plaintext data is encrypted to ciphertext (a secure form of +text that cannot be understood unless decrypted back to plaintext). The +encryption process is completed through the use of a mathematical function that +utilizes one or more values called keys to encrypt or decrypt the data. * Key Elements of Cryptographic Systems -To create or evaluate a cryptographic system, you need to know the -essential pieces to the system: - -- *Encryption Algorithm (Primitive):** A mathematical process that - encrypts and decrypts data. -- *Encryption Key:** A string of bits used within the encryption - algorithm as the secret that allows successful encryption or - decryption of data. -- *Key Length (Size):** The maximum number of bits within the encryption - key. It's important to remember that key size is regulated in many - countries. -- *Message Digest:** A smaller, fixed-size bit string version of the - original message. This is practically infeasible to reverse, which is - why it's commonly used to verify integrity. +To create or evaluate a cryptographic system, you need to know the essential +pieces to the system: + +- *Encryption Algorithm (Primitive):** A mathematical process that encrypts and + decrypts data. +- *Encryption Key:** A string of bits used within the encryption algorithm as + the secret that allows successful encryption or decryption of data. +- *Key Length (Size):** The maximum number of bits within the encryption key. + It's important to remember that key size is regulated in many countries. +- *Message Digest:** A smaller, fixed-size bit string version of the original + message. This is practically infeasible to reverse, which is why it's commonly + used to verify integrity. * Symmetric Systems (Secret Key Cryptography) -Symmetric cryptography utilizes a secret, bidirectional key to perform -both encryption and decryption of the data. The most common -implementation of symmetric cryptography is the Advanced Encryption -Standard, which uses keys that are 128 bits to 256 bits in size. This -standard came after the National Institute of Standards and Technology -(NIST) decided to retire the Data Encryption Standard (DES) in 2001. - -Since brute force attacks strongly correlate with key length, the 56-bit -key length of DES was considered insecure after it was publicly broken -in under 24 hours. However, there is a modern implementation of DES -called Triple DES where the DES method is applied three times to each -data block. - -The main advantages to symmetric systems are the ease of use, since only -one key is required for both encryption and decryption, and the -simplicity of the algorithms. This helps with bulk data encryption that -may unnecessarily waste time and power using asymmetric systems. - -However, symmetric systems have disadvantages to keep in mind. Since the -key is private, it can be difficult to safely distribute keys to -communication partners. Additionally, the key cannot be used to sign -messages since it's necessary to keep the key private. +Symmetric cryptography utilizes a secret, bidirectional key to perform both +encryption and decryption of the data. The most common implementation of +symmetric cryptography is the Advanced Encryption Standard, which uses keys that +are 128 bits to 256 bits in size. This standard came after the National +Institute of Standards and Technology (NIST) decided to retire the Data +Encryption Standard (DES) in 2001. + +Since brute force attacks strongly correlate with key length, the 56-bit key +length of DES was considered insecure after it was publicly broken in under 24 +hours. However, there is a modern implementation of DES called Triple DES where +the DES method is applied three times to each data block. + +The main advantages to symmetric systems are the ease of use, since only one key +is required for both encryption and decryption, and the simplicity of the +algorithms. This helps with bulk data encryption that may unnecessarily waste +time and power using asymmetric systems. + +However, symmetric systems have disadvantages to keep in mind. Since the key is +private, it can be difficult to safely distribute keys to communication +partners. Additionally, the key cannot be used to sign messages since it's +necessary to keep the key private. * Asymmetric Systems (Public Key Cryptography) -Asymmetric cryptography utilizes two keys within the system: a secret -key that is privately-held and a public key that can be distributed -freely. The interesting aspect of asymmetric cryptography is that either -key can be used to encrypt the data, there's no rule that dictates which -key must be used for encryption. Once one key is used to encrypt the -data, only the other key can be used to decrypt the data. This means -that if the private key encrypts the data, only the public key can -decrypt the data. - -An advantage of this system is that if you successfully decrypt data -using one of the keys, you can be sure of the sender since only the -other key could have encrypted the data. - -One of the major implementations of an asymmetric system is a digital -signature. A digital signature can be generated using the sender's -private key, or a one-way hash function and is used to provide assurance -for the integrity and authenticity of the message. A couple common -message digest algorithms are SHA-256 and SHA-512, which securely -compress data and produce a 128-bit message digest. - -It should be noted that man-in-the-middle attacks are one of the risks -with digital signatures and public keys. To combat this, applications -often use a public key infrastructure (PKI) to independently -authenticate the validity of signatures and keys. - -Due to the large key size and -[[https://crypto.stackexchange.com/a/591][inefficient mathematical -functions]] of asymmetric encryption, elliptical curve cryptography -(ECC) is often used to increase security while using fewer resources. +Asymmetric cryptography utilizes two keys within the system: a secret key that +is privately-held and a public key that can be distributed freely. The +interesting aspect of asymmetric cryptography is that either key can be used to +encrypt the data, there's no rule that dictates which key must be used for +encryption. Once one key is used to encrypt the data, only the other key can be +used to decrypt the data. This means that if the private key encrypts the data, +only the public key can decrypt the data. + +An advantage of this system is that if you successfully decrypt data using one +of the keys, you can be sure of the sender since only the other key could have +encrypted the data. + +One of the major implementations of an asymmetric system is a digital signature. +A digital signature can be generated using the sender's private key, or a +one-way hash function and is used to provide assurance for the integrity and +authenticity of the message. A couple common message digest algorithms are +SHA-256 and SHA-512, which securely compress data and produce a 128-bit message +digest. + +It should be noted that man-in-the-middle attacks are one of the risks with +digital signatures and public keys. To combat this, applications often use a +public key infrastructure (PKI) to independently authenticate the validity of +signatures and keys. + +Due to the large key size and [[https://crypto.stackexchange.com/a/591][inefficient mathematical functions]] of asymmetric +encryption, elliptical curve cryptography (ECC) is often used to increase +security while using fewer resources. * Applications of Cryptographic Systems -There are quite a few implementations of cryptographic systems around -the world. Here are a few popular examples: +There are quite a few implementations of cryptographic systems around the world. +Here are a few popular examples: *Transport Layer Security (TLS):** One of the most famous cryptographic -solutions created is TLS, a session-layered or connection-layered -internet protocol that allows for secure communications between browsers -and servers. Using handshakes, peer negotiation, and authentication -allows TLS to prevent eavesdropping and malicious transformation of -data. The major reason for TLS popularity is that a major vulnerability -was found in the SSL protocol in 2014. Instead of SSL, TLS can be used -with HTTP to form HTTPS and is the preferred method for modern web -development due to its increased security. - -*Secure Hypertext Transfer Protocol (HTTPS):** An application layer -protocol that allows for secure transport of data between servers and -web clients. One of the unique parts of HTTPS is that it uses a secured -port number instead of the default web port address. - -*Virtual Private Network (VPN):** VPNs are made to securely extend a -private network across public networks by utilizing an encrypted layered -tunneling protocol paired with an authentication method, such as -usernames and passwords. This technology originally allowed remote -employees to access their company's data but have evolved into one of -the top choices for anyone who wishes to mask their sensitive personal -data. +solutions created is TLS, a session-layered or connection-layered internet +protocol that allows for secure communications between browsers and servers. +Using handshakes, peer negotiation, and authentication allows TLS to prevent +eavesdropping and malicious transformation of data. The major reason for TLS +popularity is that a major vulnerability was found in the SSL protocol in 2014. +Instead of SSL, TLS can be used with HTTP to form HTTPS and is the preferred +method for modern web development due to its increased security. + +*Secure Hypertext Transfer Protocol (HTTPS):** An application layer protocol +that allows for secure transport of data between servers and web clients. One of +the unique parts of HTTPS is that it uses a secured port number instead of the +default web port address. + +*Virtual Private Network (VPN):** VPNs are made to securely extend a private +network across public networks by utilizing an encrypted layered tunneling +protocol paired with an authentication method, such as usernames and passwords. +This technology originally allowed remote employees to access their company's +data but have evolved into one of the top choices for anyone who wishes to mask +their sensitive personal data. *Internet Protocol Security (IPSec):** This protocol suite facilitates communication between two or more hosts or subnets by authenticating and -encrypting the data packets. IPSec is used in a lot of VPNs to establish -the VPN connection through the transport and tunnel mode encryption -methods. IPSec encrypts just the data portion of packets in the -transport methods, but it encrypts both the data and headers in the -tunnel method (introducing an additional header for authentication). - -*Secure Shell (SSH):** SSH is another network protocol used to protect -network services by authenticating users through a secure channel. This -protocol is often used for command-line (shell) functions such as remote -shell commands, logins, and file transfers. - -*Kerberos:** Developed by MIT, Kerberos is a computer-network -authentication protocol that works on the basis of tickets to allow -nodes communicating over a non-secure network to prove their identity to -one another securely. This is most commonly used in business -environments when used as the authentication and encryption method for -Windows Active Directory (AD). +encrypting the data packets. IPSec is used in a lot of VPNs to establish the VPN +connection through the transport and tunnel mode encryption methods. IPSec +encrypts just the data portion of packets in the transport methods, but it +encrypts both the data and headers in the tunnel method (introducing an +additional header for authentication). + +*Secure Shell (SSH):** SSH is another network protocol used to protect network +services by authenticating users through a secure channel. This protocol is +often used for command-line (shell) functions such as remote shell commands, +logins, and file transfers. + +*Kerberos:** Developed by MIT, Kerberos is a computer-network authentication +protocol that works on the basis of tickets to allow nodes communicating over a +non-secure network to prove their identity to one another securely. This is most +commonly used in business environments when used as the authentication and +encryption method for Windows Active Directory (AD). * Cybersecurity Controls -If you're someone who needs solutions on how to control risks associated -with utilizing a crytograhpic system, start with a few basic controls: +If you're someone who needs solutions on how to control risks associated with +utilizing a crytograhpic system, start with a few basic controls: -- *Policies:** A policy on the use of cryptographic controls for - protection of information is implemented and is in accordance with - organizational objectives. +- *Policies:** A policy on the use of cryptographic controls for protection of + information is implemented and is in accordance with organizational + objectives. - *Key management:** A policy on the use, protection and lifetime of - cryptographic keys is implemented through the entire application - lifecycle. -- *Key size:** The organization has researched the optimal key size for - their purposes, considering national laws, required processing power, - and longevity of the solution. -- *Algorithm selection:** Implemented algorithms are sufficiently - appropriate for the business of the organization, robust, and align - with recommended guidelines. + cryptographic keys is implemented through the entire application lifecycle. +- *Key size:** The organization has researched the optimal key size for their + purposes, considering national laws, required processing power, and longevity + of the solution. +- *Algorithm selection:** Implemented algorithms are sufficiently appropriate + for the business of the organization, robust, and align with recommended + guidelines. - *Protocol configuration:** Protocols have been reviewed and configured suitable to the purpose of the business. diff --git a/content/blog/2020-03-25-session-manager.org b/content/blog/2020-03-25-session-manager.org index 803d048..3635e4a 100644 --- a/content/blog/2020-03-25-session-manager.org +++ b/content/blog/2020-03-25-session-manager.org @@ -4,44 +4,39 @@ #+filetags: :privacy: * Privacy Warning -The company behind Session (Loki Foundation) is from Australia. If you -didn't know, Australia has introduced -[[https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_aspassed/toc_pdf/18204b01.pdf][legislation]] -mandating companies comply with government requests to build backdoor -access into applications. For more information, read my article on -[[./2020-01-25-aes-encryption.html][AES Encryption]]. +The company behind Session (Loki Foundation) is from Australia. If you didn't +know, Australia has introduced [[https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_aspassed/toc_pdf/18204b01.pdf][legislation]] mandating companies comply with +government requests to build backdoor access into applications. For more +information, read my article on [[./2020-01-25-aes-encryption.html][AES Encryption]]. * About Session -[[https://getsession.org][Session]] is a private, cross-platform -messaging app from the [[https://loki.foundation][Loki Foundation]]. As -someone who has spent years looking for quality alternatives to major -messaging apps, I was excited when I first heard about Session. Reading -through [[https://arxiv.org/pdf/2002.04609.pdf][Session's white paper]], -you can learn the technologies behind the Session app. Part of the -security of Session comes from the Signal protocol, which was forked as -the origin of Session. +[[https://getsession.org][Session]] is a private, cross-platform messaging app from the [[https://loki.foundation][Loki Foundation]]. As +someone who has spent years looking for quality alternatives to major messaging +apps, I was excited when I first heard about Session. Reading through [[https://arxiv.org/pdf/2002.04609.pdf][Session's +white paper]], you can learn the technologies behind the Session app. Part of the +security of Session comes from the Signal protocol, which was forked as the +origin of Session. #+begin_quote -Session is an end-to-end encrypted messenger that removes sensitive -metadata collection, and is designed for people who want privacy and -freedom from any forms of surveillance. +Session is an end-to-end encrypted messenger that removes sensitive metadata +collection, and is designed for people who want privacy and freedom from any +forms of surveillance. #+end_quote In general, this app promises security through end-to-end encryption, -decentralized onion routing, and private identities. The biggest change -that the Loki Foundation has made to the Signal protocol is removing the -need for a phone number. Instead, a random identification string is -generated for any session you create. This means you can create a new -session for each device if you want to, or link new devices with your -ID. +decentralized onion routing, and private identities. The biggest change that the +Loki Foundation has made to the Signal protocol is removing the need for a phone +number. Instead, a random identification string is generated for any session you +create. This means you can create a new session for each device if you want to, +or link new devices with your ID. -Since Session's website and white paper describe the details of -Session's security, I'm going to focus on using the app in this post. +Since Session's website and white paper describe the details of Session's +security, I'm going to focus on using the app in this post. * Features -Since most people are looking for an alternative to a popular chat app, -I am going to list out the features that Session has so that you are -able to determine if the app would suit your needs: +Since most people are looking for an alternative to a popular chat app, I am +going to list out the features that Session has so that you are able to +determine if the app would suit your needs: - Multiple device linking (via QR code or ID) - App locking via device screen lock, password, or fingerprint @@ -55,15 +50,15 @@ able to determine if the app would suit your needs: - Account deletion, including ID, messages, sessions, and contacts * Downloads -I have tested this app on Ubuntu 19.10, Android 10, macOS Monterey, and -iOS 15. All apps have worked well without many issues. +I have tested this app on Ubuntu 19.10, Android 10, macOS Monterey, and iOS 15. +All apps have worked well without many issues. -Below is a brief overview of the Session app on Linux. To get this app, -you'll need to go to the [[https://getsession.org/download/][Downloads]] -page and click to link to the operating system you're using. +Below is a brief overview of the Session app on Linux. To get this app, you'll +need to go to the [[https://getsession.org/download/][Downloads]] page and click to link to the operating system +you're using. -For Linux, it will download an AppImage that you'll need to enable with -the following command: +For Linux, it will download an AppImage that you'll need to enable with the +following command: #+begin_src sh sudo chmod u+x session-messenger-desktop-linux-x86_64-1.0.5.AppImage @@ -73,12 +68,12 @@ sudo chmod u+x session-messenger-desktop-linux-x86_64-1.0.5.AppImage [[https://img.cleberg.net/blog/20200325-session-private-messenger/session_downloads.png]] * Creating an Account -Once you've installed the app, simply run the app and create your unique -Session ID. It will look something like this: +Once you've installed the app, simply run the app and create your unique Session +ID. It will look something like this: =05af1835afdd63c947b47705867501d6373f486aa1ae05b1f2f3fcd24570eba608=. -You'll need to set a display name and, optionally, a password. If you -set a password, you will need to enter it every time you open the app. +You'll need to set a display name and, optionally, a password. If you set a +password, you will need to enter it every time you open the app. #+caption: Session Login (Linux) [[https://img.cleberg.net/blog/20200325-session-private-messenger/session_linux_login.png]] @@ -90,39 +85,36 @@ set a password, you will need to enter it every time you open the app. [[https://img.cleberg.net/blog/20200325-session-private-messenger/session_password_authentication.png]] * Start Messaging -Once you've created your account and set up your profile details, the -next step is to start messaging other people. To do so, you'll need to -share your Session ID with other people. From this point, it's fairly -straightforward and acts like any other messaging app, so I won't dive -into much detail here. +Once you've created your account and set up your profile details, the next step +is to start messaging other people. To do so, you'll need to share your Session +ID with other people. From this point, it's fairly straightforward and acts like +any other messaging app, so I won't dive into much detail here. ** macOS #+caption: macOS Conversations [[https://img.cleberg.net/blog/20200325-session-private-messenger/session_macos_conversations.png]] -One key feature to note is that the desktop application now provides a -helpful pop-up box explaining the process that Session uses to hide your -IP address: +One key feature to note is that the desktop application now provides a helpful +pop-up box explaining the process that Session uses to hide your IP address: #+caption: IP Address Help Box [[https://img.cleberg.net/blog/20200325-session-private-messenger/session_ip.png]] ** iOS -The mobile app is quite simple and effective, giving you all the -standard mobile messaging options you'd expect. +The mobile app is quite simple and effective, giving you all the standard mobile +messaging options you'd expect. #+caption: iOS App [[https://img.cleberg.net/blog/20200325-session-private-messenger/session_ios.png]] * Potential Issues -I've discovered one annoying issue that would prevent from using this -app regularly. On a mobile device, there have been issues with receiving -messages on time. Even with battery optimization disabled and no network -restrictions, Session notifications sometimes do not display until I -open the app or the conversation itself and wait a few moments. This is -actually one of the reasons I stopped using Signal (this seems fixed as -of my updates in 2021/2022, so I wouldn't worry about this issue -anymore). - -Looking for another messenger instead of Session? I recommend Signal, -Matrix, and IRC. +I've discovered one annoying issue that would prevent from using this app +regularly. On a mobile device, there have been issues with receiving messages on +time. Even with battery optimization disabled and no network restrictions, +Session notifications sometimes do not display until I open the app or the +conversation itself and wait a few moments. This is actually one of the reasons +I stopped using Signal (this seems fixed as of my updates in 2021/2022, so I +wouldn't worry about this issue anymore). + +Looking for another messenger instead of Session? I recommend Signal, Matrix, +and IRC. diff --git a/content/blog/2020-05-03-homelab.org b/content/blog/2020-05-03-homelab.org index ffefe5d..1b2b12e 100644 --- a/content/blog/2020-05-03-homelab.org +++ b/content/blog/2020-05-03-homelab.org @@ -4,28 +4,24 @@ #+filetags: :sysadmin: * What is a Homelab? -Starting as a developer, I have largely stayed away from hardware-based -hobbies (other than building a gaming desktop). However, as the -quarantine for COVID-19 stretches out further and further, I found -myself bored and in search of new hobbies. After spending the last few -months browsing the [[https://www.reddit.com/r/homelab/][r/homelab]] -subreddit, I decided it was time to jump in and try things out for -myself. +Starting as a developer, I have largely stayed away from hardware-based hobbies +(other than building a gaming desktop). However, as the quarantine for COVID-19 +stretches out further and further, I found myself bored and in search of new +hobbies. After spending the last few months browsing the [[https://www.reddit.com/r/homelab/][r/homelab]] subreddit, I +decided it was time to jump in and try things out for myself. -Since I am a beginner and just recently graduated from college, -everything I've done so far in my homelab is fairly low-budget. +Since I am a beginner and just recently graduated from college, everything I've +done so far in my homelab is fairly low-budget. * Hardware #+caption: HomeLab Diagram [[https://img.cleberg.net/blog/20200503-homelab/homelab-min.png]] *** Raspberry Pi 4 -Luckily, I had actually purchased a -[[https://www.raspberrypi.org/products/raspberry-pi-4-model-b/][Raspberry -Pi 4]] before the quarantine started so that I could try to keep Plex -Media Center running, even while my desktop computer was turned off. I -started here, using the Pi to hold Plex and Pi-hole until I grew tired -with the slow performance. +Luckily, I had actually purchased a [[https://www.raspberrypi.org/products/raspberry-pi-4-model-b/][Raspberry Pi 4]] before the quarantine started +so that I could try to keep Plex Media Center running, even while my desktop +computer was turned off. I started here, using the Pi to hold Plex and Pi-hole +until I grew tired with the slow performance. Here are the specifications for the Pi 4: @@ -36,12 +32,12 @@ Here are the specifications for the Pi 4: - 64 GB MicroSD Card ** Dell Optiplex 5040 -Since I wasn't happy with the Pi as my main server, I turned to -Craigslist. I know a lot of other homelabbers use Ebay, but I can't seem -to ever trust it enough to purchase items on there. So I used Craigslist -and found a Dell Optiplex 5040 desktop computer on sale for $90. While -this computer might be underpowered, it was one of the few computers -under $100 that was available during quarantine. +Since I wasn't happy with the Pi as my main server, I turned to Craigslist. I +know a lot of other homelabbers use Ebay, but I can't seem to ever trust it +enough to purchase items on there. So I used Craigslist and found a Dell +Optiplex 5040 desktop computer on sale for $90. While this computer might be +underpowered, it was one of the few computers under $100 that was available +during quarantine. Here are the specifications for the Dell Optiplex 5040: @@ -51,99 +47,90 @@ Here are the specifications for the Dell Optiplex 5040: - Gigabit Ethernet - 500GB Hard Drive -While this hardware would be awful for a work computer or a gaming rig, -it turned out to be wonderful for my server purposes. The only -limitation I have found so far is the CPU. The i3-6100 only has enough -power for a single 4k video transcode at a time. I haven't tested more -than three 1080p streams at a time, but the maximum amount of streams -I've ever actually used is two. +While this hardware would be awful for a work computer or a gaming rig, it +turned out to be wonderful for my server purposes. The only limitation I have +found so far is the CPU. The i3-6100 only has enough power for a single 4k video +transcode at a time. I haven't tested more than three 1080p streams at a time, +but the maximum amount of streams I've ever actually used is two. ** WD easystore 10TB & 8TB -Application storage and temporary files are stored on the internal hard -drive of the server, but all media files (movies, tv, games, books, etc) -are stored externally on my WD easystore hard drive. Creating auto-boot -configurations in the =/etc/fstab= file on my server allows the hard -drives to automatically mount whenever I need to restart my server. +Application storage and temporary files are stored on the internal hard drive of +the server, but all media files (movies, tv, games, books, etc) are stored +externally on my WD easystore hard drive. Creating auto-boot configurations in +the =/etc/fstab= file on my server allows the hard drives to automatically mount +whenever I need to restart my server. #+begin_quote -Update: In March 2022, I shucked the hard drives out of their external -cases, put some Kapton tape on the third power pin to prevent power -shutdowns, and stuck them inside my server tower using internal SATA -cables. - +Update: In March 2022, I shucked the hard drives out of their external cases, +put some Kapton tape on the third power pin to prevent power shutdowns, and +stuck them inside my server tower using internal SATA cables. #+end_quote ** Netgear Unmanaged Switch -To manage all the ethernet cords used by my homelab, my desktop, and my -living room media center, I purchased an 8-port gigabit ethernet switch -for $50 at my local computer store. This is probably much more than I -should have spent on an unmanaged switch, but I am comfortable with the -choice. +To manage all the ethernet cords used by my homelab, my desktop, and my living +room media center, I purchased an 8-port gigabit ethernet switch for $50 at my +local computer store. This is probably much more than I should have spent on an +unmanaged switch, but I am comfortable with the choice. ** TP-Link Managed Switch -Since I use the unmanaged switch to group all living room devices -together, I use the managed switch to configure VLANs and secure my -network. +Since I use the unmanaged switch to group all living room devices together, I +use the managed switch to configure VLANs and secure my network. ** Arris TM1602A Modem & Sagecom Fast 5280 Router -My default modem and router, provided by my ISP, are fairly standard. -The Arris modem supports DOCSIS 3.0, which is something that I -definitely wanted as a minimum. The Sagecom router is also standard, no -fancy bells or whistles. However, it does support DHCP and DHCPv6, which -is something you can use to route all household traffic through a -pi-hole or firewall. +My default modem and router, provided by my ISP, are fairly standard. The Arris +modem supports DOCSIS 3.0, which is something that I definitely wanted as a +minimum. The Sagecom router is also standard, no fancy bells or whistles. +However, it does support DHCP and DHCPv6, which is something you can use to +route all household traffic through a pi-hole or firewall. ** TP-Link EAP -In order to gain better control over the network, I use my own wireless -access point instead of the one included in the Sagecom router above. -Now I can control and organize all of my ethernet connections through -the VLANs on the managed switch and wireless connections through the -VLANS on the EAP. +In order to gain better control over the network, I use my own wireless access +point instead of the one included in the Sagecom router above. Now I can control +and organize all of my ethernet connections through the VLANs on the managed +switch and wireless connections through the VLANS on the EAP. ** Generic Printer -The last piece to my homelab is a standard wireless printer. Nothing -special here. +The last piece to my homelab is a standard wireless printer. Nothing special +here. * Software ** Ubuntu Server 20.04 -While the 20.04 version of Ubuntu was just released, I always like to -experiment with new features (and I don't mind breaking my system - it -just gives me more experience learning how to fix things). So, I have -Ubuntu Server 20.04 installed on the Dell Optiplex server and Ubuntu -Server 19.10 installed on the Raspberry Pi. Once I find an acceptable -use for the Pi, I will most likely switch the operating system. +While the 20.04 version of Ubuntu was just released, I always like to experiment +with new features (and I don't mind breaking my system - it just gives me more +experience learning how to fix things). So, I have Ubuntu Server 20.04 installed +on the Dell Optiplex server and Ubuntu Server 19.10 installed on the Raspberry +Pi. Once I find an acceptable use for the Pi, I will most likely switch the +operating system. ** Docker -I am /very/ new to Docker, but I have had a lot of fun playing with it -so far. Docker is used to create containers that can hold all the -contents of a system without interfering with other software on the same -system. So far, I have successfully installed pi-hole, GitLab, Gogs, and -Nextcloud in containers. However, I opted to delete all of those so that -I can reconfigure them more professionally at a later time. +I am /very/ new to Docker, but I have had a lot of fun playing with it so far. +Docker is used to create containers that can hold all the contents of a system +without interfering with other software on the same system. So far, I have +successfully installed pi-hole, GitLab, Gogs, and Nextcloud in containers. +However, I opted to delete all of those so that I can reconfigure them more +professionally at a later time. ** Plex Media Server -Plex is a media center software that allows you to organize your movies, -TV shows, music, photos, and videos automatically. It will even download -metadata for you so that you can easily browse these collections. +Plex is a media center software that allows you to organize your movies, TV +shows, music, photos, and videos automatically. It will even download metadata +for you so that you can easily browse these collections. ** Pi-hole -Pi-hole is an alternative ad-blocker that runs at the DNS level, -allowing you to block traffic when it hits your network, so that you can -reject any traffic you deem to be bad. Pi-hole uses blacklists and -whitelists to decide which traffic block and, luckily, there are a lot -of pre-made lists out there on Reddit, GitHub, etc. +Pi-hole is an alternative ad-blocker that runs at the DNS level, allowing you to +block traffic when it hits your network, so that you can reject any traffic you +deem to be bad. Pi-hole uses blacklists and whitelists to decide which traffic +block and, luckily, there are a lot of pre-made lists out there on Reddit, +GitHub, etc. ** Nextcloud -While I had trouble with the Docker version of Nextcloud, I was very -successful when setting up the snap version. Using this, I was able to -map Nextcloud to a subdomain of a domain I own in Namecheap. -Additionally, Nextcloud has an integration with Let's Encrypt that -allows me to issue certificates automatically to any new domain I -authorize. +While I had trouble with the Docker version of Nextcloud, I was very successful +when setting up the snap version. Using this, I was able to map Nextcloud to a +subdomain of a domain I own in Namecheap. Additionally, Nextcloud has an +integration with Let's Encrypt that allows me to issue certificates +automatically to any new domain I authorize. ** Webmin -To monitor my servers, and the processes running on them, I use the -Webmin dashboard. This was fairly painless to set up, and I currently -access it straight through the server's IP address. In the future, I -will be looking to configure Webmin to use a custom domain just like -Nextcloud. +To monitor my servers, and the processes running on them, I use the Webmin +dashboard. This was fairly painless to set up, and I currently access it +straight through the server's IP address. In the future, I will be looking to +configure Webmin to use a custom domain just like Nextcloud. diff --git a/content/blog/2020-05-19-customizing-ubuntu.org b/content/blog/2020-05-19-customizing-ubuntu.org index 6461a9a..468edc8 100644 --- a/content/blog/2020-05-19-customizing-ubuntu.org +++ b/content/blog/2020-05-19-customizing-ubuntu.org @@ -8,145 +8,128 @@ For inspiration on designing your *nix computer, check out the [[https://libredd.it/r/unixporn][r/unixporn]] subreddit! * Customizing Ubuntu -New to Linux and want to add a personal touch to your machine? One of -the best perks of Linux is that it is *extremely** customizable. You can -change the styles of the windows, shell (status bars/docks), icons, -fonts, terminals, and more. +New to Linux and want to add a personal touch to your machine? One of the best +perks of Linux is that it is *extremely** customizable. You can change the +styles of the windows, shell (status bars/docks), icons, fonts, terminals, and +more. -In this post, I'm going to go through customization on Ubuntu 20.04 -(GNOME) since most new users tend to choose Ubuntu-based distros. If -you've found a way to install Arch with i3-gaps, I'm assuming you know -how to find more advanced tutorials out there on customizations. +In this post, I'm going to go through customization on Ubuntu 20.04 (GNOME) +since most new users tend to choose Ubuntu-based distros. If you've found a way +to install Arch with i3-gaps, I'm assuming you know how to find more advanced +tutorials out there on customizations. ** Required Tools #+caption: Gnome Tweaks [[https://img.cleberg.net/blog/20200519-customizing-ubuntu/gnome-tweaks-min.png]] -Ubuntu 20.04 ships with the default desktop environment -[[https://www.gnome.org/][Gnome]], which includes the handy -=gnome-tweaks= tool to quickly change designs. To install this, just +Ubuntu 20.04 ships with the default desktop environment [[https://www.gnome.org/][Gnome]], which includes +the handy =gnome-tweaks= tool to quickly change designs. To install this, just open your terminal and enter the following command: #+begin_src sh sudo apt install gnome-tweaks #+end_src -After you've finished installing the tool, simply launch the Tweaks -application, and you'll be able to access the various customization -options available by default on Ubuntu. You might even like some of the -pre-installed options. +After you've finished installing the tool, simply launch the Tweaks application, +and you'll be able to access the various customization options available by +default on Ubuntu. You might even like some of the pre-installed options. ** GNOME Application Themes -To change the themes applied to applications in GNOME, you will need to -change the Applications dropdown in the Appearance section of Tweaks. To -add more themes, you will have to find your preferred theme online and -follow the steps below to have it show up in the Tweaks tool. While you -may find themes anywhere, one of the most popular sites for GNOME themes -is [[https://www.gnome-look.org/][gnome-look.org]]. This website +To change the themes applied to applications in GNOME, you will need to change +the Applications dropdown in the Appearance section of Tweaks. To add more +themes, you will have to find your preferred theme online and follow the steps +below to have it show up in the Tweaks tool. While you may find themes anywhere, +one of the most popular sites for GNOME themes is [[https://www.gnome-look.org/][gnome-look.org]]. This website contains themes for applications, shells, icons, and cursors. Steps to import themes into Tweaks: 1. Download the theme. -2. These files are usually compressed (.zip, .tar.gz, .tar.xz), so you - will need to extract the contents. This is easiest when opening the - file explorer, right-clicking the compressed file, and choosing - "Extract here." +2. These files are usually compressed (.zip, .tar.gz, .tar.xz), so you will need + to extract the contents. This is easiest when opening the file explorer, + right-clicking the compressed file, and choosing "Extract here." 3. Move the theme folder to =/usr/share/themes/=. You can do so with the following command: =sudo mv theme-folder/ /usr/share/themes/=. - Icons and cursors will be moved to the =/usr/share/icons/= folder. - - Fonts will be moved to the =/usr/share/fonts/= folder - Alternatively, you can move them to the - =/usr/share/fonts/opentype/= or =/usr/share/fonts/opentype/= - folders, if you have a specific font type. + - Fonts will be moved to the =/usr/share/fonts/= folder Alternatively, you + can move them to the =/usr/share/fonts/opentype/= or + =/usr/share/fonts/opentype/= folders, if you have a specific font type. 4. Close tweaks if it is open. Re-open Tweaks and your new theme will be - available in the Applications dropdown in the Appearance section of - Tweaks. + available in the Applications dropdown in the Appearance section of Tweaks. -If the theme is not showing up after you've moved it into the themes -folder, you may have uncompressed the folder into a sub-folder. You can -check this by entering the theme folder and listing the contents: +If the theme is not showing up after you've moved it into the themes folder, you +may have uncompressed the folder into a sub-folder. You can check this by +entering the theme folder and listing the contents: #+begin_src sh cd /usr/share/themes/Mojave-Dark && ls -la #+end_src -This is an example of what the contents of your theme folder should look -like. If you just see another folder there, you should move that folder -up into the =/usr/share/themes/= folder. +This is an example of what the contents of your theme folder should look like. +If you just see another folder there, you should move that folder up into the +=/usr/share/themes/= folder. #+begin_src sh cinnamon COPYING gnome-shell gtk-2.0 gtk-3.0 index.theme metacity-1 plank xfwm4 #+end_src ** GNOME Shell Themes -To change the appearance of the title bar, default dock, app menu, and -other parts of the GNOME shell, you'll need to install the -[[https://extensions.gnome.org/extension/19/user-themes/][user themes]] -extension on [[https://extensions.gnome.org/][Gnome Extensions]]. To be -able to install extensions, you will first need to install the browser -extension that the website instructs you to. See this screenshot for the -blue box with a link to the extension. +To change the appearance of the title bar, default dock, app menu, and other +parts of the GNOME shell, you'll need to install the [[https://extensions.gnome.org/extension/19/user-themes/][user themes]] extension on +[[https://extensions.gnome.org/][Gnome Extensions]]. To be able to install extensions, you will first need to +install the browser extension that the website instructs you to. See this +screenshot for the blue box with a link to the extension. #+caption: Gnome Extensions [[https://img.cleberg.net/blog/20200519-customizing-ubuntu/gnome-extensions-min.png]] -After the browser extension is installed, you will need to install the -native host connector: +After the browser extension is installed, you will need to install the native +host connector: #+begin_src sh sudo apt install chrome-gnome-shell #+end_src -Finally, you can go the -[[https://extensions.gnome.org/extension/19/user-themes/][user themes]] -extension page and click the installation button. This will enable the -Shell option in Tweaks. Now you can move shell themes to the -=/usr/share/themes= directory, using the same steps mentioned in the -previous section, and enable the new theme in Tweaks. +Finally, you can go the [[https://extensions.gnome.org/extension/19/user-themes/][user themes]] extension page and click the installation +button. This will enable the Shell option in Tweaks. Now you can move shell +themes to the =/usr/share/themes= directory, using the same steps mentioned in +the previous section, and enable the new theme in Tweaks. ** Icons & Cursors -Icons and cursors are installed exactly the same way, so I'm grouping -these together in this post. Both of these items will need to follow the -same process as installing themes, except you will want to move your -font folders to the =/usr/share/icons/= directory instead. +Icons and cursors are installed exactly the same way, so I'm grouping these +together in this post. Both of these items will need to follow the same process +as installing themes, except you will want to move your font folders to the +=/usr/share/icons/= directory instead. ** Fonts -Fonts are one of the overlooked parts of customization, but a good font -can make the whole screen look different. For example, I have installed -the [[https://github.com/IBM/plex/releases][IBM Plex]] fonts on my -system. This follows the same process as installing themes, except you -will want to move your font folders to the =/usr/share/fonts/= directory +Fonts are one of the overlooked parts of customization, but a good font can make +the whole screen look different. For example, I have installed the [[https://github.com/IBM/plex/releases][IBM Plex]] +fonts on my system. This follows the same process as installing themes, except +you will want to move your font folders to the =/usr/share/fonts/= directory instead. ** Terminal -If you spend a lot of time typing commands, you know how important the -style and functionality of the terminal is. After spending a lot of time -using the default GNOME terminal with -[[https://en.wikipedia.org/wiki/Bash_(Unix_shell)][unix shell]], I -decided to try some different options. I ended up choosing -[[https://terminator-gtk3.readthedocs.io/en/latest/][Terminator]] with -[[https://en.wikipedia.org/wiki/Z_shell][zsh]]. - -Terminator is great if you need to open multiple terminals at one time -by simply right-clicking and splitting the screen into as many terminals -as you want. While this project hasn't been updated in a while, -[[https://github.com/gnome-terminator/terminator/issues/1][it is coming -under new development]]. However, this terminal is great and I haven't -experienced any errors yet. - -For the shell choice, I decided to choose zsh after trying it out on a -fresh Manjaro installation. Zsh is great if you like to change the -themes of your terminal, include icons, or add plugins. - -The desktop uses the -[[https://github.com/zsh-users/zsh-autosuggestions][zsh-autosuggestions]] -to suggest past commands as you type. In addition, it suggests -corrections if you misspell a command. Lastly, it uses the =af-magic= -theme, which adds dashed lines between commands, moving the user@host -tag to the right side of the terminal, and changes the colors. There are -plenty of plugins and themes to choose from. Just figure out what you -like and add it to your =~/.zshrc= file! +If you spend a lot of time typing commands, you know how important the style and +functionality of the terminal is. After spending a lot of time using the default +GNOME terminal with [[https://en.wikipedia.org/wiki/Bash_(Unix_shell)][unix shell]], I decided to try some different options. I ended +up choosing [[https://terminator-gtk3.readthedocs.io/en/latest/][Terminator]] with [[https://en.wikipedia.org/wiki/Z_shell][zsh]]. + +Terminator is great if you need to open multiple terminals at one time by simply +right-clicking and splitting the screen into as many terminals as you want. +While this project hasn't been updated in a while, [[https://github.com/gnome-terminator/terminator/issues/1][it is coming under new +development]]. However, this terminal is great and I haven't experienced any +errors yet. + +For the shell choice, I decided to choose zsh after trying it out on a fresh +Manjaro installation. Zsh is great if you like to change the themes of your +terminal, include icons, or add plugins. + +The desktop uses the [[https://github.com/zsh-users/zsh-autosuggestions][zsh-autosuggestions]] to suggest past commands as you type. +In addition, it suggests corrections if you misspell a command. Lastly, it uses +the =af-magic= theme, which adds dashed lines between commands, moving the +user@host tag to the right side of the terminal, and changes the colors. There +are plenty of plugins and themes to choose from. Just figure out what you like +and add it to your =~/.zshrc= file! *** Steps to Replicate My Terminal To install zsh on Ubuntu, enter the following command into a terminal: @@ -179,9 +162,9 @@ To install zsh-autosuggestions via Oh My Zsh: git clone https://github.com/zsh-users/zsh-autosuggestions ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-autosuggestions #+end_src -Then, add the following plugin wording to your =~/.zshrc= file (the -default config usually has the =git= plugin activated, so just add any -other plugins to the parentheses separated by a space): +Then, add the following plugin wording to your =~/.zshrc= file (the default +config usually has the =git= plugin activated, so just add any other plugins to +the parentheses separated by a space): #+begin_src sh nano ~/.zshrc @@ -191,5 +174,5 @@ nano ~/.zshrc plugins=(git zsh-autosuggestions) #+end_src -Finally, you need to log out of your computer and log back in so your -user shell can refresh. +Finally, you need to log out of your computer and log back in so your user shell +can refresh. diff --git a/content/blog/2020-07-20-video-game-sales.org b/content/blog/2020-07-20-video-game-sales.org index 672558d..2967c17 100644 --- a/content/blog/2020-07-20-video-game-sales.org +++ b/content/blog/2020-07-20-video-game-sales.org @@ -4,10 +4,8 @@ #+filetags: :data: * Background Information -This dataset (obtained from -[[https://www.kaggle.com/gregorut/videogamesales/data][Kaggle]]) -contains a list of video games with sales greater than 100,000 copies. -It was generated by a scrape of vgchartz.com. +This dataset (obtained from [[https://www.kaggle.com/gregorut/videogamesales/data][Kaggle]]) contains a list of video games with sales +greater than 100,000 copies. It was generated by a scrape of vgchartz.com. Fields include: @@ -23,8 +21,7 @@ Fields include: - Other_{Sales}: Sales in the rest of the world (in millions) - Global_{Sales}: Total worldwide sales. -There are 16,598 records. 2 records were dropped due to incomplete -information. +There are 16,598 records. 2 records were dropped due to incomplete information. * Import the Data #+begin_src python @@ -45,7 +42,8 @@ df * Explore the Data #+begin_src python -# With the description function, we can see the basic stats. For example, we can also see that the 'Year' column has some incomplete values. +# With the description function, we can see the basic stats. For example, we can +# also see that the 'Year' column has some incomplete values. df.describe() #+end_src @@ -158,18 +156,18 @@ df3.sort_values(by=['Global_Sales'], ascending=False).head(5) [[https://img.cleberg.net/blog/20200720-data-exploration-video-game-sales/09_outliers-min.png]] * Discussion -The purpose of exploring datasets is to ask questions, answer questions, -and discover intelligence that can be used to inform decision-making. -So, what have we found in this dataset? - -Today we simply explored a publicly-available dataset to see what kind -of information it contained. During that exploration, we found that -video game sales peaked in 2006. That peak was largely due to Nintendo, -who sold the top 5 games in 2006 and has a number of games in the top-10 -list for the years 1980-2020. Additionally, the top four platforms by -global sales (Wii, NES, GB, DS) are owned by Nintendo. - -We didn't explore everything this dataset has to offer, but we can tell -from a brief analysis that Nintendo seems to rule sales in the video -gaming world. Further analysis could provide insight into which genres, -regions, publishers, or world events are correlated with sales. +The purpose of exploring datasets is to ask questions, answer questions, and +discover intelligence that can be used to inform decision-making. So, what have +we found in this dataset? + +Today we simply explored a publicly-available dataset to see what kind of +information it contained. During that exploration, we found that video game +sales peaked in 2006. That peak was largely due to Nintendo, who sold the top 5 +games in 2006 and has a number of games in the top-10 list for the years +1980-2020. Additionally, the top four platforms by global sales (Wii, NES, GB, +DS) are owned by Nintendo. + +We didn't explore everything this dataset has to offer, but we can tell from a +brief analysis that Nintendo seems to rule sales in the video gaming world. +Further analysis could provide insight into which genres, regions, publishers, +or world events are correlated with sales. diff --git a/content/blog/2020-07-26-business-analysis.org b/content/blog/2020-07-26-business-analysis.org index 6d60471..098dce7 100644 --- a/content/blog/2020-07-26-business-analysis.org +++ b/content/blog/2020-07-26-business-analysis.org @@ -4,9 +4,9 @@ #+filetags: :data: * Background Information -This project aims to help investors learn more about a random city in -order to determine optimal locations for business investments. The data -used in this project was obtained using Foursquare's developer API. +This project aims to help investors learn more about a random city in order to +determine optimal locations for business investments. The data used in this +project was obtained using Foursquare's developer API. Fields include: @@ -15,12 +15,12 @@ Fields include: - Venue Latitude - Venue Longitude -There are 232 records found using the center of Lincoln as the area of -interest with a radius of 10,000. +There are 232 records found using the center of Lincoln as the area of interest +with a radius of 10,000. * Import the Data -The first step is the simplest: import the applicable libraries. We will -be using the libraries below for this project. +The first step is the simplest: import the applicable libraries. We will be +using the libraries below for this project. #+begin_src python # Import the Python libraries we will be using @@ -33,10 +33,10 @@ from pandas.io.json import json_normalize from sklearn.cluster import KMeans #+end_src -To begin our analysis, we need to import the data for this project. The -data we are using in this project comes directly from the Foursquare -API. The first step is to get the latitude and longitude of the city -being studied (Lincoln, NE) and setting up the folium map. +To begin our analysis, we need to import the data for this project. The data we +are using in this project comes directly from the Foursquare API. The first step +is to get the latitude and longitude of the city being studied (Lincoln, NE) and +setting up the folium map. #+begin_src python # Define the latitude and longitude, then map the results @@ -50,11 +50,11 @@ map_LNK #+caption: Blank Map [[https://img.cleberg.net/blog/20200726-ibm-data-science/01_blank_map-min.png]] -Now that we have defined our city and created the map, we need to go get -the business data. The Foursquare API will limit the results to 100 per -API call, so we use our first API call below to determine the total -results that Foursquare has found. Since the total results are 232, we -perform the API fetching process three times (100 + 100 + 32 = 232). +Now that we have defined our city and created the map, we need to go get the +business data. The Foursquare API will limit the results to 100 per API call, so +we use our first API call below to determine the total results that Foursquare +has found. Since the total results are 232, we perform the API fetching process +three times (100 + 100 + 32 = 232). #+begin_src python # Foursquare API credentials @@ -117,13 +117,12 @@ results3 = requests.get(url3).json() #+end_src * Clean the Data -Now that we have our data in three separate dataframes, we need to -combine them into a single dataframe and make sure to reset the index so -that we have a unique ID for each business. The =get~categorytype~= -function below will pull the categories and name from each business's -entry in the Foursquare data automatically. Once all the data has been -labeled and combined, the results are stored in the =nearby_venues= -dataframe. +Now that we have our data in three separate dataframes, we need to combine them +into a single dataframe and make sure to reset the index so that we have a +unique ID for each business. The =get~categorytype~= function below will pull +the categories and name from each business's entry in the Foursquare data +automatically. Once all the data has been labeled and combined, the results are +stored in the =nearby_venues= dataframe. #+begin_src python # This function will extract the category of the venue from the API dictionary @@ -194,9 +193,9 @@ nearby_venues [[https://img.cleberg.net/blog/20200726-ibm-data-science/02_clean_data-min.png]] * Visualize the Data -We now have a complete, clean data set. The next step is to visualize -this data onto the map we created earlier. We will be using folium's -=CircleMarker()= function to do this. +We now have a complete, clean data set. The next step is to visualize this data +onto the map we created earlier. We will be using folium's =CircleMarker()= +function to do this. #+begin_src python # add markers to map @@ -220,15 +219,14 @@ map_LNK data map]] * Clustering: /k-means/ -To cluster the data, we will be using the /k-means/ algorithm. This -algorithm is iterative and will automatically make sure that data points -in each cluster are as close as possible to each other, while being as -far as possible away from other clusters. +To cluster the data, we will be using the /k-means/ algorithm. This algorithm is +iterative and will automatically make sure that data points in each cluster are +as close as possible to each other, while being as far as possible away from +other clusters. -However, we first have to figure out how many clusters to use (defined -as the variable /'k'/). To do so, we will use the next two functions to -calculate the sum of squares within clusters and then return the optimal -number of clusters. +However, we first have to figure out how many clusters to use (defined as the +variable /'k'/). To do so, we will use the next two functions to calculate the +sum of squares within clusters and then return the optimal number of clusters. #+begin_src python # This function will return the sum of squares found in the data @@ -266,9 +264,9 @@ def optimal_number_of_clusters(wcss): n = optimal_number_of_clusters(sum_of_squares) #+end_src -Now that we have found that our optimal number of clusters is six, we -need to perform k-means clustering. When this clustering occurs, each -business is assigned a cluster number from 0 to 5 in the dataframe. +Now that we have found that our optimal number of clusters is six, we need to +perform k-means clustering. When this clustering occurs, each business is +assigned a cluster number from 0 to 5 in the dataframe. #+begin_src python # set number of clusters equal to the optimal number @@ -281,9 +279,8 @@ kmeans = KMeans(n_clusters=kclusters, random_state=0).fit(cluster_df) nearby_venues.insert(0, 'Cluster Labels', kmeans.labels_) #+end_src -Success! We now have a dataframe with clean business data, along with a -cluster number for each business. Now let's map the data using six -different colors. +Success! We now have a dataframe with clean business data, along with a cluster +number for each business. Now let's map the data using six different colors. #+begin_src python # create map with clusters @@ -310,12 +307,11 @@ map_clusters [[https://img.cleberg.net/blog/20200726-ibm-data-science/04_clusters-min.png]] * Investigate Clusters -Now that we have figured out our clusters, let's do a little more -analysis to provide more insight into the clusters. With the information -below, we can see which clusters are more popular for businesses and -which are less popular. The results below show us that clusters 0 -through 3 are popular, while clusters 4 and 5 are not very popular at -all. +Now that we have figured out our clusters, let's do a little more analysis to +provide more insight into the clusters. With the information below, we can see +which clusters are more popular for businesses and which are less popular. The +results below show us that clusters 0 through 3 are popular, while clusters 4 +and 5 are not very popular at all. #+begin_src python # Show how many venues are in each cluster @@ -329,9 +325,9 @@ for x in range(0,6): #+caption: Venues per Cluster [[https://img.cleberg.net/blog/20200726-ibm-data-science/05_venues_per_cluster-min.png]] -Our last piece of analysis is to summarize the categories of businesses -within each cluster. With these results, we can clearly see that -restaurants, coffee shops, and grocery stores are the most popular. +Our last piece of analysis is to summarize the categories of businesses within +each cluster. With these results, we can clearly see that restaurants, coffee +shops, and grocery stores are the most popular. #+begin_src python # Calculate how many venues there are in each category @@ -362,19 +358,17 @@ with pd.option_context('display.max_rows', None, 'display.max_columns', None): [[https://img.cleberg.net/blog/20200726-ibm-data-science/07_categories_per_cluster_pt2-min.png]] * Discussion -In this project, we gathered location data for Lincoln, Nebraska, USA -and clustered the data using the k-means algorithm in order to identify -the unique clusters of businesses in Lincoln. Through these actions, we -found that there are six unique business clusters in Lincoln and that -two of the clusters are likely unsuitable for investors. The remaining -four clusters have a variety of businesses, but are largely dominated by -restaurants and grocery stores. - -Using this project, investors can now make more informed decisions when -deciding the location and category of business in which to invest. - -Further studies may involve other attributes for business locations, -such as population density, average wealth across the city, or crime -rates. In addition, further studies may include additional location data -and businesses by utilizing multiple sources, such as Google Maps and -OpenStreetMap. +In this project, we gathered location data for Lincoln, Nebraska, USA and +clustered the data using the k-means algorithm in order to identify the unique +clusters of businesses in Lincoln. Through these actions, we found that there +are six unique business clusters in Lincoln and that two of the clusters are +likely unsuitable for investors. The remaining four clusters have a variety of +businesses, but are largely dominated by restaurants and grocery stores. + +Using this project, investors can now make more informed decisions when deciding +the location and category of business in which to invest. + +Further studies may involve other attributes for business locations, such as +population density, average wealth across the city, or crime rates. In addition, +further studies may include additional location data and businesses by utilizing +multiple sources, such as Google Maps and OpenStreetMap. diff --git a/content/blog/2020-08-22-redirect-github-pages.org b/content/blog/2020-08-22-redirect-github-pages.org index cae5928..562249d 100644 --- a/content/blog/2020-08-22-redirect-github-pages.org +++ b/content/blog/2020-08-22-redirect-github-pages.org @@ -5,17 +5,16 @@ * Short answer ** Step 1 -Add a new file CNAME to your GitHub Pages repository containing only one -line: your top-level domain name. E.g.: =example.com= +Add a new file CNAME to your GitHub Pages repository containing only one line: +your top-level domain name. E.g.: =example.com= ** Step 2 [Optional] but highly recommended -2.1: Remove all other top-level records (prefixed with @) of type A from -your DNS configuration. +2.1: Remove all other top-level records (prefixed with @) of type A from your +DNS configuration. -2.2: Remove a CNAME record for the second-level domain www if it is -present. +2.2: Remove a CNAME record for the second-level domain www if it is present. ** Step 3 Add these 5 entries to the very top of your DNS configuration: @@ -35,52 +34,48 @@ Wait for your DNS changes to propagate. DNS changes aren't effective immediately. They can take up to a full day to propagate. * Long answer -This issue has two sides. One is the DNS configuration itself. Another -one is the way GitHub Pages will forward HTTP requests. +This issue has two sides. One is the DNS configuration itself. Another one is +the way GitHub Pages will forward HTTP requests. -We need to know a few things to understand what GitHub is trying to say -in their documentation. +We need to know a few things to understand what GitHub is trying to say in their +documentation. ** DNS Entry Types There are two types of DNS records which interest us: CNAME and A. -=A= is also known as =Apex= or sometimes as =root entry=. It forwards -requests to a specified fixed IP address. =CNAME= entry forwards -requests to a specified URL (actual valid plain text URL, not an IP -address). +=A= is also known as =Apex= or sometimes as =root entry=. It forwards requests +to a specified fixed IP address. =CNAME= entry forwards requests to a specified +URL (actual valid plain text URL, not an IP address). ** DNS Load balancing -GitHub has one central URL address which accepts all DNS requests for -GitHub Pages: =http://username.github.io=. That URL is resolved to -different IP addresses based on your geographical location. Website -hosted on GitHub Pages is a simple collection of =HTML=, =CSS= and =JS= -files. GitHub distributes these files to different servers across the -globe. So that when your browser sends a request from Europe, it -receives data from a server in Europe. The same is valid for the -requests from Asia and the USA. +GitHub has one central URL address which accepts all DNS requests for GitHub +Pages: =http://username.github.io=. That URL is resolved to different IP +addresses based on your geographical location. Website hosted on GitHub Pages is +a simple collection of =HTML=, =CSS= and =JS= files. GitHub distributes these +files to different servers across the globe. So that when your browser sends a +request from Europe, it receives data from a server in Europe. The same is valid +for the requests from Asia and the USA. ** What GitHub is trying to say -Since =A= records in DNS must contain IP addresses, and they must be -either =185.199.108.153= or =185.199.109.153= or =185.199.110.153= or -=185.199.111.153=, there is no way to forward requests to a server -located somewhere in Europe or Asia. Your website hosted at GitHub Pages -will be downloaded from a central GitHub Pages server. There is a minor -risk that if GitHub Pages DNS servers (=x.x.x.153=) are down for some -reason, all custom domains which use fixed GitHub Pages IP addresses -will not be accessible (their DNS requests will not be resolvable). - -That is why GitHub strongly suggests to either use a second-level domain -for your GitHub Pages (e.g. =blog.example.com=) or use a DNS service -provider that supports a record type =ALIAS= that acts as =A= record but -forwards request to a URL address (e.g. =username.github.io=) instead of -a fixed IP address. +Since =A= records in DNS must contain IP addresses, and they must be either +=185.199.108.153= or =185.199.109.153= or =185.199.110.153= or +=185.199.111.153=, there is no way to forward requests to a server located +somewhere in Europe or Asia. Your website hosted at GitHub Pages will be +downloaded from a central GitHub Pages server. There is a minor risk that if +GitHub Pages DNS servers (=x.x.x.153=) are down for some reason, all custom +domains which use fixed GitHub Pages IP addresses will not be accessible (their +DNS requests will not be resolvable). + +That is why GitHub strongly suggests to either use a second-level domain for +your GitHub Pages (e.g. =blog.example.com=) or use a DNS service provider that +supports a record type =ALIAS= that acts as =A= record but forwards request to a +URL address (e.g. =username.github.io=) instead of a fixed IP address. ** How GitHub Pages treats HTTP requests -After a DNS request for =your_github_username.github.io= is resolved -into an IP address, e.g. =185.199.108.153= your browser sends an HTTP -request to that server with an HTTP header =Host=. Below are =curl= -examples that load the same website (these examples might not work if -you are behind a proxy server): +After a DNS request for =your_github_username.github.io= is resolved into an IP +address, e.g. =185.199.108.153= your browser sends an HTTP request to that +server with an HTTP header =Host=. Below are =curl= examples that load the same +website (these examples might not work if you are behind a proxy server): #+begin_src sh curl --header "Host: your_github_username.github.io" http://185.199.108.153/ @@ -91,30 +86,25 @@ curl --header "Host: example.com" http://185.199.108.153/ This way GitHub Pages servers know which user website to serve. #+begin_quote -GitHub Pages server will automatically redirect HTTP requests to the -top-level domain if your =CNAME= file contains =example.com= but -=www.example.com= is requested. +GitHub Pages server will automatically redirect HTTP requests to the top-level +domain if your =CNAME= file contains =example.com= but =www.example.com= is +requested. -The same is valid if your =CNAME= file contains =www.example.com= but -the header =Host= in the =HTTP= request contains =example.com=. +The same is valid if your =CNAME= file contains =www.example.com= but the header +=Host= in the =HTTP= request contains =example.com=. #+end_quote ** Why can't I add a =CNAME= record entry that accepts a top-level request (=@=) to my DNS configuration? Quote from the GitHub Pages documentation: #+begin_quote -Warning: Do not create a CNAME record for your custom apex domain! Doing -so may cause issues with other services, such as email, on that domain. +Warning: Do not create a CNAME record for your custom apex domain! Doing so may +cause issues with other services, such as email, on that domain. #+end_quote ** References: -1. [[https://docs.github.com/en/github/working-with-github-pages/configuring-a-custom-domain-for-your-github-pages-site][Setting - up a custom domain with GitHub Pages]] -2. [[https://docs.github.com/en/github/working-with-github-pages/troubleshooting-custom-domains-and-github-pages][My - custom domain isn't working]] -3. [[https://serverfault.com/questions/589370/cannot-access-my-github-pages-website-by-ip-address][Cannot - access my GitHub Pages website by IP Address]] -4. [[https://stackoverflow.com/questions/23375422/how-do-i-set-up-github-pages-to-redirect-dns-requests-from-a-subdomain-e-g-www][How - do I set up GitHub Pages to redirect DNS requests from a subdomain - (e.g. www) to the top-level domain (TLD, Apex record)?]] - +1. [[https://docs.github.com/en/github/working-with-github-pages/configuring-a-custom-domain-for-your-github-pages-site][Setting up a custom domain with GitHub Pages]] +2. [[https://docs.github.com/en/github/working-with-github-pages/troubleshooting-custom-domains-and-github-pages][My custom domain isn't working]] +3. [[https://serverfault.com/questions/589370/cannot-access-my-github-pages-website-by-ip-address][Cannot access my GitHub Pages website by IP Address]] +4. [[https://stackoverflow.com/questions/23375422/how-do-i-set-up-github-pages-to-redirect-dns-requests-from-a-subdomain-e-g-www][How do I set up GitHub Pages to redirect DNS requests from a subdomain (e.g. + www) to the top-level domain (TLD, Apex record)?]] diff --git a/content/blog/2020-08-29-php-auth-flow.org b/content/blog/2020-08-29-php-auth-flow.org index 2e5cf5c..558ad2c 100644 --- a/content/blog/2020-08-29-php-auth-flow.org +++ b/content/blog/2020-08-29-php-auth-flow.org @@ -4,16 +4,15 @@ #+filetags: :dev: * Introduction -When creating websites that will allow users to create accounts, the -developer always needs to consider the proper authentication flow for -their app. For example, some developers will utilize an API for -authentication, some will use OAuth, and some may just use their own -simple database. +When creating websites that will allow users to create accounts, the developer +always needs to consider the proper authentication flow for their app. For +example, some developers will utilize an API for authentication, some will use +OAuth, and some may just use their own simple database. -For those using pre-built libraries, authentication may simply be a -problem of copying and pasting the code from their library's -documentation. For example, here's the code I use to authenticate users -with the Tumblr OAuth API for my Tumblr client, Vox Populi: +For those using pre-built libraries, authentication may simply be a problem of +copying and pasting the code from their library's documentation. For example, +here's the code I use to authenticate users with the Tumblr OAuth API for my +Tumblr client, Vox Populi: #+begin_src php // Start the session @@ -38,23 +37,22 @@ $client = new Tumblr\API\Client( ); #+end_src -However, developers creating authentication flows from scratch will need -to think carefully about when to make sure a web page will check the -user's authenticity. +However, developers creating authentication flows from scratch will need to +think carefully about when to make sure a web page will check the user's +authenticity. -In this article, we're going to look at a simple authentication flow -using a MySQL database and PHP. +In this article, we're going to look at a simple authentication flow using a +MySQL database and PHP. * Creating User Accounts -The beginning to any type of user authentication is to create a user -account. This process can take many formats, but the simplest is to -accept user input from a form (e.g., username and password) and send it -over to your database. For example, here's a snippet that shows how to -get username and password parameters that would come when a user submits -a form to your PHP script. +The beginning to any type of user authentication is to create a user account. +This process can take many formats, but the simplest is to accept user input +from a form (e.g., username and password) and send it over to your database. For +example, here's a snippet that shows how to get username and password parameters +that would come when a user submits a form to your PHP script. -*Note*: Ensure that your password column is large enough to hold the -hashed value (at least 60 characters or longer). +*Note*: Ensure that your password column is large enough to hold the hashed +value (at least 60 characters or longer). #+begin_src php // Get the values from the URL @@ -92,9 +90,9 @@ $conn->close(); #+end_src ** Validate Returning Users -To be able to verify that a returning user has a valid username and -password in your database is as simple as having users fill out a form -and comparing their inputs to your database. +To be able to verify that a returning user has a valid username and password in +your database is as simple as having users fill out a form and comparing their +inputs to your database. #+begin_src php // Query the database for username and password @@ -110,24 +108,23 @@ if(password_verify($password_input, $hashed_password)) { #+end_src * Storing Authentication State -Once you've created the user's account, now you're ready to initialize -the user's session. *You will need to do this on every page you load -while the user is logged in.** To do so, simply enter the following code -snippet: +Once you've created the user's account, now you're ready to initialize the +user's session. *You will need to do this on every page you load while the user +is logged in.** To do so, simply enter the following code snippet: #+begin_src php session_start(); #+end_src -Once you've initialized the session, the next step is to store the -session in a cookie so that you can access it later. +Once you've initialized the session, the next step is to store the session in a +cookie so that you can access it later. #+begin_src php setcookie(session_name()); #+end_src -Now that the session name has been stored, you'll be able to check if -there's an active session whenever you load a page. +Now that the session name has been stored, you'll be able to check if there's an +active session whenever you load a page. #+begin_src php if(isset(session_name())) { @@ -136,9 +133,9 @@ if(isset(session_name())) { #+end_src ** Removing User Authentication -The next logical step is to give your users the option to log out once -they are done using your application. This can be tricky in PHP since a -few of the standard ways do not always work. +The next logical step is to give your users the option to log out once they are +done using your application. This can be tricky in PHP since a few of the +standard ways do not always work. #+begin_src php // Initialize the session. @@ -175,14 +172,10 @@ die(); #+end_src * Wrapping Up -Now you should be ready to begin your authentication programming with -PHP. You can create user accounts, create sessions for users across -different pages of your site, and then destroy the user data when -they're ready to leave. - -For more information on this subject, I recommend reading the -[[https://www.php.net/][PHP Documentation]]. Specifically, you may want -to look at [[https://www.php.net/manual/en/features.http-auth.php][HTTP -Authentication with PHP]], -[[https://www.php.net/manual/en/book.session.php][session handling]], -and [[https://www.php.net/manual/en/function.hash.php][hash]]. +Now you should be ready to begin your authentication programming with PHP. You +can create user accounts, create sessions for users across different pages of +your site, and then destroy the user data when they're ready to leave. + +For more information on this subject, I recommend reading the [[https://www.php.net/][PHP Documentation]]. +Specifically, you may want to look at [[https://www.php.net/manual/en/features.http-auth.php][HTTP Authentication with PHP]], [[https://www.php.net/manual/en/book.session.php][session +handling]], and [[https://www.php.net/manual/en/function.hash.php][hash]]. diff --git a/content/blog/2020-09-01-visual-recognition.org b/content/blog/2020-09-01-visual-recognition.org index d703113..1e0f3b5 100644 --- a/content/blog/2020-09-01-visual-recognition.org +++ b/content/blog/2020-09-01-visual-recognition.org @@ -4,37 +4,30 @@ #+filetags: :dev: * What is IBM Watson? -If you've never heard of [[https://www.ibm.com/watson][Watson]], this -service is a suite of enterprise-ready AI services, applications, and -tooling provided by IBM. Watson contains quite a few useful tools for -data scientists and students, including the subject of this post today: -visual recognition. +If you've never heard of [[https://www.ibm.com/watson][Watson]], this service is a suite of enterprise-ready AI +services, applications, and tooling provided by IBM. Watson contains quite a few +useful tools for data scientists and students, including the subject of this +post today: visual recognition. -If you'd like to view the official documentation for the Visual -Recognition API, visit the -[[https://cloud.ibm.com/apidocs/visual-recognition/visual-recognition-v3?code=python][API -Docs]]. +If you'd like to view the official documentation for the Visual Recognition API, +visit the [[https://cloud.ibm.com/apidocs/visual-recognition/visual-recognition-v3?code=python][API Docs]]. * Prerequisites To be able to use Watson Visual Recognition, you'll need the following: -1. Create a free account on - [[https://www.ibm.com/cloud/watson-studio][IBM Watson Studio]]. -2. Add the [[https://www.ibm.com/cloud/watson-visual-recognition][Watson - Visual Recognition]] service to your IBM Watson account. -3. Get your API key and URL. To do this, first go to the - [[https://dataplatform.cloud.ibm.com/home2?context=cpdaas][profile - dashboard]] for your IBM account and click on the Watson Visual - Recognition service you created. This will be listed in the section - titled *Your services*. Then click the *Credentials** tab and open the - *Auto-generated credentials** dropdown. Copy your API key and URL so - that you can use them in the Python script later. -4. *[Optional]** While not required, you can also create the Jupyter - Notebook for this project right inside - [[https://www.ibm.com/cloud/watson-studio][Watson Studio]]. Watson - Studio will save your notebooks inside an organized project and allow - you to use their other integrated products, such as storage - containers, AI models, documentation, external sharing, etc. +1. Create a free account on [[https://www.ibm.com/cloud/watson-studio][IBM Watson Studio]]. +2. Add the [[https://www.ibm.com/cloud/watson-visual-recognition][Watson Visual Recognition]] service to your IBM Watson account. +3. Get your API key and URL. To do this, first go to the [[https://dataplatform.cloud.ibm.com/home2?context=cpdaas][profile dashboard]] for + your IBM account and click on the Watson Visual Recognition service you + created. This will be listed in the section titled *Your services*. Then + click the *Credentials** tab and open the *Auto-generated credentials** + dropdown. Copy your API key and URL so that you can use them in the Python + script later. +4. *[Optional]** While not required, you can also create the Jupyter Notebook + for this project right inside [[https://www.ibm.com/cloud/watson-studio][Watson Studio]]. Watson Studio will save your + notebooks inside an organized project and allow you to use their other + integrated products, such as storage containers, AI models, documentation, + external sharing, etc. * Calling the IBM Watson Visual Recognition API Okay, now let's get started. @@ -45,8 +38,8 @@ To begin, we need to install the proper Python package for IBM Watson. pip install --upgrade --user "ibm-watson>=4.5.0" #+end_src -Next, we need to specify the API key, version, and URL given to us when -we created the Watson Visual Recognition service. +Next, we need to specify the API key, version, and URL given to us when we +created the Watson Visual Recognition service. #+begin_src python apikey = "<your-apikey>" @@ -70,15 +63,15 @@ visual_recognition = VisualRecognitionV3( visual_recognition.set_service_url(url) #+end_src -*[Optional]* If you'd like to tell the API not to use any data to -improve their products, set the following header. +*[Optional]* If you'd like to tell the API not to use any data to improve their +products, set the following header. #+begin_src python visual_recognition.set_default_headers({'x-watson-learning-opt-out': "true"}) #+end_src -Now we have our API all set and ready to go. For this example, I'm going -to include a =dict= of photos to load as we test out the API. +Now we have our API all set and ready to go. For this example, I'm going to +include a =dict= of photos to load as we test out the API. #+begin_src python data = [ @@ -109,14 +102,14 @@ data = [ ] #+end_src -Now that we've set up our libraries and have the photos ready, let's -create a loop to call the API for each image. The code below shows a -loop that calls the URL of each image and sends it to the API, -requesting results with at least 60% confidence. The results are output -to the console with dotted lines separating each section. +Now that we've set up our libraries and have the photos ready, let's create a +loop to call the API for each image. The code below shows a loop that calls the +URL of each image and sends it to the API, requesting results with at least 60% +confidence. The results are output to the console with dotted lines separating +each section. -In the case of an API error, the codes and explanations are output to -the console. +In the case of an API error, the codes and explanations are output to the +console. #+begin_src python from ibm_watson import ApiException @@ -142,23 +135,22 @@ except ApiException as ex: #+end_src * The Results -Here we can see the full result set of our function above. If you view -each of the URLs that we sent to the API, you'll be able to see that it -was remarkably accurate. To be fair, these are clear high-resolution, -clear photos shot with a professional camera. In reality, you will most -likely be processing images that are lower quality and may have a lot of -noise in the photo. - -However, we can clearly see the benefit of being able to call this API -instead of attempting to write our own image recognition function. Each -of the classifications returned was a fair description of the image. - -If you wanted to restrict the results to those that are at least 90% -confident or greater, you would simply adjust the =threshold= in the +Here we can see the full result set of our function above. If you view each of +the URLs that we sent to the API, you'll be able to see that it was remarkably +accurate. To be fair, these are clear high-resolution, clear photos shot with a +professional camera. In reality, you will most likely be processing images that +are lower quality and may have a lot of noise in the photo. + +However, we can clearly see the benefit of being able to call this API instead +of attempting to write our own image recognition function. Each of the +classifications returned was a fair description of the image. + +If you wanted to restrict the results to those that are at least 90% confident +or greater, you would simply adjust the =threshold= in the =visual_recognition.classify()= function. -When your program runs, it should show the output below for each photo -you provide. +When your program runs, it should show the output below for each photo you +provide. #+begin_src txt ---------------------------------------------------------------- @@ -176,22 +168,19 @@ greenishness color ( 0.975 ) #+end_src * Discussion -Now, this was a very minimal implementation of the API. We simply -supplied some images and looked to see how accurate the results were. -However, you could implement this type of API into many machine learning -(ML) models. - -For example, you could be working for a company that scans their -warehouses or inventory using drones. Would you want to pay employees to -sit there and watch drone footage all day in order to identify or count -things in the video? Probably not. Instead, you could use a -classification system similar to this one in order to train your machine -learning model to correctly identify items that the drones show through -video. More specifically, you could have your machine learning model -watch a drone fly over a field of sheep in order to count how many sheep -are living in that field. - -There are many ways to implement machine learning functionality, but -hopefully this post helped inspire some deeper thought about the tools -that can help propel us further into the future of machine learning and -AI. +Now, this was a very minimal implementation of the API. We simply supplied some +images and looked to see how accurate the results were. However, you could +implement this type of API into many machine learning (ML) models. + +For example, you could be working for a company that scans their warehouses or +inventory using drones. Would you want to pay employees to sit there and watch +drone footage all day in order to identify or count things in the video? +Probably not. Instead, you could use a classification system similar to this one +in order to train your machine learning model to correctly identify items that +the drones show through video. More specifically, you could have your machine +learning model watch a drone fly over a field of sheep in order to count how +many sheep are living in that field. + +There are many ways to implement machine learning functionality, but hopefully +this post helped inspire some deeper thought about the tools that can help +propel us further into the future of machine learning and AI. diff --git a/content/blog/2020-09-22-internal-audit.org b/content/blog/2020-09-22-internal-audit.org index 3074266..b90b461 100644 --- a/content/blog/2020-09-22-internal-audit.org +++ b/content/blog/2020-09-22-internal-audit.org @@ -7,64 +7,63 @@ [[https://img.cleberg.net/blog/20200922-what-is-internal-audit/internal-audit-overview.jpg]] * Definitions -One of the many reasons that Internal Audit needs such thorough -explaining to non-auditors is that Internal Audit can serve many -purposes, depending on the organization's size and needs. However, the -Institute of Internal Auditors (IIA) defines Internal Auditing as: +One of the many reasons that Internal Audit needs such thorough explaining to +non-auditors is that Internal Audit can serve many purposes, depending on the +organization's size and needs. However, the Institute of Internal Auditors (IIA) +defines Internal Auditing as: #+begin_quote -Internal auditing is an independent, objective assurance and consulting -activity designed to add value and improve an organization's operations. -It helps an organization accomplish its objectives by bringing a -systematic, disciplined approach to evaluate and improve the -effectiveness of risk management, control, and governance processes. +Internal auditing is an independent, objective assurance and consulting activity +designed to add value and improve an organization's operations. It helps an +organization accomplish its objectives by bringing a systematic, disciplined +approach to evaluate and improve the effectiveness of risk management, control, +and governance processes. #+end_quote -However, this definition uses quite a few terms that aren't clear unless -the reader already has a solid understanding of the auditing profession. -To further explain, the following is a list of definitions that can help -supplement understanding of internal auditing. +However, this definition uses quite a few terms that aren't clear unless the +reader already has a solid understanding of the auditing profession. To further +explain, the following is a list of definitions that can help supplement +understanding of internal auditing. ** Independent -Independence is the freedom from conditions that threaten the ability of -the internal audit activity to carry out internal audit responsibilities -in an unbiased manner. To achieve the degree of independence necessary -to effectively carry out the responsibilities of the internal audit -activity, the chief audit executive has direct and unrestricted access -to senior management and the board. This can be achieved through a -dual-reporting relationship. Threats to independence must be managed at -the individual auditor, engagement, functional, and organizational -levels. +Independence is the freedom from conditions that threaten the ability of the +internal audit activity to carry out internal audit responsibilities in an +unbiased manner. To achieve the degree of independence necessary to effectively +carry out the responsibilities of the internal audit activity, the chief audit +executive has direct and unrestricted access to senior management and the board. +This can be achieved through a dual-reporting relationship. Threats to +independence must be managed at the individual auditor, engagement, functional, +and organizational levels. ** Objective -Objectivity is an unbiased mental attitude that allows internal auditors -to perform engagements in such a manner that they believe in their work -product and that no quality compromises are made. Objectivity requires -that internal auditors do not subordinate their judgment on audit -matters to others. Threats to objectivity must be managed at the -individual auditor, engagement, functional, and organizational levels. +Objectivity is an unbiased mental attitude that allows internal auditors to +perform engagements in such a manner that they believe in their work product and +that no quality compromises are made. Objectivity requires that internal +auditors do not subordinate their judgment on audit matters to others. Threats +to objectivity must be managed at the individual auditor, engagement, +functional, and organizational levels. ** Assurance -Assurance services involve the internal auditor's objective assessment -of evidence to provide opinions or conclusions regarding an entity, -operation, function, process, system, or other subject matters. The -internal auditor determines the nature and scope of an assurance -engagement. Generally, three parties are participants in assurance -services: (1) the person or group directly involved with the entity, -operation, function, process, system, or other subject - (the process -owner), (2) the person or group making the assessment - (the internal -auditor), and (3) the person or group using the assessment - (the user). +Assurance services involve the internal auditor's objective assessment of +evidence to provide opinions or conclusions regarding an entity, operation, +function, process, system, or other subject matters. The internal auditor +determines the nature and scope of an assurance engagement. Generally, three +parties are participants in assurance services: (1) the person or group directly +involved with the entity, operation, function, process, system, or other +subject - (the process owner), (2) the person or group making the assessment - +(the internal auditor), and (3) the person or group using the assessment - (the +user). ** Consulting -Consulting services are advisory in nature and are generally performed -at the specific request of an engagement client. The nature and scope of -the consulting engagement are subject to agreement with the engagement -client. Consulting services generally involve two parties: (1) the -person or group offering the advice (the internal auditor), and (2) the -person or group seeking and receiving the advice (the engagement -client). When performing consulting services, the internal auditor -should maintain objectivity and not assume management responsibility. +Consulting services are advisory in nature and are generally performed at the +specific request of an engagement client. The nature and scope of the consulting +engagement are subject to agreement with the engagement client. Consulting +services generally involve two parties: (1) the person or group offering the +advice (the internal auditor), and (2) the person or group seeking and receiving +the advice (the engagement client). When performing consulting services, the +internal auditor should maintain objectivity and not assume management +responsibility. ** Governance, Risk Management, & Compliance (GRC) The integrated collection of capabilities that enable an organization to @@ -72,176 +71,162 @@ reliably achieve objectives, address uncertainty and act with integrity. * Audit Charter & Standards First, it's important to note that not every organization needs internal -auditors. In fact, it's unwise for an organization to hire internal -auditors unless they have regulatory requirements for auditing and have -the capital to support the department. Internal audit is a cost center -that can only affect revenue indirectly. - -Once an organization determines the need for internal assurance -services, they will hire a Chief Audit Executive and create the audit -charter. This charter is a document, approved by the company's governing -body, that will define internal audit's purpose, authority, -responsibility, and position within the organization. Fortunately, the -IIA has model charters available to IIA members for those developing or -improving their charter. - -Beyond the charter and organizational documents, internal auditors -follow a few different standards in order to perform their job. First is -the International Professional Practices Framework (IPPF) by the IIA, -which is the model of standards for internal auditing. In addition, -ISACA's Information Technology Assurance Framework (ITAF) helps guide -auditors in reference to information technology (IT) compliance and -assurance. Finally, additional standards such as FASB, GAAP, and -industry-specific standards are used when performing internal audit -work. +auditors. In fact, it's unwise for an organization to hire internal auditors +unless they have regulatory requirements for auditing and have the capital to +support the department. Internal audit is a cost center that can only affect +revenue indirectly. + +Once an organization determines the need for internal assurance services, they +will hire a Chief Audit Executive and create the audit charter. This charter is +a document, approved by the company's governing body, that will define internal +audit's purpose, authority, responsibility, and position within the +organization. Fortunately, the IIA has model charters available to IIA members +for those developing or improving their charter. + +Beyond the charter and organizational documents, internal auditors follow a few +different standards in order to perform their job. First is the International +Professional Practices Framework (IPPF) by the IIA, which is the model of +standards for internal auditing. In addition, ISACA's Information Technology +Assurance Framework (ITAF) helps guide auditors in reference to information +technology (IT) compliance and assurance. Finally, additional standards such as +FASB, GAAP, and industry-specific standards are used when performing internal +audit work. * Three Lines of Defense -[[https://theiia.org][The IIA]] released the original Three Lines of -Defense model in 2013, but have released an updated version in 2020. -Here is what the Three Lines of Defense model has historically looked -like: +[[https://theiia.org][The IIA]] released the original Three Lines of Defense model in 2013, but have +released an updated version in 2020. Here is what the Three Lines of Defense +model has historically looked like: #+caption: 2013 Three Lines of Defense Model [[https://img.cleberg.net/blog/20200922-what-is-internal-audit/three_lines_model.png]] -I won't go into depth about the changes made to the model in this -article. Instead, let's take a look at the most current model. +I won't go into depth about the changes made to the model in this article. +Instead, let's take a look at the most current model. #+caption: 2020 Three Lines of Defense Model [[https://img.cleberg.net/blog/20200922-what-is-internal-audit/updated_three_lines_model.png]] The updated model forgets the strict idea of areas performing their own -functions or line of defense. Instead of talking about management, risk, -and internal audit as 1-2-3, the new model creates a more fluid and -cooperative model. - -Looking at this model from an auditing perspective shows us that -auditors will need to align, communicate, and collaborate with -management, including business area managers and chief officers, as well -as reporting to the governing body. The governing body will instruct -internal audit /functionally/ on their goals and track their progress -periodically. - -However, the internal audit department will report /administratively/ to -a chief officer in the company for the purposes of collaboration, -direction, and assistance with the business. Note that in most -situations, the governing body is the audit committee on the company's -board of directors. - -The result of this structure is that internal audit is an independent -and objective function that can provide assurance over the topics they -audit. +functions or line of defense. Instead of talking about management, risk, and +internal audit as 1-2-3, the new model creates a more fluid and cooperative +model. + +Looking at this model from an auditing perspective shows us that auditors will +need to align, communicate, and collaborate with management, including business +area managers and chief officers, as well as reporting to the governing body. +The governing body will instruct internal audit /functionally/ on their goals +and track their progress periodically. + +However, the internal audit department will report /administratively/ to a chief +officer in the company for the purposes of collaboration, direction, and +assistance with the business. Note that in most situations, the governing body +is the audit committee on the company's board of directors. + +The result of this structure is that internal audit is an independent and +objective function that can provide assurance over the topics they audit. * Audit Process -A normal audit will generally follow the same process, regardless of the -topic. However, certain special projects or abnormal business areas may -call for changes to the audit process. The audit process is not set in -stone, it's simply a set of best practices so that audits can be -performed consistently. +A normal audit will generally follow the same process, regardless of the topic. +However, certain special projects or abnormal business areas may call for +changes to the audit process. The audit process is not set in stone, it's simply +a set of best practices so that audits can be performed consistently. #+caption: The Internal Audit Process [[https://img.cleberg.net/blog/20200922-what-is-internal-audit/internal-audit-process.jpg]] -While different organizations may tweak the process, it will generally -follow this flow: +While different organizations may tweak the process, it will generally follow +this flow: ** 1. Risk Assessment The risk assessment part of the process has historically been performed -annually, but many organizations have moved to performing this process -much more frequently. In fact, some organizations are moving to an agile -approach that can take new risks into the risk assessment and -re-prioritize risk areas on-the-go. To perform a risk assessment, -leaders in internal audit will research industry risks, consult with -business leaders around the company, and perform analyses on company -data. +annually, but many organizations have moved to performing this process much more +frequently. In fact, some organizations are moving to an agile approach that can +take new risks into the risk assessment and re-prioritize risk areas on-the-go. +To perform a risk assessment, leaders in internal audit will research industry +risks, consult with business leaders around the company, and perform analyses on +company data. Once a risk assessment has been documented, the audit department has a -prioritized list of risks that can be audited. This is usually in the -form of auditable entities, such as business areas or departments. +prioritized list of risks that can be audited. This is usually in the form of +auditable entities, such as business areas or departments. ** 2. Planning -During the planning phase of an audit, auditors will meet with the -business area to discuss the various processes, controls, and risks -applicable to the business. This helps the auditors determine the scope -limits for the audit, as well as timing and subject-matter experts. -Certain documents will be created in this phase that will be used to -keep the audit on-track an in-scope as it goes forward. +During the planning phase of an audit, auditors will meet with the business area +to discuss the various processes, controls, and risks applicable to the +business. This helps the auditors determine the scope limits for the audit, as +well as timing and subject-matter experts. Certain documents will be created in +this phase that will be used to keep the audit on-track an in-scope as it goes +forward. ** 3. Testing -The testing phase, also known as fieldwork or execution, is where -internal auditors will take the information they've discovered and test -it against regulations, industry standards, company rules, best -practices, as well as validating that any processes are complete and -accurate. For example, an audit of HR would most likely examine -processes such as employee on-boarding, employee termination, security -of personally identifiable information (PII), or the IT systems involved -in these processes. Company standards would be examined and compared -against how the processes are actually being performed day-to-day, as -well as compared against regulations such as the Equal Employment -Opportunity (EEO), American with Disabilities Act, and National Labor -Relations Act. +The testing phase, also known as fieldwork or execution, is where internal +auditors will take the information they've discovered and test it against +regulations, industry standards, company rules, best practices, as well as +validating that any processes are complete and accurate. For example, an audit +of HR would most likely examine processes such as employee on-boarding, employee +termination, security of personally identifiable information (PII), or the IT +systems involved in these processes. Company standards would be examined and +compared against how the processes are actually being performed day-to-day, as +well as compared against regulations such as the Equal Employment Opportunity +(EEO), American with Disabilities Act, and National Labor Relations Act. ** 4. Reporting -Once all the tests have been completed, the audit will enter the -reporting phase. This is when the audit team will conclude on the -evidence they've collected, interviews they've held, and any opinions -they've formed on the controls in place. A summary of the audit -findings, conclusions, and specific recommendations are officially -communicated to the client through a draft report. Clients have the -opportunity to respond to the report and submit an action plan and time -frame. These responses become part of the final report which is -distributed to the appropriate level of administration. +Once all the tests have been completed, the audit will enter the reporting +phase. This is when the audit team will conclude on the evidence they've +collected, interviews they've held, and any opinions they've formed on the +controls in place. A summary of the audit findings, conclusions, and specific +recommendations are officially communicated to the client through a draft +report. Clients have the opportunity to respond to the report and submit an +action plan and time frame. These responses become part of the final report +which is distributed to the appropriate level of administration. ** 5. Follow-Up -After audits have been completed and management has formed action plans -and time frames for audit issues, internal audit will follow up once -that due date has arrived. In most cases, the follow-up will simply -consist of a meeting to discuss how the action plan has been completed -and to request documentation to prove it. +After audits have been completed and management has formed action plans and time +frames for audit issues, internal audit will follow up once that due date has +arrived. In most cases, the follow-up will simply consist of a meeting to +discuss how the action plan has been completed and to request documentation to +prove it. * Audit Department Structure While an internal audit department is most often thought of as a team of full-time employees, there are actually many different ways in which a -department can be structured. As the world becomes more digital and -fast-paced, outsourcing has become a more attractive option for some -organizations. Internal audit can be fully outsourced or partially -outsourced, allowing for flexibility in cases where turnover is high. - -In addition, departments can implement a rotational model. This allows -for interested employees around the organization to rotate into the -internal audit department for a period of time, allowing them to obtain -knowledge of risks and controls and allowing the internal audit team to -obtain more business area knowledge. This program is popular in very -large organizations, but organizations tend to rotate lower-level audit -staff instead of managers. This helps prevent any significant knowledge -loss as auditors rotate out to business areas. +department can be structured. As the world becomes more digital and fast-paced, +outsourcing has become a more attractive option for some organizations. Internal +audit can be fully outsourced or partially outsourced, allowing for flexibility +in cases where turnover is high. + +In addition, departments can implement a rotational model. This allows for +interested employees around the organization to rotate into the internal audit +department for a period of time, allowing them to obtain knowledge of risks and +controls and allowing the internal audit team to obtain more business area +knowledge. This program is popular in very large organizations, but +organizations tend to rotate lower-level audit staff instead of managers. This +helps prevent any significant knowledge loss as auditors rotate out to business +areas. * Consulting -Consulting is not an easy task at any organization, especially for a -department that can have negative perceptions within the organization as -the "compliance police." However, once an internal audit department has -delivered value to organization, adding consulting to their suite of -services is a smart move. In most cases, Internal Audit can insert -themselves into a consulting role without affecting the process of -project management at the company. This means that internal audit can -add objective assurance and opinions to business areas as they develop -new processes, instead of coming in periodically to audit an area and -file issues that could have been fixed at the beginning. +Consulting is not an easy task at any organization, especially for a department +that can have negative perceptions within the organization as the "compliance +police." However, once an internal audit department has delivered value to +organization, adding consulting to their suite of services is a smart move. In +most cases, Internal Audit can insert themselves into a consulting role without +affecting the process of project management at the company. This means that +internal audit can add objective assurance and opinions to business areas as +they develop new processes, instead of coming in periodically to audit an area +and file issues that could have been fixed at the beginning. * Data Science & Data Analytics #+caption: Data Science Skill Set [[https://img.cleberg.net/blog/20200922-what-is-internal-audit/data-science-skillset.png]] -One major piece of the internal audit function in the modern world is -data science. While the process is data science, most auditors will -refer to anything in this realm as data analytics. Hot topics such as -robotic process automation (RPA), machine learning (ML), and data mining -have taken over the auditing world in recent years. These technologies -have been immensely helpful with increasing the effectiveness and -efficiency of auditors. - -For example, mundane and repetitive tasks can be automated in order for -auditors to make more room in their schedules for labor-intensive work. -Further, auditors will need to adapt technologies like machine learning -in order to extract more value from the data they're using to form -conclusions. +One major piece of the internal audit function in the modern world is data +science. While the process is data science, most auditors will refer to anything +in this realm as data analytics. Hot topics such as robotic process automation +(RPA), machine learning (ML), and data mining have taken over the auditing world +in recent years. These technologies have been immensely helpful with increasing +the effectiveness and efficiency of auditors. + +For example, mundane and repetitive tasks can be automated in order for auditors +to make more room in their schedules for labor-intensive work. Further, auditors +will need to adapt technologies like machine learning in order to extract more +value from the data they're using to form conclusions. diff --git a/content/blog/2020-09-25-happiness-map.org b/content/blog/2020-09-25-happiness-map.org index 1eab63e..1f2b56f 100644 --- a/content/blog/2020-09-25-happiness-map.org +++ b/content/blog/2020-09-25-happiness-map.org @@ -4,10 +4,9 @@ #+filetags: :data: * Background Information -The dataset (obtained from -[[https://www.kaggle.com/unsdsn/world-happiness][Kaggle]]) used in this -article contains a list of countries around the world, their happiness -rankings and scores, as well as other national scoring measures. +The dataset (obtained from [[https://www.kaggle.com/unsdsn/world-happiness][Kaggle]]) used in this article contains a list of +countries around the world, their happiness rankings and scores, as well as +other national scoring measures. Fields include: @@ -20,8 +19,8 @@ Fields include: - Generosity - Perceptions of corruption -There are 156 records. Since there are ~195 countries in the world, we -can see that around 40 countries will be missing from this dataset. +There are 156 records. Since there are ~195 countries in the world, we can see +that around 40 countries will be missing from this dataset. * Install Packages As always, run the =install= command for all packages needed to perform @@ -32,9 +31,8 @@ analysis. #+end_src * Import the Data -We only need a couple packages to create a choropleth map. We will use -[[https://python-visualization.github.io/folium/][Folium]], which -provides map visualizations in Python. We will also use geopandas and +We only need a couple packages to create a choropleth map. We will use [[https://python-visualization.github.io/folium/][Folium]], +which provides map visualizations in Python. We will also use geopandas and pandas to wrangle our data before we put it on a map. #+begin_src python @@ -44,14 +42,14 @@ import geopandas as gpd import pandas as pd #+end_src -To get anything to show up on a map, we need a file that will specify -the boundaries of each country. Luckily, GeoJSON files exist (for free!) -on the internet. To get the boundaries of every country in the world, we -will use the GeoJSON link shown below. +To get anything to show up on a map, we need a file that will specify the +boundaries of each country. Luckily, GeoJSON files exist (for free!) on the +internet. To get the boundaries of every country in the world, we will use the +GeoJSON link shown below. -GeoPandas will take this data and load it into a dataframe so that we -can easily match it to the data we're trying to analyze. Let's look at -the GeoJSON dataframe: +GeoPandas will take this data and load it into a dataframe so that we can easily +match it to the data we're trying to analyze. Let's look at the GeoJSON +dataframe: #+begin_src python # Load the GeoJSON data with geopandas @@ -62,9 +60,9 @@ geo_data.head() #+caption: GeoJSON Dataframe [[https://img.cleberg.net/blog/20200925-world-choropleth-map/geojson_df.png]] -Next, let's load the data from the Kaggle dataset. I've downloaded this -file, so update the file path if you have it somewhere else. After -loading, let's take a look at this dataframe: +Next, let's load the data from the Kaggle dataset. I've downloaded this file, so +update the file path if you have it somewhere else. After loading, let's take a +look at this dataframe: #+begin_src python # Load the world happiness data with pandas @@ -76,12 +74,11 @@ happy_data.head() [[https://img.cleberg.net/blog/20200925-world-choropleth-map/happiness_df.png]] * Clean the Data -Some countries need to be renamed, or they will be lost when you merge -the happiness and GeoJSON dataframes. This is something I discovered -when the map below showed empty countries. I searched both data frames -for the missing countries to see the naming differences. Any countries -that do not have records in the =happy_data= df will not show up on the -map. +Some countries need to be renamed, or they will be lost when you merge the +happiness and GeoJSON dataframes. This is something I discovered when the map +below showed empty countries. I searched both data frames for the missing +countries to see the naming differences. Any countries that do not have records +in the =happy_data= df will not show up on the map. #+begin_src python # Rename some countries to match our GeoJSON data @@ -105,11 +102,11 @@ happy_data.at[democratic_congo_index, 'Country or region'] = 'Democratic Republi * Merge the Data Now that we have clean data, we need to merge the GeoJSON data with the -happiness data. Since we've stored them both in dataframes, we just need -to call the =.merge()= function. +happiness data. Since we've stored them both in dataframes, we just need to call +the =.merge()= function. -We will also rename a couple columns, just so that they're a little -easier to use when we create the map. +We will also rename a couple columns, just so that they're a little easier to +use when we create the map. #+begin_src python # Merge the two previous dataframes into a single geopandas dataframe @@ -125,10 +122,9 @@ merged_df = merged_df.rename(columns = {'Country or region':'Country'}) * Create the Map The data is finally ready to be added to a map. The code below shows the -simplest way to find the center of the map and create a Folium map -object. The important part is to remember to reference the merged -dataframe for our GeoJSON data and value data. The columns specify which -geo data and value data to use. +simplest way to find the center of the map and create a Folium map object. The +important part is to remember to reference the merged dataframe for our GeoJSON +data and value data. The columns specify which geo data and value data to use. #+begin_src python # Assign centroids to map @@ -162,10 +158,9 @@ Let's look at the resulting map. [[https://img.cleberg.net/blog/20200925-world-choropleth-map/map.png]] * Create a Tooltip on Hover -Now that we have a map set up, we could stop. However, I want to add a -tooltip so that I can see more information about each country. The -=tooltip_data= code below will show a popup on hover with all the data -fields shown. +Now that we have a map set up, we could stop. However, I want to add a tooltip +so that I can see more information about each country. The =tooltip_data= code +below will show a popup on hover with all the data fields shown. #+begin_src python # Adding labels to map @@ -210,8 +205,8 @@ folium.LayerControl().add_to(world_map) world_map #+end_src -The final image below will show you what the tooltip looks like whenever -you hover over a country. +The final image below will show you what the tooltip looks like whenever you +hover over a country. #+caption: Choropleth Map Tooltip [[https://img.cleberg.net/blog/20200925-world-choropleth-map/tooltip_map.png]] diff --git a/content/blog/2020-12-28-neon-drive.org b/content/blog/2020-12-28-neon-drive.org index 957bd33..9160b7f 100644 --- a/content/blog/2020-12-28-neon-drive.org +++ b/content/blog/2020-12-28-neon-drive.org @@ -4,51 +4,44 @@ #+filetags: :gaming: * Game Description -[[https://store.steampowered.com/app/433910/Neon_Drive/][Neon Drive]] -presents itself as a simple arcade-style game inspired by the arcade -race games of the 1980s, yet it has managed to take up hours of my life -without much effort. The game description, directly from the Steam page, -is intriguing enough to entice anyone who's been looking for a good -arcade racing game: +[[https://store.steampowered.com/app/433910/Neon_Drive/][Neon Drive]] presents itself as a simple arcade-style game inspired by the arcade +race games of the 1980s, yet it has managed to take up hours of my life without +much effort. The game description, directly from the Steam page, is intriguing +enough to entice anyone who's been looking for a good arcade racing game: #+begin_quote -Neon Drive is a slick retro-futuristic arcade game that will make your -brain melt. You've been warned. From beautiful cityscapes and ocean -roads to exploding enemy spaceships, Neon Drive has it all. - +Neon Drive is a slick retro-futuristic arcade game that will make your brain +melt. You've been warned. From beautiful cityscapes and ocean roads to exploding +enemy spaceships, Neon Drive has it all. #+end_quote * Gameplay -The game holds true to the -[[https://en.wikipedia.org/wiki/Retrofuturism][retro-futurism]] style, -including chrome female robots, pixelated arcade machines, and -[[https://teddit.net/r/outrun/][outrun]] aesthetics. - -Each level of the game is shown as a separate arcade machine. Each -arcade machine lets you play on Normal, Hard, Insane, Practice, and Free -Run. To beat each arcade, you must reach the end of the level without -crashing your car into the various obstacles on the course. Basic levels -let you move left or right to avoid blocks in the road. Later levels put -you through other tests, such as dodging traffic or blasting asteroids. - -The game uses synthwave music to keep you on track to make the correct -moves by timing the beats of the songs to the correct moves on the -screen. It reminds me of the early Guitar Hero games, as well as mobile -apps like VOEZ - repetition and staying on-beat is the only way to win. +The game holds true to the [[https://en.wikipedia.org/wiki/Retrofuturism][retro-futurism]] style, including chrome female robots, +pixelated arcade machines, and [[https://teddit.net/r/outrun/][outrun]] aesthetics. + +Each level of the game is shown as a separate arcade machine. Each arcade +machine lets you play on Normal, Hard, Insane, Practice, and Free Run. To beat +each arcade, you must reach the end of the level without crashing your car into +the various obstacles on the course. Basic levels let you move left or right to +avoid blocks in the road. Later levels put you through other tests, such as +dodging traffic or blasting asteroids. + +The game uses synthwave music to keep you on track to make the correct moves by +timing the beats of the songs to the correct moves on the screen. It reminds me +of the early Guitar Hero games, as well as mobile apps like VOEZ - repetition +and staying on-beat is the only way to win. * In-Game Screenshots -Taking a look at the main menu, you can see that Neon Drive plays into -every stereotype you can think of around retro-futuristic, synthwave -arcades (in a good way). +Taking a look at the main menu, you can see that Neon Drive plays into every +stereotype you can think of around retro-futuristic, synthwave arcades (in a +good way). #+caption: Neon Drive Menu [[https://img.cleberg.net/blog/20201228-neon-drive/neon_drive_menu.png]] -Once you get into the first level, we see that the choice of car fits -right in with the stereotypical cars of the 80s, like the -[[https://en.wikipedia.org/wiki/DMC_DeLorean][DeLorean]] or the -[[https://en.wikipedia.org/wiki/Ferrari_F40][Ferrari F40]]. Each new -level comes with new color schemes and cars, so you should never get +Once you get into the first level, we see that the choice of car fits right in +with the stereotypical cars of the 80s, like the [[https://en.wikipedia.org/wiki/DMC_DeLorean][DeLorean]] or the [[https://en.wikipedia.org/wiki/Ferrari_F40][Ferrari F40]]. +Each new level comes with new color schemes and cars, so you should never get tired of the aesthetic. #+caption: Neon Drive Race @@ -59,25 +52,24 @@ Personally, I love the orange and blue colors used in level 2: #+caption: Level 2 [[https://img.cleberg.net/blog/20201228-neon-drive/neon_drive_level_2.png]] -If you're the competitive type and getting 100% on all arcade machines -isn't enough, there are leaderboards for the regular part of the game, -and the endurance game mode. +If you're the competitive type and getting 100% on all arcade machines isn't +enough, there are leaderboards for the regular part of the game, and the +endurance game mode. #+caption: Leaderboard [[https://img.cleberg.net/blog/20201228-neon-drive/neon_drive_leaderboard.png]] * Other Suggestions -Neon Drive sits nicely within the well-founded cult genre of Outrun. -Other games that I've enjoyed in this same spectrum are: +Neon Drive sits nicely within the well-founded cult genre of Outrun. Other games +that I've enjoyed in this same spectrum are: - [[https://store.steampowered.com/app/233270/Far_Cry_3__Blood_Dragon/][Far Cry 3: Blood Dragon]] - [[https://store.steampowered.com/app/1239690/Retrowave/][Retrowave]] - [[https://store.steampowered.com/app/732810/Slipstream/][Slipstream]] -Although these games aren't necessarily in the same genre, they do have -aspects that place them close enough to interest gamers that enjoyed -Neon Drive: +Although these games aren't necessarily in the same genre, they do have aspects +that place them close enough to interest gamers that enjoyed Neon Drive: - [[https://store.steampowered.com/app/311800/Black_Ice/][Black Ice]] - [[https://store.steampowered.com/app/746850/Cloudpunk/][Cloudpunk]] @@ -85,9 +77,7 @@ Neon Drive: for Speed: Heat]] - [[https://store.steampowered.com/app/1019310/VirtuaVerse/][VirtuaVerse]] -Of course, if all you really care about is the arcade aspect of these -games, you can check out the -[[https://store.steampowered.com/app/400020/Atari_Vault/][Atari Vault]] -or any of the other classic games sold on Steam by companies like Namco, -Atari. For something like Nintendo, you'd have to settle for buying used -classic consoles or delve into the world of emulation. +Of course, if all you really care about is the arcade aspect of these games, you +can check out the [[https://store.steampowered.com/app/400020/Atari_Vault/][Atari Vault]] or any of the other classic games sold on Steam by +companies like Namco, Atari. For something like Nintendo, you'd have to settle +for buying used classic consoles or delve into the world of emulation. diff --git a/content/blog/2020-12-29-zork.org b/content/blog/2020-12-29-zork.org index 92f5169..5225517 100644 --- a/content/blog/2020-12-29-zork.org +++ b/content/blog/2020-12-29-zork.org @@ -4,33 +4,28 @@ #+filetags: :gaming: * Download (Free) -Before we get into the game itself, you should know that you can -download Zork for free from Infocom's -[[http://infocom-if.org/downloads/downloads.html][download page]]. So -feel free to boot it up and take a ride back to the 1980s with this -masterpiece. +Before we get into the game itself, you should know that you can download Zork +for free from Infocom's [[http://infocom-if.org/downloads/downloads.html][download page]]. So feel free to boot it up and take a +ride back to the 1980s with this masterpiece. * Game Description -Zork is an interactive, text-based computer game originally released -in 1980. This series, split into three separate games, introduced a -robust and sophisticated text parser to gamers. People were largely used -to the simple commands used in the popular game -[[https://en.wikipedia.org/wiki/Colossal_Cave_Adventure][Colossal Cave -Adventure]], but Zork allowed users to send more complex commands that -included prepositions and conjunctions. +Zork is an interactive, text-based computer game originally released in 1980. +This series, split into three separate games, introduced a robust and +sophisticated text parser to gamers. People were largely used to the simple +commands used in the popular game [[https://en.wikipedia.org/wiki/Colossal_Cave_Adventure][Colossal Cave Adventure]], but Zork allowed +users to send more complex commands that included prepositions and conjunctions. -Zork tracks your score as you explore the map, find tools, and collect -trophy items (e.g., a jewel-encrusted egg). When you place your trophy -items in the trophy case found in the Living Room area, you gain score -points. Collecting the Twenty Treasures of Zork and placing them within -the trophy case wins the game. However, you must explore the map, solve -puzzles, and avoid being eaten by a grue to collect these treasures. +Zork tracks your score as you explore the map, find tools, and collect trophy +items (e.g., a jewel-encrusted egg). When you place your trophy items in the +trophy case found in the Living Room area, you gain score points. Collecting the +Twenty Treasures of Zork and placing them within the trophy case wins the game. +However, you must explore the map, solve puzzles, and avoid being eaten by a +grue to collect these treasures. * The Map -Since Zork is a vast and complex game, it helps to have a map as you -explore and collect your trophies. However, if you want to play the game -as it was truly intended, you should try to play it without using the -map. +Since Zork is a vast and complex game, it helps to have a map as you explore and +collect your trophies. However, if you want to play the game as it was truly +intended, you should try to play it without using the map. #+caption: Zork Map [[https://img.cleberg.net/blog/20201229-zork/zork_map.png]] @@ -38,53 +33,45 @@ map. /[[https://www.filfre.net/2012/01/exploring-zork-part-1/][Map Source]]/ * In-Game Screenshots -After playing the game (for the first time ever) for several weeks -around 2014, I was finally able to beat the game with some online help -to find the last couple items. As I was writing this post, I installed -the game again to grab some screenshots to show off the true glory of -this game. As noted in -[[https://www.filfre.net/2012/01/exploring-zork-part-1/][Jimmy Maher's -playthrough]], the original Zork games looked quite a bit different due -to the older hardware of computers like the Apple II and multiple bug -fixes that Infocom pushed out after the game's initial release. My -play-through uses the -[[https://store.steampowered.com/app/570580/Zork_Anthology/][Zork -Anthology]] version, which utilizes DOSBox on Windows. +After playing the game (for the first time ever) for several weeks around 2014, +I was finally able to beat the game with some online help to find the last +couple items. As I was writing this post, I installed the game again to grab +some screenshots to show off the true glory of this game. As noted in [[https://www.filfre.net/2012/01/exploring-zork-part-1/][Jimmy +Maher's playthrough]], the original Zork games looked quite a bit different due to +the older hardware of computers like the Apple II and multiple bug fixes that +Infocom pushed out after the game's initial release. My play-through uses the +[[https://store.steampowered.com/app/570580/Zork_Anthology/][Zork Anthology]] version, which utilizes DOSBox on Windows. -The first screenshot here shows the introductory information, which -doesn't include instructions of any kind for the player. If you haven't -played text adventures before, try to use simple commands like "go -west," "look around," or "hit troll with elvish sword." +The first screenshot here shows the introductory information, which doesn't +include instructions of any kind for the player. If you haven't played text +adventures before, try to use simple commands like "go west," "look around," or +"hit troll with elvish sword." #+caption: Zork Screen, pt. 1 [[https://img.cleberg.net/blog/20201229-zork/zork_01.png]] -In this second screenshot, we see the player has entered the house and -found the trophy case in the living room. The lantern and sword in this -room allow the player to explore dark areas and attack enemies. If you -don't use the lantern, you won't be able to see anything in dark areas, -and you may be eaten by a grue. +In this second screenshot, we see the player has entered the house and found the +trophy case in the living room. The lantern and sword in this room allow the +player to explore dark areas and attack enemies. If you don't use the lantern, +you won't be able to see anything in dark areas, and you may be eaten by a grue. #+caption: Zork Screen, pt. 2 [[https://img.cleberg.net/blog/20201229-zork/zork_02.png]] -Finally, we see that the player has found the first treasure: a -jewel-encrusted egg. These treasures can be taken back to the house and -placed in the trophy case or carried until you feel like you want to put -things away. +Finally, we see that the player has found the first treasure: a jewel-encrusted +egg. These treasures can be taken back to the house and placed in the trophy +case or carried until you feel like you want to put things away. #+caption: Zork Screen, pt 3. [[https://img.cleberg.net/blog/20201229-zork/zork_03.png]] * Conclusion -It's been quite a few years since I first played Zork, but I clearly -remember the late nights and bloodshot eyes that helped me find all the -treasures. This game is well worth the time and effort, even though the -text-based aspect may be off-putting to gamers who didn't have to grow -up playing games without graphics. However, I believe that the strategy -and skills learned in early video games like Zork can actually help you, -even when playing newer games. +It's been quite a few years since I first played Zork, but I clearly remember +the late nights and bloodshot eyes that helped me find all the treasures. This +game is well worth the time and effort, even though the text-based aspect may be +off-putting to gamers who didn't have to grow up playing games without graphics. +However, I believe that the strategy and skills learned in early video games +like Zork can actually help you, even when playing newer games. If you do decide to play Zork, you can download Zork I, II, and III from -Infocom's [[http://infocom-if.org/downloads/downloads.html][download -page]] for free or search the internet for an online version. +Infocom's [[http://infocom-if.org/downloads/downloads.html][download page]] for free or search the internet for an online version. |