Commit `972b15ecc9`

972b15ecc9140bc41c0b80bcea7e71a4935cf4d3

parent: 7aef1980b5

Unsigned

cmc <hello@cleberg.net> · 2024-09-02 02:54 UTC

format 2018 to 2020 blog posts

Layout: unified · split

content/blog/2018-11-28-aes-encryption.org +79 −97

		@@ -5,121 +5,103 @@
5	5
6	6	* Basic AES
7	7
8		If you're not familiar with encryption techniques,
9		[[https://en.wikipedia.org/wiki/Advanced_Encryption_Standard][AES]] is
10		the Advanced Encryption Standard. This specification was established
11		by the National Institute of Standards and Technology, sub-selected from
12		the Rijndael family of ciphers (128, 192, and 256 bits) in 2001.
13		Furthering its popularity and status, the US government chose AES as
14		their default encryption method for top-secret data, removing the
15		previous standard which had been in place since 1977.
16
17		AES has proven to be an extremely safe encryption method, with 7-round
18		and 8-round attacks making no material improvements since the release of
19		this encryption standard almost two decades ago.
	8	If you're not familiar with encryption techniques, [[https://en.wikipedia.org/wiki/Advanced_Encryption_Standard][AES]] is the *Advanced
	9	Encryption Standard*. This specification was established by the National
	10	Institute of Standards and Technology, sub-selected from the Rijndael family of
	11	ciphers (128, 192, and 256 bits) in 2001. Furthering its popularity and status,
	12	the US government chose AES as their default encryption method for top-secret
	13	data, removing the previous standard which had been in place since 1977.
	14
	15	AES has proven to be an extremely safe encryption method, with 7-round and
	16	8-round attacks making no material improvements since the release of this
	17	encryption standard almost two decades ago.
20	18
21	19	#+begin_quote
22		Though many papers have been published on the cryptanalysis of AES, the
23		fastest single-key attacks on round-reduced AES variants [20, 33] so far
24		are only slightly more powerful than those proposed 10 years ago
25		[23,24].
	20	Though many papers have been published on the cryptanalysis of AES, the fastest
	21	single-key attacks on round-reduced AES variants [20, 33] so far are only
	22	slightly more powerful than those proposed 10 years ago [23,24].
26	23
27		- [[http://research.microsoft.com/en-us/projects/cryptanalysis/aesbc.pdf][Bogdonav,
28		et al.]]
	24	- [[http://research.microsoft.com/en-us/projects/cryptanalysis/aesbc.pdf][Bogdonav, et al.]]
29	25	#+end_quote
30	26
31	27	* How Secure is AES?
32	28
33		In theory, AES-256 is non-crackable due to the massive number of
34		combinations that can be produced. However, AES-128 is no longer
35		recommended as a viable implementation to protect important data.
36
37		A semi-short
38		[[http://www.moserware.com/2009/09/stick-figure-guide-to-advanced.html][comic
39		strip]] from Moserware quickly explains AES for the public to
40		understand. Basically AES encrypts the data by obscuring the
41		relationship between the data and the encrypted data. Additionally, this
42		method spreads the message out. Lastly, the key produced by AES is the
43		secret to decrypting it. Someone may know the method of AES, but without
44		the key, they are powerless.
45
46		To obscure and spread the data out, AES creates a
47		substitution-permutation network. Wikipedia has a wonderful
48		[[https://upload.wikimedia.org/wikipedia/commons/thumb/c/cd/SubstitutionPermutationNetwork2.png/468px-SubstitutionPermutationNetwork2.png][example
49		of an SP network]] available. This network sends the data through a set
50		of S boxes (using the unique key) to substitute the bits with another
51		block of bits. Then, a P box will permutate, or rearrange, the bits.
52		This is done over and over, with the key being derived from the last
53		round. For AES, the key size specifies the number of transformation
	29	In theory, AES-256 is non-crackable due to the massive number of combinations
	30	that can be produced. However, AES-128 is no longer recommended as a viable
	31	implementation to protect important data.
	32
	33	A semi-short [[http://www.moserware.com/2009/09/stick-figure-guide-to-advanced.html][comic strip]] from Moserware quickly explains AES for the public to
	34	understand. Basically AES encrypts the data by obscuring the relationship
	35	between the data and the encrypted data. Additionally, this method spreads the
	36	message out. Lastly, the key produced by AES is the secret to decrypting it.
	37	Someone may know the method of AES, but without the key, they are powerless.
	38
	39	To obscure and spread the data out, AES creates a substitution-permutation
	40	network. Wikipedia has a wonderful [[https://upload.wikimedia.org/wikipedia/commons/thumb/c/cd/SubstitutionPermutationNetwork2.png/468px-SubstitutionPermutationNetwork2.png][example of an SP network]] available. This
	41	network sends the data through a set of S boxes (using the unique key) to
	42	substitute the bits with another block of bits. Then, a P box will permutate, or
	43	rearrange, the bits. This is done over and over, with the key being derived from
	44	the last round. For AES, the key size specifies the number of transformation
54	45	rounds: 10, 12, and 14 rounds for 128-bit, 192-bit, and 256-bit keys,
55	46	respectively.
56	47
57	48	* The Process
58	49
59		1. KeyExpansion: Using
60		[[https://en.m.wikipedia.org/wiki/Advanced_Encryption_Standard][Rijndael's
61		key schedule]], the keys are dynamically generated.
62		2. AddRoundKey: Each byte of the data is combined with this key using
63		bitwise xor.
64		3. SubBytes: This is followed by the substitution of each byte of
65		data.
66		4. ShiftRows: Then, the final three rows are shifted a certain number
67		of steps, dictated by the cipher.
68		5. MixColumns: After the rows have been shifted, the columns are mixed
69		and combined.
70
71		This process does not necessarily stop after one full round. Steps 2
72		through 5 will repeat for the number of rounds specified by the key.
73		However, the final round excludes the MixColumns step. As you can see,
74		this is a fairly complex process. One must have a solid understanding of
75		general mathematic principles to fully understand how the sequence works
76		(and to even attempt to find a weakness).
77
78		According to research done by Bogdanov et al., it would take billions of
79		years to brute force a 126-bit key with current hardware. Additionally,
80		this brute force attack would require storing 2^{88} bits of data!
81		However, there are a few different attacks that have been used to show
82		vulnerabilities with the use of this technology. Side-channel attacks
83		use inadvertent leaks of data from the hardware or software, which can
84		allow attackers to obtain the key or run programs on a user's hardware.
85
86		Please note that this is not something you should run out and try to
87		implement in your =Hello, World!= app after only a few hours of
88		research. While AES (basically all encryption methods) is extremely
89		efficient in what it does, it takes a lot of time and patience to
90		understand. If you're looking for something which currently implements
91		AES, check out the
92		[[https://www.bouncycastle.org/documentation.html][Legion of the Bouncy
93		Castle]] for Java implementations of cryptographic algorithms.
	50	1. KeyExpansion: Using [[https://en.m.wikipedia.org/wiki/Advanced_Encryption_Standard][Rijndael's key schedule]], the keys are dynamically
	51	generated.
	52	2. AddRoundKey: Each byte of the data is combined with this key using bitwise
	53	xor.
	54	3. SubBytes: This is followed by the substitution of each byte of data.
	55	4. ShiftRows: Then, the final three rows are shifted a certain number of
	56	steps, dictated by the cipher.
	57	5. MixColumns: After the rows have been shifted, the columns are mixed and
	58	combined.
	59
	60	This process does not necessarily stop after one full round. Steps 2 through 5
	61	will repeat for the number of rounds specified by the key. However, the final
	62	round excludes the MixColumns step. As you can see, this is a fairly complex
	63	process. One must have a solid understanding of general mathematic principles to
	64	fully understand how the sequence works (and to even attempt to find a
	65	weakness).
	66
	67	According to research done by Bogdanov et al., it would take billions of years
	68	to brute force a 126-bit key with current hardware. Additionally, this brute
	69	force attack would require storing 2^{88} bits of data! However, there are a few
	70	different attacks that have been used to show vulnerabilities with the use of
	71	this technology. Side-channel attacks use inadvertent leaks of data from the
	72	hardware or software, which can allow attackers to obtain the key or run
	73	programs on a user's hardware.
	74
	75	Please note that this is not something you should run out and try to implement
	76	in your =Hello, World!= app after only a few hours of research. While AES
	77	(basically all encryption methods) is extremely efficient in what it does, it
	78	takes a lot of time and patience to understand. If you're looking for something
	79	which currently implements AES, check out the [[https://www.bouncycastle.org/documentation.html][Legion of the Bouncy Castle]] for
	80	Java implementations of cryptographic algorithms.
94	81
95	82	* Why Does Encryption Matter?
96	83
97		There are limitless reasons to enable encryption at-rest or in-transit
98		for various aspects of your digital life. You can research specific
99		examples, such as
100		[[https://arstechnica.com/tech-policy/2018/12/australia-passes-new-law-to-thwart-strong-encryption/][Australia
101		passes new law to thwart strong encryption]]. However, I will simply
	84	There are limitless reasons to enable encryption at-rest or in-transit for
	85	various aspects of your digital life. You can research specific examples, such
	86	as [[https://arstechnica.com/tech-policy/2018/12/australia-passes-new-law-to-thwart-strong-encryption/][Australia passes new law to thwart strong encryption]]. However, I will simply
102	87	list a few basic reasons to always enable encryption, where feasible:
103	88
104		1. Privacy is a human right and is recognized as a national right in
105		some countries (e.g.,
106		[[https://www.law.cornell.edu/wex/fourth_amendment][US Fourth
107		Amendment]]).
108		2. "Why not?" Encryption rarely affects performance or speed, so there's
109		usually not a reason to avoid it in the first place.
110		3. Your digital identity and activity (texts, emails, phone calls,
111		online accounts, etc.) are extremely valuable and can result in
112		terrible consequences, such as identity theft, if leaked to other
113		parties. Encrypting this data prevents such leaks from ruining lives.
114		4. Wiping or factory-resetting does not actually wipe all data from the
115		storage device. There are methods to read data from the physical
116		disks/boards inside devices.
	89	1. Privacy is a human right and is recognized as a national right in some
	90	countries (e.g., [[https://www.law.cornell.edu/wex/fourth_amendment][US Fourth Amendment]]).
	91	2. "Why not?" Encryption rarely affects performance or speed, so there's usually
	92	not a reason to avoid it in the first place.
	93	3. Your digital identity and activity (texts, emails, phone calls, online
	94	accounts, etc.) are extremely valuable and can result in terrible
	95	consequences, such as identity theft, if leaked to other parties. Encrypting
	96	this data prevents such leaks from ruining lives.
	97	4. Wiping or factory-resetting does not actually wipe all data from the storage
	98	device. There are methods to read data from the physical disks/boards inside
	99	devices.
117	100	5. Corporations, governments, and other nefarious groups/individuals are
118		actively looking for ways to collect personal information about
119		anyone they can. If someone's data is unencrypted, that person may
120		become a target due to the ease of data collection.
	101	actively looking for ways to collect personal information about anyone they
	102	can. If someone's data is unencrypted, that person may become a target due to
	103	the ease of data collection.
121	104
122	105	Read More:
123	106
124		- [[http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf][Federal
125		Information Processing Standards Publication 197]]
	107	- [[http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf][Federal Information Processing Standards Publication 197]]

content/blog/2018-11-28-cpp-compiler.org +46 −53

		@@ -5,14 +5,13 @@
5	5
6	6	* A Brief Introduction
7	7
8		[[https://en.wikipedia.org/wiki/C%2B%2B][C++]] is a general-purpose
9		programming language with object-oriented, generic, and functional
10		features in addition to facilities for low-level memory manipulation.
	8	[[https://en.wikipedia.org/wiki/C%2B%2B][C++]] is a general-purpose programming language with object-oriented, generic, and
	9	functional features in addition to facilities for low-level memory manipulation.
11	10
12		The source code, shown in the snippet below, must be compiled before it
13		can be executed. There are many steps and intricacies to the compilation
14		process, and this post was a personal exercise to learn and remember as
15		much information as I can.
	11	The source code, shown in the snippet below, must be compiled before it can be
	12	executed. There are many steps and intricacies to the compilation process, and
	13	this post was a personal exercise to learn and remember as much information as I
	14	can.
16	15
17	16	#+begin_src cpp
18	17	#include <iostream>
		@@ -27,24 +26,19 @@ int main()
27	26
28	27	*** An Overview
29	28
30		Compiling C++ projects is a frustrating task most days. Seemingly
31		nonexistent errors keeping your program from successfully compiling can
32		be annoying (especially since you know you wrote it perfectly the first
33		time, right?).
34
35		I'm learning more and more about C++ these days and decided to write
36		this concept down so that I can cement it even further in my own head.
37		However, C++ is not the only compiled language. Check out
38		[[https://en.wikipedia.org/wiki/Compiled_language][the Wikipedia entry
39		for compiled languages]] for more examples of compiled languages.
40
41		I'll start with a wonderful, graphical way to conceptualize the C++
42		compiler. View
43		[[https://web.archive.org/web/20190419035048/http://faculty.cs.niu.edu/~mcmahon/CS241/Notes/compile.html][The
44		C++ Compilation Process]] by Kurt MacMahon, an NIU professor, to see the
45		graphic and an explanation. The goal of the compilation process is to
46		take the C++ code and produce a shared library, dynamic library, or an
47		executable file.
	29	Compiling C++ projects is a frustrating task most days. Seemingly nonexistent
	30	errors keeping your program from successfully compiling can be annoying
	31	(especially since you know you wrote it perfectly the first time, right?).
	32
	33	I'm learning more and more about C++ these days and decided to write this
	34	concept down so that I can cement it even further in my own head. However, C++
	35	is not the only compiled language. Check out [[https://en.wikipedia.org/wiki/Compiled_language][the Wikipedia entry for compiled
	36	languages]] for more examples of compiled languages.
	37
	38	I'll start with a wonderful, graphical way to conceptualize the C++ compiler.
	39	View [[https://web.archive.org/web/20190419035048/http://faculty.cs.niu.edu/~mcmahon/CS241/Notes/compile.html][The C++ Compilation Process]] by Kurt MacMahon, an NIU professor, to see the
	40	graphic and an explanation. The goal of the compilation process is to take the
	41	C++ code and produce a shared library, dynamic library, or an executable file.
48	42
49	43	** Compilation Phases
50	44
		@@ -53,28 +47,27 @@ compiling C++ code.
53	47
54	48	*** Step 1
55	49
56		The first step is to expand the source code file to meet all
57		dependencies. The C++ preprocessor includes the code from all the header
58		files, such as =#include <iostream>=. Now, what does that mean? The
59		previous example includes the =iostream= header. This tells the computer
60		that you want to use the =iostream= standard library, which contains
61		classes and functions written in the core language. This specific header
62		allows you to manipulate input/output streams. After all this, you'll
63		end up which a temporary file that contains the expanded source code.
	50	The first step is to expand the source code file to meet all dependencies. The
	51	C++ preprocessor includes the code from all the header files, such as =#include
	52	<iostream>=. Now, what does that mean? The previous example includes the
	53	=iostream= header. This tells the computer that you want to use the =iostream=
	54	standard library, which contains classes and functions written in the core
	55	language. This specific header allows you to manipulate input/output streams.
	56	After all this, you'll end up which a temporary file that contains the expanded
	57	source code.
64	58
65		In the example of the C++ code above, the =iostream= class would be
66		included in the expanded code.
	59	In the example of the C++ code above, the =iostream= class would be included in
	60	the expanded code.
67	61
68	62	*** Step 2
69	63
70		After the code is expanded, the compiler comes into play. The compiler
71		takes the C++ code and converts this code into the assembly language,
72		understood by the platform. You can see this in action if you head over
73		to the [[https://godbolt.org][GodBolt Compiler Explorer]], which shows
74		C++ being converted into assembly dynamically.
	64	After the code is expanded, the compiler comes into play. The compiler takes the
	65	C++ code and converts this code into the assembly language, understood by the
	66	platform. You can see this in action if you head over to the [[https://godbolt.org][GodBolt Compiler
	67	Explorer]], which shows C++ being converted into assembly dynamically.
75	68
76		For example, the =Hello, world!= code snippet above compiles into the
77		following assembly code:
	69	For example, the =Hello, world!= code snippet above compiles into the following
	70	assembly code:
78	71
79	72	#+begin_src asm
80	73	.LC0:
		@@ -120,17 +113,17 @@ _GLOBAL__sub_I_main:
120	113
121	114	*** Step 3
122	115
123		Third, the assembly code generated by the compiler is assembled into the
124		object code for the platform. Essentially, this is when the compiler
125		takes the assembly code and assembles it into machine code in a binary
126		format. After researching this online, I figured out that a lot of
127		compilers will allow you to stop compilation at this step. This would be
128		useful for compiling each source code file separately. This saves time
129		later if a single file changes; only that file needs to be recompiled.
	116	Third, the assembly code generated by the compiler is assembled into the object
	117	code for the platform. Essentially, this is when the compiler takes the assembly
	118	code and assembles it into machine code in a binary format. After researching
	119	this online, I figured out that a lot of compilers will allow you to stop
	120	compilation at this step. This would be useful for compiling each source code
	121	file separately. This saves time later if a single file changes; only that file
	122	needs to be recompiled.
130	123
131	124	*** Step 4
132	125
133		Finally, the object code file generated by the assembler is linked
134		together with the object code files for any library functions used to
135		produce a shared library, dynamic library, or an executable file. It
136		replaces all references to undefined symbols with the correct addresses.
	126	Finally, the object code file generated by the assembler is linked together with
	127	the object code files for any library functions used to produce a shared
	128	library, dynamic library, or an executable file. It replaces all references to
	129	undefined symbols with the correct addresses.

content/blog/2019-01-07-useful-css.org +50 −61

		@@ -5,35 +5,31 @@
5	5
6	6	* Introduction to CSS
7	7
8		[[https://en.wikipedia.org/wiki/CSS][CSS]], the language used to markup
9		HTML code and make it "pretty", is one of the most effective ways to
10		increase the attractiveness of a website. It can also lead to increased
11		user engagement, retention, and satisfaction. In fact, there are whole
12		career fields are dedicated to the improvement of user experiences,
	8	[[https://en.wikipedia.org/wiki/CSS][CSS]], the language used to markup HTML code and make it "pretty", is one of the
	9	most effective ways to increase the attractiveness of a website. It can also
	10	lead to increased user engagement, retention, and satisfaction. In fact, there
	11	are whole career fields are dedicated to the improvement of user experiences,
13	12	known as UI design and UX design.
14	13
15		Some web developers are used to the common CSS properties, such as
16		element sizing, fonts, colors, etc., but are not as well versed in
17		less-used properties and values such as =flexbox=, =clip-path=, and
18		=transform=. This article will provide some insight into the less-used
19		and unique CSS properties.
	14	Some web developers are used to the common CSS properties, such as element
	15	sizing, fonts, colors, etc., but are not as well versed in less-used properties
	16	and values such as =flexbox=, =clip-path=, and =transform=. This article will
	17	provide some insight into the less-used and unique CSS properties.
20	18
21	19	* CSS Variables
22	20
23		The first topic today is CSS variables. Variables are not often used by
24		smaller developers. CSS variables allow you to give your website a
25		well-defined structure, where you can easily reuse CSS properties
26		throughout the project.
	21	The first topic today is CSS variables. Variables are not often used by smaller
	22	developers. CSS variables allow you to give your website a well-defined
	23	structure, where you can easily reuse CSS properties throughout the project.
27	24
28		You can use variables to define things, such as color palettes. Then,
29		you can use these colors for backgrounds anywhere else in the HTML. This
30		could be extended, where extra variables could be defined for
31		=primary-text=, =quoted-text=, etc. Variables can also be used to define
32		spacing (e.g. =32px= or =2rem=), which can then be applied to margins,
33		padding, font sizes, and more.
	25	You can use variables to define things, such as color palettes. Then, you can
	26	use these colors for backgrounds anywhere else in the HTML. This could be
	27	extended, where extra variables could be defined for =primary-text=,
	28	=quoted-text=, etc. Variables can also be used to define spacing (e.g. =32px= or
	29	=2rem=), which can then be applied to margins, padding, font sizes, and more.
34	30
35		For example, here are some variables defined at the root of the website,
36		which allows for any subsequent CSS rules to use those variables:
	31	For example, here are some variables defined at the root of the website, which
	32	allows for any subsequent CSS rules to use those variables:
37	33
38	34	#+begin_src css
39	35	:root {
		@@ -49,23 +45,21 @@ body {
49	45
50	46	* CSS Box Shadows
51	47
52		Box shadows were once my mortal enemy. No matter how hard I tried, I
53		just couldn't get them to work how I wanted. Because of this, my
54		favorite discovery has been CSSMatic's
55		[[https://www.cssmatic.com/box-shadow][box shadow generator]]. It
56		provides an excellent tool to generate box shadows using their simple
57		sliders. Surprisingly, this is the reason I learned how box shadows
58		work! You can use the sliders and watch how the CSS code changes in the
59		image that is displayed. Through this, you should understand that the
60		basic structure for box shadows is:
	48	Box shadows were once my mortal enemy. No matter how hard I tried, I just
	49	couldn't get them to work how I wanted. Because of this, my favorite discovery
	50	has been CSSMatic's [[https://www.cssmatic.com/box-shadow][box shadow generator]]. It provides an excellent tool to
	51	generate box shadows using their simple sliders. Surprisingly, this is the
	52	reason I learned how box shadows work! You can use the sliders and watch how the
	53	CSS code changes in the image that is displayed. Through this, you should
	54	understand that the basic structure for box shadows is:
61	55
62	56	#+begin_src css
63	57	box-shadow: inset horizontal vertical blur spread color;
64	58	#+end_src
65	59
66		Now, let's look at some basic examples! You can copy and paste the
67		following code into a site like CodePen or your own HTML files. Feel
68		free to play around with the code, experiment, and learn.
	60	Now, let's look at some basic examples! You can copy and paste the following
	61	code into a site like CodePen or your own HTML files. Feel free to play around
	62	with the code, experiment, and learn.
69	63
70	64	Box Shadow #1
71	65
		@@ -121,22 +115,20 @@ free to play around with the code, experiment, and learn.
121	115	}
122	116	#+end_src
123	117
124		Try these box shadows out on your own and see how changing each shadow
125		value works.
	118	Try these box shadows out on your own and see how changing each shadow value
	119	works.
126	120
127	121	* CSS Flexbox
128	122
129		Now, let's move on to the best part of this article: flexbox. The
130		flexbox is by far my favorite new toy. I originally stumbled across this
131		solution after looking for more efficient ways of centering content
132		horizontally AND vertically. I had used a few hack-ish methods before,
133		but flexbox throws those out the window. The best part of it all is that
134		flexbox is /dead simple/.
	123	Now, let's move on to the best part of this article: flexbox. The flexbox is by
	124	far my favorite new toy. I originally stumbled across this solution after
	125	looking for more efficient ways of centering content horizontally AND
	126	vertically. I had used a few hack-ish methods before, but flexbox throws those
	127	out the window. The best part of it all is that flexbox is /dead simple/.
135	128
136		Flexbox pertains to the parent div of any element. You want the parent
137		to be the flexbox in which items are arranged to use the flex methods.
138		It's easier to see this in action that explained, so let's see an
139		example.
	129	Flexbox pertains to the parent div of any element. You want the parent to be the
	130	flexbox in which items are arranged to use the flex methods. It's easier to see
	131	this in action that explained, so let's see an example.
140	132
141	133	Flexbox
142	134
		@@ -171,24 +163,21 @@ example.
171	163	}
172	164	#+end_src
173	165
174		You may notice that we no longer need to use the =top= property for the
175		=h3= elements in our code. This is because we set the display box to be
176		a flex container for the small boxes, AND we made the small boxes flex
177		containers for their elements (the h3 tags). Flex boxes can be nested
178		like this to center content that is inside centered content.
	166	You may notice that we no longer need to use the =top= property for the =h3=
	167	elements in our code. This is because we set the display box to be a flex
	168	container for the small boxes, AND we made the small boxes flex containers for
	169	their elements (the h3 tags). Flex boxes can be nested like this to center
	170	content that is inside centered content.
179	171
180		For the example above, we designated the =justify-content= property to
181		be =flex-start= so that the boxes stack from the left side of the
182		screen. This property can be changed to =center= to make the boxes
183		appear in the center of the screen.
	172	For the example above, we designated the =justify-content= property to be
	173	=flex-start= so that the boxes stack from the left side of the screen. This
	174	property can be changed to =center= to make the boxes appear in the center of
	175	the screen.
184	176
185		For an interactive example,
186		[[https://codepen.io/LandonSchropp/pen/KpzzGo][check out this CodePen]]
187		from [[https://codepen.io/LandonSchropp/][LandonScropp]]. Resize the
	177	For an interactive example, [[https://codepen.io/LandonSchropp/pen/KpzzGo][check out this CodePen]] from [[https://codepen.io/LandonSchropp/][LandonScropp]]. Resize the
188	178	window with dice to see how they collapse and re-align.
189	179
190	180	* Even More CSS
191	181
192		For more inspiration, you can visit [[https://www.codepen.io][CodePen]],
193		[[https://dribbble.com][Dribbble]], or [[https://uimovement.com][UI
194		Movement]] to browse the collections of many amazing web designers.
	182	For more inspiration, you can visit [[https://www.codepen.io][CodePen]], [[https://dribbble.com][Dribbble]], or [[https://uimovement.com][UI Movement]] to browse
	183	the collections of many amazing web designers.

content/blog/2019-09-09-audit-analytics.org +142 −160

		@@ -5,107 +5,99 @@
5	5
6	6	* What Are Data Analytics?
7	7
8		A quick aside before I dive into this post: =data analytics= is a vague
9		term that has become popular in recent years. Think of a =data analytic=
10		as the output of any data analysis you perform. For example, a pivot
11		table or a pie chart could be a data analytic.
12
13		[[https://en.wikipedia.org/wiki/Data_analysis][Data analysis]] is a
14		process that utilizes statistics and other mathematical methods to
15		discover useful information within datasets. This involves examining,
16		cleaning, transforming, and modeling data so that you can use the data
17		to support an opinion, create more useful viewpoints, and gain knowledge
18		to implement into audit planning or risk assessments.
19
20		One of the common mistakes that managers (and anyone new to the process)
21		make is assuming that everything involved with this process is "data
22		analytics". In fact, data analytics are only a small part of the
23		process.
24
25		See Figure 1 for a more accurate representation of where data analysis
26		sits within the full process. This means that data analysis does not
27		include querying or extracting data, selecting samples, or performing
28		audit tests. These steps can be necessary for an audit (and may even be
29		performed by the same associates), but they are not data analytics.
	8	A quick aside before I dive into this post: =data analytics= is a vague term
	9	that has become popular in recent years. Think of a =data analytic= as the
	10	output of any data analysis you perform. For example, a pivot table or a pie
	11	chart could be a data analytic.
	12
	13	[[https://en.wikipedia.org/wiki/Data_analysis][Data analysis]] is a process that utilizes statistics and other mathematical
	14	methods to discover useful information within datasets. This involves examining,
	15	cleaning, transforming, and modeling data so that you can use the data to
	16	support an opinion, create more useful viewpoints, and gain knowledge to
	17	implement into audit planning or risk assessments.
	18
	19	One of the common mistakes that managers (and anyone new to the process) make is
	20	assuming that everything involved with this process is "data analytics". In
	21	fact, data analytics are only a small part of the process.
	22
	23	See Figure 1 for a more accurate representation of where data analysis sits
	24	within the full process. This means that data analysis does not include querying
	25	or extracting data, selecting samples, or performing audit tests. These steps
	26	can be necessary for an audit (and may even be performed by the same
	27	associates), but they are not data analytics.
30	28
31	29	* Current Use of Analytics in Auditing
32	30
33		While data analysis has been an integral part of most businesses and
34		departments for the better part of the last century, only recently have
35		internal audit functions been adopting this practice. The internal audit
36		function works exclusively to provide assurance and consulting services
37		to the business areas within the firm (except for internal auditing
38		firms who are hired by different companies to perform their roles).
	31	While data analysis has been an integral part of most businesses and departments
	32	for the better part of the last century, only recently have internal audit
	33	functions been adopting this practice. The internal audit function works
	34	exclusively to provide assurance and consulting services to the business areas
	35	within the firm (except for internal auditing firms who are hired by different
	36	companies to perform their roles).
39	37
40	38	#+begin_quote
41		Internal Auditing helps an organization accomplish its objectives by
42		bringing a systematic, disciplined approach to evaluate and improve the
43		effectiveness of risk management, control and governance processes.
	39	Internal Auditing helps an organization accomplish its objectives by bringing a
	40	systematic, disciplined approach to evaluate and improve the effectiveness of
	41	risk management, control and governance processes.
44	42
45	43	- The IIA's Definition of Internal Audit
46	44	#+end_quote
47	45
48		Part of the blame for the slow adoption of data analysis can be
49		attributed to the fact that internal auditing is strongly based on
50		tradition and following the precedents set by previous auditors.
51		However, there can be no progress without auditors who are willing to
52		break the mold and test new audit techniques. In fact, as of 2018,
53		[[https://www.cpapracticeadvisor.com/accounting-audit/news/12404086/internal-audit-groups-are-lagging-in-data-analytics][only
54		63% of internal audit departments currently utilize data analytics]] in
55		North America. This number should be as close as possible to 100%. I
56		have never been part of an audit that would not have benefited from data
	46	Part of the blame for the slow adoption of data analysis can be attributed to
	47	the fact that internal auditing is strongly based on tradition and following the
	48	precedents set by previous auditors. However, there can be no progress without
	49	auditors who are willing to break the mold and test new audit techniques. In
	50	fact, as of 2018, [[https://www.cpapracticeadvisor.com/accounting-audit/news/12404086/internal-audit-groups-are-lagging-in-data-analytics][only 63% of internal audit departments currently utilize data
	51	analytics]] in North America. This number should be as close as possible to 100%.
	52	I have never been part of an audit that would not have benefited from data
57	53	analytics.
58	54
59		So, how do internal audit functions remedy this situation? It's
60		definitely not as easy as walking into work on Monday and telling your
61		Chief Audit Executive that you're going to start implementing analytics
62		in the next audit. You need a plan and a system to make the analysis
63		process as effective as possible.
	55	So, how do internal audit functions remedy this situation? It's definitely not
	56	as easy as walking into work on Monday and telling your Chief Audit Executive
	57	that you're going to start implementing analytics in the next audit. You need a
	58	plan and a system to make the analysis process as effective as possible.
64	59
65	60	* The DELTA Model
66	61
67	62	One of the easiest ways to experiment with data analytics and gain an
68		understanding of the processes is to implement them within your own
69		department. But how do we do this if we've never worked with analysis
70		before? One of the most common places to start is to research some data
71		analysis models currently available. For this post, we'll take a look at
72		the DELTA model. You can take a look at Figure 2 for a quick overview
73		of the model.
	63	understanding of the processes is to implement them within your own department.
	64	But how do we do this if we've never worked with analysis before? One of the
	65	most common places to start is to research some data analysis models currently
	66	available. For this post, we'll take a look at the DELTA model. You can take a
	67	look at Figure 2 for a quick overview of the model.
74	68
75		The DELTA model sets a few guidelines for areas wanting to implement
76		data analytics so that the results can be as comprehensive as possible:
	69	The DELTA model sets a few guidelines for areas wanting to implement data
	70	analytics so that the results can be as comprehensive as possible:
77	71
78	72	- Data: Must be clean, accessible, and (usually) unique.
79		- Enterprise-Wide Focus: Key data systems and analytical resources
80		must be available for use (by the Internal Audit Function).
81		- Leaders: Must promote a data analytics approach and show the value
82		of analytical results.
83		- Targets: Must be set for key areas and risks that the analytics can
84		be compared against (KPIs).
85		- Analysts: There must be auditors willing and able to perform data
86		analytics or else the system cannot be sustained.
	73	- Enterprise-Wide Focus: Key data systems and analytical resources must be
	74	available for use (by the Internal Audit Function).
	75	- Leaders: Must promote a data analytics approach and show the value of
	76	analytical results.
	77	- Targets: Must be set for key areas and risks that the analytics can be
	78	compared against (KPIs).
	79	- Analysts: There must be auditors willing and able to perform data analytics
	80	or else the system cannot be sustained.
87	81
88	82	* Finding the Proper KPIs
89	83
90		Once the Internal Audit Function has decided that they want to start
91		using data analytics internally and have ensured they're properly set up
92		to do so, they need to figure out what they will be testing against. Key
93		Performance Indicators (KPIs) are qualitative or quantitative factors
94		that can be evaluated and assessed to determine if the department is
95		performing well, usually compared to historical or industry benchmarks.
96		Once KPIs have been agreed upon and set, auditors can use data analytics
97		to assess and report on these KPIs. This allows the person performing
98		the analytics the freedom to express opinions on the results, whereas
99		the results are ambiguous if no KPIs exist.
100
101		It should be noted that tracking KPIs in the department can help ensure
102		you have a rigorous Quality Assurance and Improvement Program (QAIP) in
103		accordance with some applicable standards, such as IPPF Standard 1300.
	84	Once the Internal Audit Function has decided that they want to start using data
	85	analytics internally and have ensured they're properly set up to do so, they
	86	need to figure out what they will be testing against. Key Performance Indicators
	87	(KPIs) are qualitative or quantitative factors that can be evaluated and
	88	assessed to determine if the department is performing well, usually compared to
	89	historical or industry benchmarks. Once KPIs have been agreed upon and set,
	90	auditors can use data analytics to assess and report on these KPIs. This allows
	91	the person performing the analytics the freedom to express opinions on the
	92	results, whereas the results are ambiguous if no KPIs exist.
	93
	94	It should be noted that tracking KPIs in the department can help ensure you have
	95	a rigorous Quality Assurance and Improvement Program (QAIP) in accordance with
	96	some applicable standards, such as IPPF Standard 1300.
104	97
105	98	#+begin_quote
106		The chief audit executive must develop and maintain a quality assurance
107		and improvement program that covers all aspects of the internal audit
108		activity.
	99	The chief audit executive must develop and maintain a quality assurance and
	100	improvement program that covers all aspects of the internal audit activity.
109	101
110	102	- IPPF Standard 1300
111	103	#+end_quote
		@@ -113,38 +105,36 @@ activity.
113	105	Additionally, IPPF Standard 2060 discusses reporting:
114	106
115	107	#+begin_quote
116		The chief audit executive must report periodically to senior management
117		and the board on the internal audit activity's purpose, authority,
118		responsibility, and performance relative to its plan and on its
119		conformance with the Code of Ethics and the Standards. Reporting must
120		also include significant risk and control issues, including fraud risks,
121		governance issues, and other matters that require the attention of
122		senior management and/or the board.
	108	The chief audit executive must report periodically to senior management and the
	109	board on the internal audit activity's purpose, authority, responsibility, and
	110	performance relative to its plan and on its conformance with the Code of Ethics
	111	and the Standards. Reporting must also include significant risk and control
	112	issues, including fraud risks, governance issues, and other matters that require
	113	the attention of senior management and/or the board.
123	114
124	115	- IPPF Standard 2060
125	116	#+end_quote
126	117
127		The hardest part of finding KPIs is to determine which KPIs are
128		appropriate for your department. Since every department is different and
129		has different goals, KPIs will vary drastically between companies. To
130		give you an idea of where to look, here are some ideas I came up with
131		when discussing the topic with a few colleagues.
	118	The hardest part of finding KPIs is to determine which KPIs are appropriate for
	119	your department. Since every department is different and has different goals,
	120	KPIs will vary drastically between companies. To give you an idea of where to
	121	look, here are some ideas I came up with when discussing the topic with a few
	122	colleagues.
132	123
133	124	- Efficiency/Budgeting:
134		- Audit hours to staff utilization ratio (annual hours divided by
135		total annual work hours).
	125	- Audit hours to staff utilization ratio (annual hours divided by total annual
	126	work hours).
136	127	- Audit hours compared to the number of audits completed.
137		- Time between audit steps or to complete the whole audit. E.g., time
138		from fieldwork completion to audit report issuance.
	128	- Time between audit steps or to complete the whole audit. E.g., time from
	129	fieldwork completion to audit report issuance.
139	130	- Reputation:
140	131	- The frequency that management has requested the services of the IAF.
141		- Management, audit committee, or external audit satisfaction survey
142		results.
143		- Education, experience, certifications, tenure, and training of the
144		auditors on staff.
	132	- Management, audit committee, or external audit satisfaction survey results.
	133	- Education, experience, certifications, tenure, and training of the auditors
	134	on staff.
145	135	- Quality:
146		- Number and frequency of audit findings. Assign monetary or numerical
147		values, if possible.
	136	- Number and frequency of audit findings. Assign monetary or numerical values,
	137	if possible.
148	138	- Percentage of recommendations issued and implemented.
149	139	- Planning:
150	140	- Percentage or number of key risks audited per year or per audit.
		@@ -152,69 +142,61 @@ when discussing the topic with a few colleagues.
152	142
153	143	* Data Analysis Tools
154	144
155		Finally, to be able to analyze and report on the data analysis, auditors
156		need to evaluate the tools at their disposal. There are many options
157		available, but a few of the most common ones can easily get the job
158		done. For example, almost every auditor already has access to Microsoft
159		Excel. Excel is more powerful than most people give it credit for and
160		can accomplish a lot of basic statistics without much work. If you don't
161		know a lot about statistics but still want to see some of the more basic
162		results, Excel is a great option.
163
164		To perform more in-depth statistical analysis or to explore large
165		datasets that Excel cannot handle, auditors will need to explore other
166		options. The big three that have had a lot of success in recent years
167		are Python, R, and ACL. ACL can be used as either a graphical tool
168		(point and click) or as a scripting tool, where the auditor must write
169		the scripts manually. Python and the R-language are solely scripting
170		languages.
171
172		The general trend in the data analytics environment is that if the tool
173		allows you to do everything by clicking buttons or dragging elements,
174		you won't be able to fully utilize the analytics you need. The most
175		robust solutions are created by those who understand how to write the
176		scripts manually. It should be noted that as the utility of a tool
177		increases, it usually means that the learning curve for that tool will
178		also be higher. It will take auditors longer to learn how to utilize
179		Python, R, or ACL versus learning how to utilize Excel.
	145	Finally, to be able to analyze and report on the data analysis, auditors need to
	146	evaluate the tools at their disposal. There are many options available, but a
	147	few of the most common ones can easily get the job done. For example, almost
	148	every auditor already has access to Microsoft Excel. Excel is more powerful than
	149	most people give it credit for and can accomplish a lot of basic statistics
	150	without much work. If you don't know a lot about statistics but still want to
	151	see some of the more basic results, Excel is a great option.
	152
	153	To perform more in-depth statistical analysis or to explore large datasets that
	154	Excel cannot handle, auditors will need to explore other options. The big three
	155	that have had a lot of success in recent years are Python, R, and ACL. ACL can
	156	be used as either a graphical tool (point and click) or as a scripting tool,
	157	where the auditor must write the scripts manually. Python and the R-language are
	158	solely scripting languages.
	159
	160	The general trend in the data analytics environment is that if the tool allows
	161	you to do everything by clicking buttons or dragging elements, you won't be able
	162	to fully utilize the analytics you need. The most robust solutions are created
	163	by those who understand how to write the scripts manually. It should be noted
	164	that as the utility of a tool increases, it usually means that the learning
	165	curve for that tool will also be higher. It will take auditors longer to learn
	166	how to utilize Python, R, or ACL versus learning how to utilize Excel.
180	167
181	168	* Visualization
182	169
183		Once an auditor has finally found the right data, KPIs, and tools, they
184		must report these results so that actions can be taken. Performing
185		in-depth data analysis is only useful if the results are understood by
186		the audiences of the data. The best way to create this understanding is
187		to visualize the results of the data. Let's take a look at some of the
188		best options to visualize and report the results you've found.
189
190		Some of the most popular commercial tools for visualization are
191		Microsoft PowerBI and Tableau Desktop. However, other tools exist such
192		as JMP, Plotly, Qlikview, Alteryx, or D3. Some require commercial
193		licenses while others are simply free to use. For corporate data, you
194		may want to make sure that the tool does not communicate any of the data
195		outside the company (such as cloud storage). I won't be going into depth
196		on any of these tools since visualization is largely a subjective and
197		creative experience, but remember to constantly explore new options as
198		you repeat the process.
199
200		Lastly, let's take a look at an example of data visualization. This
201		example comes from a
202		[[https://talent.works/2018/03/28/the-science-of-the-job-search-part-iii-61-of-entry-level-jobs-require-3-years-of-experience/][blog
203		post written by Kushal Chakrabarti]] in 2018 about the percent of
204		entry-level US jobs that require experience. Figure 3 shows us an
205		easy-to-digest picture of the data. We can quickly tell that only about
206		12.5% of entry-level jobs don't require experience.
207
208		This is the kind of result that easily describes the data for you.
209		However, make sure to include an explanation of what the results mean.
210		Don't let the reader assume what the data means, especially if it
211		relates to a complex subject. /Tell a story/ about the data and why the
212		results matter.
	170	Once an auditor has finally found the right data, KPIs, and tools, they must
	171	report these results so that actions can be taken. Performing in-depth data
	172	analysis is only useful if the results are understood by the audiences of the
	173	data. The best way to create this understanding is to visualize the results of
	174	the data. Let's take a look at some of the best options to visualize and report
	175	the results you've found.
	176
	177	Some of the most popular commercial tools for visualization are Microsoft
	178	PowerBI and Tableau Desktop. However, other tools exist such as JMP, Plotly,
	179	Qlikview, Alteryx, or D3. Some require commercial licenses while others are
	180	simply free to use. For corporate data, you may want to make sure that the tool
	181	does not communicate any of the data outside the company (such as cloud
	182	storage). I won't be going into depth on any of these tools since visualization
	183	is largely a subjective and creative experience, but remember to constantly
	184	explore new options as you repeat the process.
	185
	186	Lastly, let's take a look at an example of data visualization. This example
	187	comes from a [[https://talent.works/2018/03/28/the-science-of-the-job-search-part-iii-61-of-entry-level-jobs-require-3-years-of-experience/][blog post written by Kushal Chakrabarti]] in 2018 about the percent
	188	of entry-level US jobs that require experience. Figure 3 shows us an
	189	easy-to-digest picture of the data. We can quickly tell that only about 12.5% of
	190	entry-level jobs don't require experience.
	191
	192	This is the kind of result that easily describes the data for you. However, make
	193	sure to include an explanation of what the results mean. Don't let the reader
	194	assume what the data means, especially if it relates to a complex subject. /Tell
	195	a story/ about the data and why the results matter.
213	196
214	197	* Wrap-Up
215	198
216		While this is not an all-encompassing program that you can just adopt
217		into your department, it should be enough to get anyone started on the
218		process of understanding and implementing data analytics. Always
219		remember to continue learning and exploring new options as your
220		processes grow and evolve.
	199	While this is not an all-encompassing program that you can just adopt into your
	200	department, it should be enough to get anyone started on the process of
	201	understanding and implementing data analytics. Always remember to continue
	202	learning and exploring new options as your processes grow and evolve.

content/blog/2019-12-03-the-ansoff-matrix.org +83 −95

		@@ -5,118 +5,106 @@
5	5
6	6	* Overview
7	7
8		As the world of business evolves, managers must approach business
9		planning and strategy with a contemporary mindset. According to Dess,
10		McNamara, Eisner, and Lee, managers must be willing to adapt to the
11		modern business environment by going beyond "'incremental management',
12		whereby they view their job as making a series of small, minor changes
13		to improve the efficiency of the firm's operations"(2019).
14
15		One reason that strategic management is crucial is because most
16		businesses that fail in the United States each year fail due to a lack
17		of strategic focus or direction(2019). The rate of failure for
18		businesses with poor strategies shows that strategic planning and
19		management are crucial to a business's strength and longevity, injecting
20		the critical factors of growth and direction into a company's business
21		plan.
22
23		One of the most significant strategic planning and management frameworks
24		that companies can use is the
25		[[https://en.wikipedia.org/wiki/Ansoff_matrix][Ansoff Matrix]]. While
26		this framework has unique purposes and use-cases, it can effectively
27		help an organization grow and compete. Specifically, the Ansoff matrix
28		is one of the most effective frameworks for companies who want to focus
29		on increasing sales revenue or profitability(2019).
30
31		This framework uses a two-by-two figure to show the four strategic
32		options for companies to use in this framework: market penetration,
33		market development, product development, and diversification (see
34		Figure 1). The x-axis of the matrix focuses on the firm's markets and
35		also determines if the firm is looking to enter new markets or innovate
36		in its current markets. The y-axis of the matrix focuses on the firm's
37		products and determines if the firm wants to pursue strategies around
38		their existing products or explore new products.
	8	As the world of business evolves, managers must approach business planning and
	9	strategy with a contemporary mindset. According to Dess, McNamara, Eisner, and
	10	Lee, managers must be willing to adapt to the modern business environment by
	11	going beyond "'incremental management', whereby they view their job as making a
	12	series of small, minor changes to improve the efficiency of the firm's
	13	operations"(2019).
	14
	15	One reason that strategic management is crucial is because most businesses that
	16	fail in the United States each year fail due to a lack of strategic focus or
	17	direction(2019). The rate of failure for businesses with poor strategies shows
	18	that strategic planning and management are crucial to a business's strength and
	19	longevity, injecting the critical factors of growth and direction into a
	20	company's business plan.
	21
	22	One of the most significant strategic planning and management frameworks that
	23	companies can use is the [[https://en.wikipedia.org/wiki/Ansoff_matrix][Ansoff Matrix]]. While this framework has unique purposes
	24	and use-cases, it can effectively help an organization grow and compete.
	25	Specifically, the Ansoff matrix is one of the most effective frameworks for
	26	companies who want to focus on increasing sales revenue or profitability(2019).
	27
	28	This framework uses a two-by-two figure to show the four strategic options for
	29	companies to use in this framework: market penetration, market development,
	30	product development, and diversification (see Figure 1). The x-axis of the
	31	matrix focuses on the firm's markets and also determines if the firm is looking
	32	to enter new markets or innovate in its current markets. The y-axis of the
	33	matrix focuses on the firm's products and determines if the firm wants to pursue
	34	strategies around their existing products or explore new products.
39	35
40	36	* Strategic Options
41	37
42	38	** Market Penetration
43	39
44		The most straightforward strategy in the Ansoff matrix is to focus on
45		existing products in existing markets, also known as market
46		penetration(2019). Companies such as Coca-Cola have used market
47		penetration successfully by investing a lot of money to get further
48		value out of their current markets. Coca-Cola does this by introducing
49		new features such as Christmas-themed bottles, personal names on the
50		bottles, and other marketing schemes.
	40	The most straightforward strategy in the Ansoff matrix is to focus on existing
	41	products in existing markets, also known as market penetration(2019). Companies
	42	such as Coca-Cola have used market penetration successfully by investing a lot
	43	of money to get further value out of their current markets. Coca-Cola does this
	44	by introducing new features such as Christmas-themed bottles, personal names on
	45	the bottles, and other marketing schemes.
51	46
52	47	** Market Development
53	48
54		Market development extends existing products into new markets in an
55		attempt to increase the number of buyers. One interesting way that
56		Coca-Cola used this strategy comes from the stigma that Diet Coke is a
57		woman's drink(2019). Coca-Cola introduced Coca-Cola Zero, which
58		contained the same nutritional content as Diet Coke, but was packaged in
59		a dark black can to appear more "manly"(2019).
	49	Market development extends existing products into new markets in an attempt to
	50	increase the number of buyers. One interesting way that Coca-Cola used this
	51	strategy comes from the stigma that Diet Coke is a woman's drink(2019).
	52	Coca-Cola introduced Coca-Cola Zero, which contained the same nutritional
	53	content as Diet Coke, but was packaged in a dark black can to appear more
	54	"manly"(2019).
60	55
61	56	** Product Development
62	57
63		Product development uses existing markets to introduce new products so
64		that the firm can better meet customer needs(2019). The extreme end of
65		diversification is home to companies such as Johnson & Johnson, a
66		healthcare company that has developed a business portfolio of more than
67		60,000 different products(2019). Johnson & Johnson's dedication to
68		continuous diversification has led them to a balance sheet rating of
69		"AAA", industry recognition for diversification, and increases in their
70		investor dividends for 57 consecutive years(2019).
	58	Product development uses existing markets to introduce new products so that the
	59	firm can better meet customer needs(2019). The extreme end of diversification is
	60	home to companies such as Johnson & Johnson, a healthcare company that has
	61	developed a business portfolio of more than 60,000 different products(2019).
	62	Johnson & Johnson's dedication to continuous diversification has led them to a
	63	balance sheet rating of "AAA", industry recognition for diversification, and
	64	increases in their investor dividends for 57 consecutive years(2019).
71	65
72	66	** Related Diversification
73	67
74		Diversification, the final strategy of the Ansoff Matrix, is more
75		difficult than the others since it involves exploring both new markets
76		and new products. Related diversification is a diversification strategy
77		that closely relates to the firm's core business. Coca-Cola's best
78		example of related diversification is its acquisition of Glaceau and
79		Vitamin Water, which expanded their drinking lines of business(2019).
	68	Diversification, the final strategy of the Ansoff Matrix, is more difficult than
	69	the others since it involves exploring both new markets and new products.
	70	Related diversification is a diversification strategy that closely relates to
	71	the firm's core business. Coca-Cola's best example of related diversification is
	72	its acquisition of Glaceau and Vitamin Water, which expanded their drinking
	73	lines of business(2019).
80	74
81	75	** Unrelated Diversification
82	76
83		Unrelated diversification is a diversification strategy that does not
84		really relate to the firm's core business but still diversifies their
85		business portfolio. A good example of this would be a coffee company who
86		has decided to enter the market for bicycle sales. The main purpose of
87		this strategy is to an extremely diverse company that will not go
88		bankrupt if one market goes through difficult times. However, this
89		requires a lot of independent skills and heavy investments since the
90		company most likely cannot easily transfer knowledge between the markets
91		they compete in.
	77	Unrelated diversification is a diversification strategy that does not really
	78	relate to the firm's core business but still diversifies their business
	79	portfolio. A good example of this would be a coffee company who has decided to
	80	enter the market for bicycle sales. The main purpose of this strategy is to an
	81	extremely diverse company that will not go bankrupt if one market goes through
	82	difficult times. However, this requires a lot of independent skills and heavy
	83	investments since the company most likely cannot easily transfer knowledge
	84	between the markets they compete in.
92	85
93	86	* Requirements for Success
94	87
95		To use the Ansoff Matrix framework, managers need to formulate corporate
96		goals and objectives. Without goals and direction, management frameworks
97		do not present much practical utility. Further, the Ansoff Matrix
98		requires the managers involved to make tactical decisions and create a
99		path for the company to take toward their goals. Lastly, both the Ansoff
100		Matrix needs to consider both internal and external perspectives
101		throughout the strategy formulation process.
102
103		One interesting probability is that companies will be using multiple
104		strategic planning and management frameworks at the same time. While
105		this may sound like it could crowd the management process, there are
106		numerous reasons to do so. For example, the Ansoff Matrix and the
107		Balanced Scorecard are relatively popular, and they cover entirely
108		different parts of a company's strategy. Using the results from the
109		Balanced Scorecard could inform a company of the potential product and
110		market demands, such as from customer or supplier survey results, to
111		help the company determine which Ansoff Matrix strategy to pursue.
112		However, a combined approach at this level would require mature
113		frameworks and focused managers who are able to strategize at a high
114		level.
115
116		Lastly, it should be noted that the author of the Ansoff matrix, Igor
117		Ansoff, often used the term
118		[[https://en.wikipedia.org/wiki/Analysis_paralysis][paralysis by
119		analysis]] to explain the mistake of companies who overuse analysis and
120		spend too much time planning. Companies need to understand the utility
121		of a strategic management framework while ensuring that the company is
122		poised to execute as efficiently as they have planned.
	88	To use the Ansoff Matrix framework, managers need to formulate corporate goals
	89	and objectives. Without goals and direction, management frameworks do not
	90	present much practical utility. Further, the Ansoff Matrix requires the managers
	91	involved to make tactical decisions and create a path for the company to take
	92	toward their goals. Lastly, both the Ansoff Matrix needs to consider both
	93	internal and external perspectives throughout the strategy formulation process.
	94
	95	One interesting probability is that companies will be using multiple strategic
	96	planning and management frameworks at the same time. While this may sound like
	97	it could crowd the management process, there are numerous reasons to do so. For
	98	example, the Ansoff Matrix and the Balanced Scorecard are relatively popular,
	99	and they cover entirely different parts of a company's strategy. Using the
	100	results from the Balanced Scorecard could inform a company of the potential
	101	product and market demands, such as from customer or supplier survey results, to
	102	help the company determine which Ansoff Matrix strategy to pursue. However, a
	103	combined approach at this level would require mature frameworks and focused
	104	managers who are able to strategize at a high level.
	105
	106	Lastly, it should be noted that the author of the Ansoff matrix, Igor Ansoff,
	107	often used the term [[https://en.wikipedia.org/wiki/Analysis_paralysis][paralysis by analysis]] to explain the mistake of companies
	108	who overuse analysis and spend too much time planning. Companies need to
	109	understand the utility of a strategic management framework while ensuring that
	110	the company is poised to execute as efficiently as they have planned.

content/blog/2019-12-16-password-security.org +74 −92

		@@ -7,121 +7,103 @@
7	7
8	8	** Why Does It Matter?
9	9
10		Information security, including passwords and identities, has become one
11		of the most important digital highlights of the last decade. With
12		[[https://www.usatoday.com/story/money/2018/12/28/data-breaches-2018-billions-hit-growing-number-cyberattacks/2413411002/][billions
13		of people affected by data breaches each year]], there's a greater need
14		to introduce strong information security systems. If you think you've
15		been part of a breach, or you want to check and see, you can use
16		[[https://haveibeenpwned.com/][Have I Been Pwned]] to see if your email
17		has been involved in any public breaches. Remember that there's a
18		possibility that a company experienced a breach and did not report it to
19		anyone.
	10	Information security, including passwords and identities, has become one of the
	11	most important digital highlights of the last decade. With [[https://www.usatoday.com/story/money/2018/12/28/data-breaches-2018-billions-hit-growing-number-cyberattacks/2413411002/][billions of people
	12	affected by data breaches each year]], there's a greater need to introduce strong
	13	information security systems. If you think you've been part of a breach, or you
	14	want to check and see, you can use [[https://haveibeenpwned.com/][Have I Been Pwned]] to see if your email has
	15	been involved in any public breaches. Remember that there's a possibility that a
	16	company experienced a breach and did not report it to anyone.
20	17
21	18	** How Do I Protect Myself?
22	19
23		The first place to start with any personal security check-up is to
24		gather a list of all the different websites, apps, or programs that
25		require you to have login credentials. Optionally, once you know where
26		your information is being stored, you can sort the list from the
27		most-important items such as banks or government logins to less
28		important items such as your favorite meme site. You will want to ensure
29		that your critical logins are secure before getting to the others.
	20	The first place to start with any personal security check-up is to gather a list
	21	of all the different websites, apps, or programs that require you to have login
	22	credentials. Optionally, once you know where your information is being stored,
	23	you can sort the list from the most-important items such as banks or government
	24	logins to less important items such as your favorite meme site. You will want to
	25	ensure that your critical logins are secure before getting to the others.
30	26
31	27	Once you think you have a good idea of all your different authentication
32		methods, I recommend using a password manager such as
33		[[https://bitwarden.com/][Bitwarden]]. Using a password manager allows
34		you to automatically save your logins, create randomized passwords, and
35		transfer passwords across devices. However, you'll need to memorize your
36		"vault password" that allows you to open the password manager. It's
37		important to make this something hard to guess since it would allow
38		anyone who has it to access every password you've stored in there.
39
40		Personally, I recommend using a
41		[[https://en.wikipedia.org/wiki/Passphrase][passphrase]] instead of a
42		[[https://en.wikipedia.org/wiki/Password][password]] for your vault
43		password. Instead of using a string of characters (whether random or
44		simple), use a phrase and add in symbols and a number. For example, your
45		vault password could be =Racing-Alphabet-Gourd-Parrot3=. Swap the
46		symbols out for whichever symbol you want, move the number around, and
47		fine-tune the passphrase until you are confident that you can remember
48		it whenever necessary.
49
50		Once you've stored your passwords, make sure you continually check up on
51		your account and make sure you aren't following bad password practices.
52		Krebs on Security has a great
53		[[https://krebsonsecurity.com/password-dos-and-donts/][blog post on
54		password recommendations]]. Any time that a data breach happens, make
55		sure you check to see if you were included, and if you need to reset any
56		account passwords.
	28	methods, I recommend using a password manager such as [[https://bitwarden.com/][Bitwarden]]. Using a
	29	password manager allows you to automatically save your logins, create randomized
	30	passwords, and transfer passwords across devices. However, you'll need to
	31	memorize your "vault password" that allows you to open the password manager.
	32	It's important to make this something hard to guess since it would allow anyone
	33	who has it to access every password you've stored in there.
	34
	35	Personally, I recommend using a [[https://en.wikipedia.org/wiki/Passphrase][passphrase]] instead of a [[https://en.wikipedia.org/wiki/Password][password]] for your vault
	36	password. Instead of using a string of characters (whether random or simple),
	37	use a phrase and add in symbols and a number. For example, your vault password
	38	could be =Racing-Alphabet-Gourd-Parrot3=. Swap the symbols out for whichever
	39	symbol you want, move the number around, and fine-tune the passphrase until you
	40	are confident that you can remember it whenever necessary.
	41
	42	Once you've stored your passwords, make sure you continually check up on your
	43	account and make sure you aren't following bad password practices. Krebs on
	44	Security has a great [[https://krebsonsecurity.com/password-dos-and-donts/][blog post on password recommendations]]. Any time that a data
	45	breach happens, make sure you check to see if you were included, and if you need
	46	to reset any account passwords.
57	47
58	48	* Developers
59	49
60	50	** What Are the Basic Requirements?
61	51
62		When developing any password-protected application, there are a few
63		basic rules that anyone should follow even if they do not follow any
64		official guidelines such as NIST. The foremost practice is to require
65		users to use passwords that are at least 8 characters and cannot easily
66		be guessed. This sounds extremely simple, but it requires quite a few
67		different strategies. First, the application should check the potential
68		passwords against a dictionary of insecure passwords such =password=,
69		=1234abc=, or =application_name=.
70
71		Next, the application should offer guidance on the strength of passwords
72		being entered during enrollment. Further, NIST officially recommends
73		not implementing any composition rules that make passwords hard to
74		remember (e.g. passwords with letters, numbers, and special characters)
75		and instead encouraging the use of long pass phrases which can include
76		spaces. It should be noted that to be able to keep spaces within
77		passwords, all unicode characters should be supported, and passwords
78		should not be truncated.
	52	When developing any password-protected application, there are a few basic rules
	53	that anyone should follow even if they do not follow any official guidelines
	54	such as NIST. The foremost practice is to require users to use passwords that
	55	are at least 8 characters and cannot easily be guessed. This sounds extremely
	56	simple, but it requires quite a few different strategies. First, the application
	57	should check the potential passwords against a dictionary of insecure passwords
	58	such =password=, =1234abc=, or =application_name=.
	59
	60	Next, the application should offer guidance on the strength of passwords being
	61	entered during enrollment. Further, NIST officially recommends not
	62	implementing any composition rules that make passwords hard to remember (e.g.
	63	passwords with letters, numbers, and special characters) and instead encouraging
	64	the use of long pass phrases which can include spaces. It should be noted that
	65	to be able to keep spaces within passwords, all unicode characters should be
	66	supported, and passwords should not be truncated.
79	67
80	68	** What Does NIST Recommend?
81	69
82		The National Institute of Standards and Technology
83		([[https://www.nist.gov][NIST]]) in the US Department of Commerce
84		regularly publishes information around information security and digital
85		identity guidelines. Recently, NIST published
86		[[https://pages.nist.gov/800-63-3/sp800-63b.html][Special Publication
	70	The National Institute of Standards and Technology ([[https://www.nist.gov][NIST]]) in the US Department
	71	of Commerce regularly publishes information around information security and
	72	digital identity guidelines. Recently, NIST published [[https://pages.nist.gov/800-63-3/sp800-63b.html][Special Publication
87	73	800-63b]]: Digital Identity Guidelines and Authentication and Lifecycle
88	74	Management.
89	75
90	76	#+begin_quote
91		A Memorized Secret authenticator - commonly referred to as a password
92		or, if numeric, a PIN - is a secret value intended to be chosen and
93		memorized by the user. Memorized secrets need to be of sufficient
94		complexity and secrecy that it would be impractical for an attacker to
95		guess or otherwise discover the correct secret value. A memorized secret
96		is something you know.
	77	A Memorized Secret authenticator - commonly referred to as a password or, if
	78	numeric, a PIN - is a secret value intended to be chosen and memorized by the
	79	user. Memorized secrets need to be of sufficient complexity and secrecy that it
	80	would be impractical for an attacker to guess or otherwise discover the correct
	81	secret value. A memorized secret is something you know.
97	82
98	83	- NIST Special Publication 800-63B
99	84	#+end_quote
100	85
101		NIST offers a lot of guidance on passwords, but I'm going to highlight
102		just a few of the important factors:
	86	NIST offers a lot of guidance on passwords, but I'm going to highlight just a
	87	few of the important factors:
103	88
104		- Require passwords to be a minimum of 8 characters (6 characters if
105		randomly generated and be generated using an approved random bit
106		generator).
107		- Compare potential passwords against a list that contains values known
108		to be commonly-used, expected, or compromised.
	89	- Require passwords to be a minimum of 8 characters (6 characters if randomly
	90	generated and be generated using an approved random bit generator).
	91	- Compare potential passwords against a list that contains values known to be
	92	commonly-used, expected, or compromised.
109	93	- Offer guidance on password strength, such as a strength meter.
110	94	- Implement a rate-limiting mechanism to limit the number of failed
111	95	authentication attempts for each user account.
112		- Do not require composition rules for passwords and do not require
113		passwords to be changed periodically (unless compromised).
114		- Allow pasting of user identification and passwords to facilitate the
115		use of password managers.
	96	- Do not require composition rules for passwords and do not require passwords to
	97	be changed periodically (unless compromised).
	98	- Allow pasting of user identification and passwords to facilitate the use of
	99	password managers.
116	100	- Allow users to view the password as it is being entered.
117		- Use secure forms of communication and storage, including salting and
118		hashing passwords using a one-way key derivation function.
119
120		NIST offers further guidance on other devices that require specific
121		security policies, querying for passwords, and more. All the information
122		discussed so far comes from
123		[[https://pages.nist.gov/800-63-3/sp800-63b.html][NIST SP800-63b]] but
124		NIST offers a lot of information on digital identities, enrollment,
125		identity proofing, authentication, lifecycle management, federation, and
126		assertions in the total [[https://pages.nist.gov/800-63-3/][NIST
127		SP800-63 Digital Identity Guidelines]].
	101	- Use secure forms of communication and storage, including salting and hashing
	102	passwords using a one-way key derivation function.
	103
	104	NIST offers further guidance on other devices that require specific security
	105	policies, querying for passwords, and more. All the information discussed so far
	106	comes from [[https://pages.nist.gov/800-63-3/sp800-63b.html][NIST SP800-63b]] but NIST offers a lot of information on digital
	107	identities, enrollment, identity proofing, authentication, lifecycle management,
	108	federation, and assertions in the total [[https://pages.nist.gov/800-63-3/][NIST SP800-63 Digital Identity
	109	Guidelines]].

content/blog/2020-01-25-linux-software.org +66 −87

		@@ -7,29 +7,27 @@
7	7
8	8	** Etcher
9	9
10		[[https://www.balena.io/etcher/][Etcher]] is a quick and easy way to
11		burn ISO images to CDs and USB devices. There are two different ways you
12		can install this program. First, you can navigate to the
13		[[https://www.balena.io/etcher/][official website]] and download the
14		AppImage file, which can run without installation.
	10	[[https://www.balena.io/etcher/][Etcher]] is a quick and easy way to burn ISO images to CDs and USB devices. There
	11	are two different ways you can install this program. First, you can navigate to
	12	the [[https://www.balena.io/etcher/][official website]] and download the AppImage file, which can run without
	13	installation.
15	14
16		However, AppImage files are not executable by default, so you'll either
17		need to right-click to open the properties of the file and click the
18		"Allow executing file as program" box in the Permissions tab or use the
19		following command:
	15	However, AppImage files are not executable by default, so you'll either need to
	16	right-click to open the properties of the file and click the "Allow executing
	17	file as program" box in the Permissions tab or use the following command:
20	18
21	19	#+begin_src sh
22	20	chmod u+x FILE_NAME
23	21	#+end_src
24	22
25		If you don't like AppImage files or just prefer repositories, you can
26		use the following commands to add the author's repository and install it
27		through the command-line only.
	23	If you don't like AppImage files or just prefer repositories, you can use the
	24	following commands to add the author's repository and install it through the
	25	command-line only.
28	26
29	27	First, you'll have to echo the repo and write it to a list file:
30	28
31	29	#+begin_src sh
32		echo "deb https://deb.etcher.io stable etcher" \| sudo tee /etc/apt/sources.list.d/balena-etcher.list
	30	echo "deb https://deb.etcher.iostable etcher" \| sudo tee /etc/apt/sources.list.d/balena-etcher.list
33	31	#+end_src
34	32
35	33	Next, add the application keys to Ubuntu's keyring:
		@@ -44,8 +42,7 @@ Finally, update the repositories and install the app.
44	42	sudo apt update && sudo apt install balena-etcher-electron
45	43	#+end_src
46	44
47		Using Arch, Manjaro, or another distro using the AUR? Use this command
48		instead:
	45	Using Arch, Manjaro, or another distro using the AUR? Use this command instead:
49	46
50	47	#+begin_src sh
51	48	sudo pacman -S etcher
		@@ -53,11 +50,9 @@ sudo pacman -S etcher
53	50
54	51	** Atom
55	52
56		[[https://atom.io][Atom]] is the self-proclaimed "hackable text editor
57		for the 21st century". This text editor is made by GitHub,
58		[[https://news.microsoft.com/2018/06/04/microsoft-to-acquire-github-for-7-5-billion/][now
59		owned by Microsoft]], and has some of the best add-ons available to
60		customize the layout and abilities of the app.
	53	[[https://atom.io][Atom]] is the self-proclaimed "hackable text editor for the 21st century". This
	54	text editor is made by GitHub, [[https://news.microsoft.com/2018/06/04/microsoft-to-acquire-github-for-7-5-billion/][now owned by Microsoft]], and has some of the best
	55	add-ons available to customize the layout and abilities of the app.
61	56
62	57	First, add the Atom repository to your sources.
63	58
		@@ -71,26 +66,23 @@ Next, update your package listings and install atom.
71	66	sudo apt update && sudo apt install atom
72	67	#+end_src
73	68
74		If you have issues updating your packages with the Atom repository,
75		you'll need to use the snap package described below instead of the
76		repository. To remove the repository we just added, use this command:
	69	If you have issues updating your packages with the Atom repository, you'll need
	70	to use the snap package described below instead of the repository. To remove the
	71	repository we just added, use this command:
77	72
78	73	#+begin_src sh
79	74	sudo add-apt-repository -r ppa:webupd8team/atom
80	75	#+end_src
81	76
82		You can also install Atom as a snap package, but it must be installed
83		with the =--classic= flag. A
84		[[https://language-bash.com/blog/how-to-snap-introducing-classic-confinement][full
85		explanation is available]] if you'd like to read more about why you need
86		the classic flag.
	77	You can also install Atom as a snap package, but it must be installed with the
	78	=--classic= flag. A [[https://language-bash.com/blog/how-to-snap-introducing-classic-confinement][full explanation is available]] if you'd like to read more
	79	about why you need the classic flag.
87	80
88	81	#+begin_src sh
89	82	snap install atom --classic
90	83	#+end_src
91	84
92		Using Arch, Manjaro, or another distro using the AUR? Use this command
93		instead:
	85	Using Arch, Manjaro, or another distro using the AUR? Use this command instead:
94	86
95	87	#+begin_src sh
96	88	sudo pacman -S atom
		@@ -98,28 +90,23 @@ sudo pacman -S atom
98	90
99	91	** Visual Studio Code
100	92
101		[[https://code.visualstudio.com][Visual Studio Code]] is yet another
102		fantastic choice for programming on Linux, especially if you need those
103		extra add-ons to spice up your late-night coding sessions. The theme
104		used in the screenshot is
105		[[https://marketplace.visualstudio.com/items?itemName=EliverLara.mars][Mars]]
106		by theme creator [[https://github.com/EliverLara][Eliver Lara]], who
107		makes a ton of great themes for VS Code, Atom, and various Linux desktop
	93	[[https://code.visualstudio.com][Visual Studio Code]] is yet another fantastic choice for programming on Linux,
	94	especially if you need those extra add-ons to spice up your late-night coding
	95	sessions. The theme used in the screenshot is [[https://marketplace.visualstudio.com/items?itemName=EliverLara.mars][Mars]] by theme creator [[https://github.com/EliverLara][Eliver Lara]],
	96	who makes a ton of great themes for VS Code, Atom, and various Linux desktop
108	97	environments.
109	98
110		To install VS Code, you'll need to download the =.deb= file from the
111		official website. Once you've downloaded the file, either double-click
112		it to install through the Software Center or run the following command:
	99	To install VS Code, you'll need to download the =.deb= file from the official
	100	website. Once you've downloaded the file, either double-click it to install
	101	through the Software Center or run the following command:
113	102
114	103	#+begin_src sh
115	104	sudo dpkg -i FILE_NAME.deb
116	105	#+end_src
117	106
118		You can also install VS Code as a snap package, but it must be installed
119		with the =--classic= flag. A
120		[[https://language-bash.com/blog/how-to-snap-introducing-classic-confinement][full
121		explanation is available]] if you'd like to read more about why you need
122		the classic flag.
	107	You can also install VS Code as a snap package, but it must be installed with
	108	the =--classic= flag. A [[https://language-bash.com/blog/how-to-snap-introducing-classic-confinement][full explanation is available]] if you'd like to read more
	109	about why you need the classic flag.
123	110
124	111	#+begin_src sh
125	112	snap install code --classic
		@@ -134,19 +121,18 @@ sudo pacman -S yay binutils make gcc pkg-config fakeroot yay -S visual-studio-co
134	121
135	122	** GNOME Tweaks
136	123
137		[[https://gitlab.gnome.org/GNOME/gnome-tweaks][Gnome Tweaks]] is the
138		ultimate tool to use if you want to customize your GNOME desktop
139		environment. This is how you can switch application themes (GTK), shell
140		themes, icons, fonts, and more. To install GNOME Tweaks on Ubuntu, you
141		just need to install the official package.
	124	[[https://gitlab.gnome.org/GNOME/gnome-tweaks][Gnome Tweaks]] is the ultimate tool to use if you want to customize your GNOME
	125	desktop environment. This is how you can switch application themes (GTK), shell
	126	themes, icons, fonts, and more. To install GNOME Tweaks on Ubuntu, you just need
	127	to install the official package.
142	128
143	129	#+begin_src sh
144	130	sudo apt install gnome-tweaks
145	131	#+end_src
146	132
147		If you've installed Manjaro or Arch with Gnome, you should have the
148		tweak tool pre-installed. If you're on Fedora, this tool is available as
149		an official package:
	133	If you've installed Manjaro or Arch with Gnome, you should have the tweak tool
	134	pre-installed. If you're on Fedora, this tool is available as an official
	135	package:
150	136
151	137	#+begin_src sh
152	138	sudo dnf install gnome-tweaks
		@@ -154,14 +140,12 @@ sudo dnf install gnome-tweaks
154	140
155	141	** Steam
156	142
157		[[https://steampowered.com][Steam]] is one of the most popular gaming
158		libraries for computers and is one of the main reasons that many people
159		have been able to switch to Linux in recent years, thanks to Steam
160		Proton, which makes it easier to play games not officially created for
161		Linux platforms.
	143	[[https://steampowered.com][Steam]] is one of the most popular gaming libraries for computers and is one of
	144	the main reasons that many people have been able to switch to Linux in recent
	145	years, thanks to Steam Proton, which makes it easier to play games not
	146	officially created for Linux platforms.
162	147
163		To install Steam on Ubuntu, you just need to install the official
164		package.
	148	To install Steam on Ubuntu, you just need to install the official package.
165	149
166	150	#+begin_src sh
167	151	sudo apt install steam-installer
		@@ -193,34 +177,32 @@ Finally, install the program:
193	177	sudo pacman -S steam
194	178	#+end_src
195	179
196		[[./2020-01-26-steam-on-ntfs-drives.html][Problem Launching Steam Games?
197		Click Here.]]
	180	[[./2020-01-26-steam-on-ntfs-drives.html][Problem Launching Steam Games? Click Here.]]
198	181
199	182	* Command-Line Packages
200	183
201	184	** neofetch
202	185
203		[[https://github.com/dylanaraps/neofetch][Neofetch]] is a customizable
204		tool used in the command-line to show system information. This is
205		exceptionally useful if you want to see your system's information
206		quickly without the clutter of some resource-heavy GUI apps.
	186	[[https://github.com/dylanaraps/neofetch][Neofetch]] is a customizable tool used in the command-line to show system
	187	information. This is exceptionally useful if you want to see your system's
	188	information quickly without the clutter of some resource-heavy GUI apps.
207	189
208		This is an official package if you're running Ubuntu 17.04 or later, so
209		simply use the following command:
	190	This is an official package if you're running Ubuntu 17.04 or later, so simply
	191	use the following command:
210	192
211	193	#+begin_src sh
212	194	sudo apt install neofetch
213	195	#+end_src
214	196
215		If you're running Ubuntu 16.10 or earlier, you'll have to use a series
216		of commands:
	197	If you're running Ubuntu 16.10 or earlier, you'll have to use a series of
	198	commands:
217	199
218	200	#+begin_src sh
219		sudo add-apt-repository ppa:dawidd0811/neofetch; sudo apt update; sudo apt install neofetch
	201	sudo add-apt-repository ppa:dawidd0811/neofetch; sudo apt update; sudo apt
	202	install neofetch
220	203	#+end_src
221	204
222		Using Arch, Manjaro, or another distro using the AUR? Use this command
223		instead:
	205	Using Arch, Manjaro, or another distro using the AUR? Use this command instead:
224	206
225	207	#+begin_src sh
226	208	sudo pacman -S neofetch
		@@ -228,31 +210,28 @@ sudo pacman -S neofetch
228	210
229	211	** yt-dlp
230	212
231		[[https://github.com/yt-dlp/yt-dlp][yt-dlp]] is an extremely handy
232		command-line tool that allows you to download video or audio files from
233		various websites, such as YouTube. There are a ton of different options
234		when running this package, so be sure to run =yt-dlp --help= first to
235		look through everything you can do (or give up and search for the best
	213	[[https://github.com/yt-dlp/yt-dlp][yt-dlp]] is an extremely handy command-line tool that allows you to download video
	214	or audio files from various websites, such as YouTube. There are a ton of
	215	different options when running this package, so be sure to run =yt-dlp --help=
	216	first to look through everything you can do (or give up and search for the best
236	217	config online).
237	218
238		While this shouldn't be a problem for most users, yt-dlp requires Python
239		2.6, 2.7, or 3.2+ to work correctly, so install Python if you don't have
240		it already. You can check to see if you have Python installed by
241		running:
	219	While this shouldn't be a problem for most users, yt-dlp requires Python 2.6,
	220	2.7, or 3.2+ to work correctly, so install Python if you don't have it already.
	221	You can check to see if you have Python installed by running:
242	222
243	223	#+begin_src sh
244	224	python -V
245	225	#+end_src
246	226
247		To get the youtube-dl package, simply curl the URL and output the
248		results.
	227	To get the youtube-dl package, simply curl the URL and output the results.
249	228
250	229	#+begin_src sh
251		sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
	230	sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o
	231	/usr/local/bin/yt-dlp
252	232	#+end_src
253	233
254		Finally, make the file executable so that it can be run from the
255		command-line.
	234	Finally, make the file executable so that it can be run from the command-line.
256	235
257	236	#+begin_src sh
258	237	sudo chmod a+rx /usr/local/bin/yt-dlp

content/blog/2020-01-26-steam-on-ntfs.org +28 −30

		@@ -5,28 +5,28 @@
5	5
6	6	* Auto-Mount Steam Drives
7	7
8		If you want to see how to install Steam on Linux, see my other post:
9		[[../linux-software/][Linux Software]].
	8	If you want to see how to install Steam on Linux, see my other post: [[../linux-software/][Linux
	9	Software]].
10	10
11		Are you having trouble launching games, even though they've installed
12		correctly? This may happen if you're storing your games on an
13		NTFS-formatted drive. This shouldn't be an issue if you're storing your
14		games on the same drive that Steam is on, but some gamers prefer to put
15		Steam on their main drive and game files on another SSD or HDD.
	11	Are you having trouble launching games, even though they've installed correctly?
	12	This may happen if you're storing your games on an NTFS-formatted drive. This
	13	shouldn't be an issue if you're storing your games on the same drive that Steam
	14	is on, but some gamers prefer to put Steam on their main drive and game files on
	15	another SSD or HDD.
16	16
17		To fix this problem, you'll need to try a few things. First, you'll need
18		to install the =ntfs-3g= package, which is meant for better
19		interoperability with Linux.
	17	To fix this problem, you'll need to try a few things. First, you'll need to
	18	install the =ntfs-3g= package, which is meant for better interoperability with
	19	Linux.
20	20
21	21	#+begin_src sh
22	22	sudo apt install ntfs-3g
23	23	#+end_src
24	24
25		Next, you should set up the =/etc/fstab= file to automatically mount
26		your drives on boot. To automatically mount your drives when the
27		computer boots up, you'll have to create the folders you want to mount
28		your drive to first. I store mine in the =/mnt= folder using names that
29		I'll recognize, but you can create your folders wherever you want.
	25	Next, you should set up the =/etc/fstab= file to automatically mount your drives
	26	on boot. To automatically mount your drives when the computer boots up, you'll
	27	have to create the folders you want to mount your drive to first. I store mine
	28	in the =/mnt= folder using names that I'll recognize, but you can create your
	29	folders wherever you want.
30	30
31	31	#+begin_src sh
32	32	mkdir /path/to/folder
		@@ -38,14 +38,13 @@ For example:
38	38	mkdir /mnt/steam_library
39	39	#+end_src
40	40
41		To automatically mount drives upon system boot, you will need to collect
42		a few items. The UUID is the identification number connected to
43		whichever drive you're using to store Steam games.
	41	To automatically mount drives upon system boot, you will need to collect a few
	42	items. The UUID is the identification number connected to whichever drive you're
	43	using to store Steam games.
44	44
45		Drives are usually labeled similar to =/dev/nvme0n1p1= or =/dev/sda1=,
46		so you'll need to find the line in the output of the command below that
47		correlates to your drive and copy the UUID over to the =/etc/fstab=
48		file.
	45	Drives are usually labeled similar to =/dev/nvme0n1p1= or =/dev/sda1=, so you'll
	46	need to find the line in the output of the command below that correlates to your
	47	drive and copy the UUID over to the =/etc/fstab= file.
49	48
50	49	#+begin_src sh
51	50	sudo blkid \| grep UUID=
		@@ -58,8 +57,8 @@ command:
58	57	id -u && id -g
59	58	#+end_src
60	59
61		Now that you have collected the necessary information, open the
62		=/etc/fstab= file:
	60	Now that you have collected the necessary information, open the =/etc/fstab=
	61	file:
63	62
64	63	#+begin_src sh
65	64	sudo nano /etc/fstab
		@@ -72,9 +71,8 @@ Each drive you want to mount on boot should have its own line in the
72	71	UUID=B64E53824E5339F7 /mnt/steam_library ntfs-3g uid=1000,gid=1000 0 0
73	72	#+end_src
74	73
75		Now all you need to do is unmount your drive and re-mount it. You can
76		unmount the drive by doing this (be sure to use the correct drive name
77		here):
	74	Now all you need to do is unmount your drive and re-mount it. You can unmount
	75	the drive by doing this (be sure to use the correct drive name here):
78	76
79	77	#+begin_src sh
80	78	sudo umount /dev/sdxX
		@@ -86,6 +84,6 @@ You can re-mount all your drives by executing the following:
86	84	sudo mount -a
87	85	#+end_src
88	86
89		If you don't know what your drive name is, or you're nervous about
90		unmounting and re-mounting, simply reboot your computer, and it will be
91		done for you automatically.
	87	If you don't know what your drive name is, or you're nervous about unmounting
	88	and re-mounting, simply reboot your computer, and it will be done for you
	89	automatically.

content/blog/2020-02-09-cryptography-basics.org +127 −139

		@@ -5,173 +5,161 @@
5	5
6	6	* Similar Article Available
7	7
8		If you haven't already, feel free to read my post on
9		[[../aes-encryption/][AES Encryption]].
	8	If you haven't already, feel free to read my post on [[../aes-encryption/][AES Encryption]].
10	9
11	10	* What is Cryptography?
12	11
13	12	In layman's terms, cryptography is a process that can change data from a
14		readable format into an unreadable format (and vice-versa) through a
15		series of processes and secrets. More technically, this is the Internet
16		Security Glossary's definition:
	13	readable format into an unreadable format (and vice-versa) through a series of
	14	processes and secrets. More technically, this is the Internet Security
	15	Glossary's definition:
17	16
18	17	#+begin_quote
19		[Cryptography is] the mathematical science that deals with transforming
20		data to render its meaning unintelligible (i.e., to hide its semantic
21		content), prevent its undetected alteration, or prevent its unauthorized
22		use. If the transformation is reversible, cryptography also deals with
23		restoring encrypted data to an intelligible form.
24
25		- [[https://tools.ietf.org/html/rfc2828][Internet Security Glossary
26		(2000)]]
	18	[Cryptography is] the mathematical science that deals with transforming data to
	19	render its meaning unintelligible (i.e., to hide its semantic content), prevent
	20	its undetected alteration, or prevent its unauthorized use. If the
	21	transformation is reversible, cryptography also deals with restoring encrypted
	22	data to an intelligible form.
	23
	24	- [[https://tools.ietf.org/html/rfc2828][Internet Security Glossary (2000)]]
27	25	#+end_quote
28	26
29		Cryptography cannot offer protection against the loss of data; it simply
30		offers encryption methods to protect data at-rest and data in-traffic.
31		At a high-level, encrypted is when plaintext data is encrypted to
32		ciphertext (a secure form of text that cannot be understood unless
33		decrypted back to plaintext). The encryption process is completed
34		through the use of a mathematical function that utilizes one or more
35		values called keys to encrypt or decrypt the data.
	27	Cryptography cannot offer protection against the loss of data; it simply offers
	28	encryption methods to protect data at-rest and data in-traffic. At a high-level,
	29	encrypted is when plaintext data is encrypted to ciphertext (a secure form of
	30	text that cannot be understood unless decrypted back to plaintext). The
	31	encryption process is completed through the use of a mathematical function that
	32	utilizes one or more values called keys to encrypt or decrypt the data.
36	33
37	34	* Key Elements of Cryptographic Systems
38	35
39		To create or evaluate a cryptographic system, you need to know the
40		essential pieces to the system:
41
42		- Encryption Algorithm (Primitive): A mathematical process that
43		encrypts and decrypts data.
44		- Encryption Key: A string of bits used within the encryption
45		algorithm as the secret that allows successful encryption or
46		decryption of data.
47		- Key Length (Size): The maximum number of bits within the encryption
48		key. It's important to remember that key size is regulated in many
49		countries.
50		- Message Digest: A smaller, fixed-size bit string version of the
51		original message. This is practically infeasible to reverse, which is
52		why it's commonly used to verify integrity.
	36	To create or evaluate a cryptographic system, you need to know the essential
	37	pieces to the system:
	38
	39	- Encryption Algorithm (Primitive): A mathematical process that encrypts and
	40	decrypts data.
	41	- Encryption Key: A string of bits used within the encryption algorithm as the
	42	secret that allows successful encryption or decryption of data.
	43	- Key Length (Size): The maximum number of bits within the encryption key.
	44	It's important to remember that key size is regulated in many countries.
	45	- Message Digest: A smaller, fixed-size bit string version of the original
	46	message. This is practically infeasible to reverse, which is why it's commonly
	47	used to verify integrity.
53	48
54	49	* Symmetric Systems (Secret Key Cryptography)
55	50
56		Symmetric cryptography utilizes a secret, bidirectional key to perform
57		both encryption and decryption of the data. The most common
58		implementation of symmetric cryptography is the Advanced Encryption
59		Standard, which uses keys that are 128 bits to 256 bits in size. This
60		standard came after the National Institute of Standards and Technology
61		(NIST) decided to retire the Data Encryption Standard (DES) in 2001.
62
63		Since brute force attacks strongly correlate with key length, the 56-bit
64		key length of DES was considered insecure after it was publicly broken
65		in under 24 hours. However, there is a modern implementation of DES
66		called Triple DES where the DES method is applied three times to each
67		data block.
68
69		The main advantages to symmetric systems are the ease of use, since only
70		one key is required for both encryption and decryption, and the
71		simplicity of the algorithms. This helps with bulk data encryption that
72		may unnecessarily waste time and power using asymmetric systems.
73
74		However, symmetric systems have disadvantages to keep in mind. Since the
75		key is private, it can be difficult to safely distribute keys to
76		communication partners. Additionally, the key cannot be used to sign
77		messages since it's necessary to keep the key private.
	51	Symmetric cryptography utilizes a secret, bidirectional key to perform both
	52	encryption and decryption of the data. The most common implementation of
	53	symmetric cryptography is the Advanced Encryption Standard, which uses keys that
	54	are 128 bits to 256 bits in size. This standard came after the National
	55	Institute of Standards and Technology (NIST) decided to retire the Data
	56	Encryption Standard (DES) in 2001.
	57
	58	Since brute force attacks strongly correlate with key length, the 56-bit key
	59	length of DES was considered insecure after it was publicly broken in under 24
	60	hours. However, there is a modern implementation of DES called Triple DES where
	61	the DES method is applied three times to each data block.
	62
	63	The main advantages to symmetric systems are the ease of use, since only one key
	64	is required for both encryption and decryption, and the simplicity of the
	65	algorithms. This helps with bulk data encryption that may unnecessarily waste
	66	time and power using asymmetric systems.
	67
	68	However, symmetric systems have disadvantages to keep in mind. Since the key is
	69	private, it can be difficult to safely distribute keys to communication
	70	partners. Additionally, the key cannot be used to sign messages since it's
	71	necessary to keep the key private.
78	72
79	73	* Asymmetric Systems (Public Key Cryptography)
80	74
81		Asymmetric cryptography utilizes two keys within the system: a secret
82		key that is privately-held and a public key that can be distributed
83		freely. The interesting aspect of asymmetric cryptography is that either
84		key can be used to encrypt the data, there's no rule that dictates which
85		key must be used for encryption. Once one key is used to encrypt the
86		data, only the other key can be used to decrypt the data. This means
87		that if the private key encrypts the data, only the public key can
88		decrypt the data.
89
90		An advantage of this system is that if you successfully decrypt data
91		using one of the keys, you can be sure of the sender since only the
92		other key could have encrypted the data.
93
94		One of the major implementations of an asymmetric system is a digital
95		signature. A digital signature can be generated using the sender's
96		private key, or a one-way hash function and is used to provide assurance
97		for the integrity and authenticity of the message. A couple common
98		message digest algorithms are SHA-256 and SHA-512, which securely
99		compress data and produce a 128-bit message digest.
100
101		It should be noted that man-in-the-middle attacks are one of the risks
102		with digital signatures and public keys. To combat this, applications
103		often use a public key infrastructure (PKI) to independently
104		authenticate the validity of signatures and keys.
105
106		Due to the large key size and
107		[[https://crypto.stackexchange.com/a/591][inefficient mathematical
108		functions]] of asymmetric encryption, elliptical curve cryptography
109		(ECC) is often used to increase security while using fewer resources.
	75	Asymmetric cryptography utilizes two keys within the system: a secret key that
	76	is privately-held and a public key that can be distributed freely. The
	77	interesting aspect of asymmetric cryptography is that either key can be used to
	78	encrypt the data, there's no rule that dictates which key must be used for
	79	encryption. Once one key is used to encrypt the data, only the other key can be
	80	used to decrypt the data. This means that if the private key encrypts the data,
	81	only the public key can decrypt the data.
	82
	83	An advantage of this system is that if you successfully decrypt data using one
	84	of the keys, you can be sure of the sender since only the other key could have
	85	encrypted the data.
	86
	87	One of the major implementations of an asymmetric system is a digital signature.
	88	A digital signature can be generated using the sender's private key, or a
	89	one-way hash function and is used to provide assurance for the integrity and
	90	authenticity of the message. A couple common message digest algorithms are
	91	SHA-256 and SHA-512, which securely compress data and produce a 128-bit message
	92	digest.
	93
	94	It should be noted that man-in-the-middle attacks are one of the risks with
	95	digital signatures and public keys. To combat this, applications often use a
	96	public key infrastructure (PKI) to independently authenticate the validity of
	97	signatures and keys.
	98
	99	Due to the large key size and [[https://crypto.stackexchange.com/a/591][inefficient mathematical functions]] of asymmetric
	100	encryption, elliptical curve cryptography (ECC) is often used to increase
	101	security while using fewer resources.
110	102
111	103	* Applications of Cryptographic Systems
112	104
113		There are quite a few implementations of cryptographic systems around
114		the world. Here are a few popular examples:
115
116		Transport Layer Security (TLS): One of the most famous cryptographic
117		solutions created is TLS, a session-layered or connection-layered
118		internet protocol that allows for secure communications between browsers
119		and servers. Using handshakes, peer negotiation, and authentication
120		allows TLS to prevent eavesdropping and malicious transformation of
121		data. The major reason for TLS popularity is that a major vulnerability
122		was found in the SSL protocol in 2014. Instead of SSL, TLS can be used
123		with HTTP to form HTTPS and is the preferred method for modern web
	105	There are quite a few implementations of cryptographic systems around the world.
	106	Here are a few popular examples:
	107
	108	Transport Layer Security (TLS): One of the most famous cryptographic solutions
	109	created is TLS, a session-layered or connection-layered internet protocol that
	110	allows for secure communications between browsers and servers. Using handshakes,
	111	peer negotiation, and authentication allows TLS to prevent eavesdropping and
	112	malicious transformation of data. The major reason for TLS popularity is that a
	113	major vulnerability was found in the SSL protocol in 2014. Instead of SSL, TLS
	114	can be used with HTTP to form HTTPS and is the preferred method for modern web
124	115	development due to its increased security.
125	116
126		Secure Hypertext Transfer Protocol (HTTPS): An application layer
127		protocol that allows for secure transport of data between servers and
128		web clients. One of the unique parts of HTTPS is that it uses a secured
129		port number instead of the default web port address.
	117	Secure Hypertext Transfer Protocol (HTTPS): An application layer protocol that
	118	allows for secure transport of data between servers and web clients. One of the
	119	unique parts of HTTPS is that it uses a secured port number instead of the
	120	default web port address.
130	121
131		Virtual Private Network (VPN): VPNs are made to securely extend a
132		private network across public networks by utilizing an encrypted layered
133		tunneling protocol paired with an authentication method, such as
134		usernames and passwords. This technology originally allowed remote
135		employees to access their company's data but have evolved into one of
136		the top choices for anyone who wishes to mask their sensitive personal
137		data.
	122	Virtual Private Network (VPN): VPNs are made to securely extend a private
	123	network across public networks by utilizing an encrypted layered tunneling
	124	protocol paired with an authentication method, such as usernames and passwords.
	125	This technology originally allowed remote employees to access their company's
	126	data but have evolved into one of the top choices for anyone who wishes to mask
	127	their sensitive personal data.
138	128
139	129	Internet Protocol Security (IPSec): This protocol suite facilitates
140	130	communication between two or more hosts or subnets by authenticating and
141		encrypting the data packets. IPSec is used in a lot of VPNs to establish
142		the VPN connection through the transport and tunnel mode encryption
143		methods. IPSec encrypts just the data portion of packets in the
144		transport methods, but it encrypts both the data and headers in the
145		tunnel method (introducing an additional header for authentication).
146
147		Secure Shell (SSH): SSH is another network protocol used to protect
148		network services by authenticating users through a secure channel. This
149		protocol is often used for command-line (shell) functions such as remote
150		shell commands, logins, and file transfers.
151
152		Kerberos: Developed by MIT, Kerberos is a computer-network
153		authentication protocol that works on the basis of tickets to allow
154		nodes communicating over a non-secure network to prove their identity to
155		one another securely. This is most commonly used in business
156		environments when used as the authentication and encryption method for
157		Windows Active Directory (AD).
	131	encrypting the data packets. IPSec is used in a lot of VPNs to establish the VPN
	132	connection through the transport and tunnel mode encryption methods. IPSec
	133	encrypts just the data portion of packets in the transport methods, but it
	134	encrypts both the data and headers in the tunnel method (introducing an
	135	additional header for authentication).
	136
	137	Secure Shell (SSH): SSH is another network protocol used to protect network
	138	services by authenticating users through a secure channel. This protocol is
	139	often used for command-line (shell) functions such as remote shell commands,
	140	logins, and file transfers.
	141
	142	Kerberos: Developed by MIT, Kerberos is a computer-network authentication
	143	protocol that works on the basis of tickets to allow nodes communicating over a
	144	non-secure network to prove their identity to one another securely. This is most
	145	commonly used in business environments when used as the authentication and
	146	encryption method for Windows Active Directory (AD).
158	147
159	148	* Cybersecurity Controls
160	149
161		If you're someone who needs solutions on how to control risks associated
162		with utilizing a crytograhpic system, start with a few basic controls:
	150	If you're someone who needs solutions on how to control risks associated with
	151	utilizing a crytograhpic system, start with a few basic controls:
163	152
164		- Policies: A policy on the use of cryptographic controls for
165		protection of information is implemented and is in accordance with
166		organizational objectives.
	153	- Policies: A policy on the use of cryptographic controls for protection of
	154	information is implemented and is in accordance with organizational
	155	objectives.
167	156	- Key management: A policy on the use, protection and lifetime of
168		cryptographic keys is implemented through the entire application
169		lifecycle.
170		- Key size: The organization has researched the optimal key size for
171		their purposes, considering national laws, required processing power,
172		and longevity of the solution.
173		- Algorithm selection: Implemented algorithms are sufficiently
174		appropriate for the business of the organization, robust, and align
175		with recommended guidelines.
176		- Protocol configuration: Protocols have been reviewed and configured
177		suitable to the purpose of the business.
	157	cryptographic keys is implemented through the entire application lifecycle.
	158	- Key size: The organization has researched the optimal key size for their
	159	purposes, considering national laws, required processing power, and longevity
	160	of the solution.
	161	- Algorithm selection: Implemented algorithms are sufficiently appropriate for
	162	the business of the organization, robust, and align with recommended
	163	guidelines.
	164	- Protocol configuration: Protocols have been reviewed and configured suitable
	165	to the purpose of the business.

content/blog/2020-03-25-session-messenger.org +52 −60

		@@ -5,46 +5,41 @@
5	5
6	6	* Privacy Warning
7	7
8		The company behind Session (Loki Foundation) is from Australia. If you
9		didn't know, Australia has introduced
10		[[https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_aspassed/toc_pdf/18204b01.pdf][legislation]]
11		mandating companies comply with government requests to build backdoor
12		access into applications. For more information, read my article on
13		[[./2020-01-25-aes-encryption.html][AES Encryption]].
	8	The company behind Session (Loki Foundation) is from Australia. If you didn't
	9	know, Australia has introduced [[https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_aspassed/toc_pdf/18204b01.pdf][legislation]] mandating companies comply with
	10	government requests to build backdoor access into applications. For more
	11	information, read my article on [[./2020-01-25-aes-encryption.html][AES Encryption]].
14	12
15	13	* About Session
16	14
17		[[https://getsession.org][Session]] is a private, cross-platform
18		messaging app from the [[https://loki.foundation][Loki Foundation]]. As
19		someone who has spent years looking for quality alternatives to major
20		messaging apps, I was excited when I first heard about Session. Reading
21		through [[https://arxiv.org/pdf/2002.04609.pdf][Session's white paper]],
22		you can learn the technologies behind the Session app. Part of the
23		security of Session comes from the Signal protocol, which was forked as
24		the origin of Session.
	15	[[https://getsession.org][Session]] is a private, cross-platform messaging app from the [[https://loki.foundation][Loki Foundation]]. As
	16	someone who has spent years looking for quality alternatives to major messaging
	17	apps, I was excited when I first heard about Session. Reading through [[https://arxiv.org/pdf/2002.04609.pdf][Session's
	18	white paper]], you can learn the technologies behind the Session app. Part of the
	19	security of Session comes from the Signal protocol, which was forked as the
	20	origin of Session.
25	21
26	22	#+begin_quote
27		Session is an end-to-end encrypted messenger that removes sensitive
28		metadata collection, and is designed for people who want privacy and
29		freedom from any forms of surveillance.
	23	Session is an end-to-end encrypted messenger that removes sensitive metadata
	24	collection, and is designed for people who want privacy and freedom from any
	25	forms of surveillance.
30	26	#+end_quote
31	27
32	28	In general, this app promises security through end-to-end encryption,
33		decentralized onion routing, and private identities. The biggest change
34		that the Loki Foundation has made to the Signal protocol is removing the
35		need for a phone number. Instead, a random identification string is
36		generated for any session you create. This means you can create a new
37		session for each device if you want to, or link new devices with your
38		ID.
	29	decentralized onion routing, and private identities. The biggest change that the
	30	Loki Foundation has made to the Signal protocol is removing the need for a phone
	31	number. Instead, a random identification string is generated for any session you
	32	create. This means you can create a new session for each device if you want to,
	33	or link new devices with your ID.
39	34
40		Since Session's website and white paper describe the details of
41		Session's security, I'm going to focus on using the app in this post.
	35	Since Session's website and white paper describe the details of Session's
	36	security, I'm going to focus on using the app in this post.
42	37
43	38	* Features
44	39
45		Since most people are looking for an alternative to a popular chat app,
46		I am going to list out the features that Session has so that you are
47		able to determine if the app would suit your needs:
	40	Since most people are looking for an alternative to a popular chat app, I am
	41	going to list out the features that Session has so that you are able to
	42	determine if the app would suit your needs:
48	43
49	44	- Multiple device linking (via QR code or ID)
50	45	- App locking via device screen lock, password, or fingerprint
		@@ -59,15 +54,15 @@ able to determine if the app would suit your needs:
59	54
60	55	* Downloads
61	56
62		I have tested this app on Ubuntu 19.10, Android 10, macOS Monterey, and
63		iOS 15. All apps have worked well without many issues.
	57	I have tested this app on Ubuntu 19.10, Android 10, macOS Monterey, and iOS 15.
	58	All apps have worked well without many issues.
64	59
65		Below is a brief overview of the Session app on Linux. To get this app,
66		you'll need to go to the [[https://getsession.org/download/][Downloads]]
67		page and click to link to the operating system you're using.
	60	Below is a brief overview of the Session app on Linux. To get this app, you'll
	61	need to go to the [[https://getsession.org/download/][Downloads]] page and click to link to the operating system
	62	you're using.
68	63
69		For Linux, it will download an AppImage that you'll need to enable with
70		the following command:
	64	For Linux, it will download an AppImage that you'll need to enable with the
	65	following command:
71	66
72	67	#+begin_src sh
73	68	sudo chmod u+x session-messenger-desktop-linux-x86_64-1.0.5.AppImage
		@@ -75,42 +70,39 @@ sudo chmod u+x session-messenger-desktop-linux-x86_64-1.0.5.AppImage
75	70
76	71	* Creating an Account
77	72
78		Once you've installed the app, simply run the app and create your unique
79		Session ID. It will look something like this:
	73	Once you've installed the app, simply run the app and create your unique Session
	74	ID. It will look something like this:
80	75	=05af1835afdd63c947b47705867501d6373f486aa1ae05b1f2f3fcd24570eba608=.
81	76
82		You'll need to set a display name and, optionally, a password. If you
83		set a password, you will need to enter it every time you open the app.
	77	You'll need to set a display name and, optionally, a password. If you set a
	78	password, you will need to enter it every time you open the app.
84	79
85	80	* Start Messaging
86	81
87		Once you've created your account and set up your profile details, the
88		next step is to start messaging other people. To do so, you'll need to
89		share your Session ID with other people. From this point, it's fairly
90		straightforward and acts like any other messaging app, so I won't dive
91		into much detail here.
	82	Once you've created your account and set up your profile details, the next step
	83	is to start messaging other people. To do so, you'll need to share your Session
	84	ID with other people. From this point, it's fairly straightforward and acts like
	85	any other messaging app, so I won't dive into much detail here.
92	86
93	87	** macOS
94	88
95		One key feature to note is that the desktop application now provides a
96		helpful pop-up box explaining the process that Session uses to hide your
97		IP address:
	89	One key feature to note is that the desktop application now provides a helpful
	90	pop-up box explaining the process that Session uses to hide your IP address:
98	91
99	92	** iOS
100	93
101		The mobile app is quite simple and effective, giving you all the
102		standard mobile messaging options you'd expect.
	94	The mobile app is quite simple and effective, giving you all the standard mobile
	95	messaging options you'd expect.
103	96
104	97	* Potential Issues
105	98
106		I've discovered one annoying issue that would prevent from using this
107		app regularly. On a mobile device, there have been issues with receiving
108		messages on time. Even with battery optimization disabled and no network
109		restrictions, Session notifications sometimes do not display until I
110		open the app or the conversation itself and wait a few moments. This is
111		actually one of the reasons I stopped using Signal (this seems fixed as
112		of my updates in 2021/2022, so I wouldn't worry about this issue
113		anymore).
114
115		Looking for another messenger instead of Session? I recommend Signal,
116		Matrix, and IRC.
	99	I've discovered one annoying issue that would prevent from using this app
	100	regularly. On a mobile device, there have been issues with receiving messages on
	101	time. Even with battery optimization disabled and no network restrictions,
	102	Session notifications sometimes do not display until I open the app or the
	103	conversation itself and wait a few moments. This is actually one of the reasons
	104	I stopped using Signal (this seems fixed as of my updates in 2021/2022, so I
	105	wouldn't worry about this issue anymore).
	106
	107	Looking for another messenger instead of Session? I recommend Signal, Matrix,
	108	and IRC.

content/blog/2020-05-03-homelab.org +76 −88

		@@ -5,27 +5,23 @@
5	5
6	6	* What is a Homelab?
7	7
8		Starting as a developer, I have largely stayed away from hardware-based
9		hobbies (other than building a gaming desktop). However, as the
10		quarantine for COVID-19 stretches out further and further, I found
11		myself bored and in search of new hobbies. After spending the last few
12		months browsing the [[https://www.reddit.com/r/homelab/][r/homelab]]
13		subreddit, I decided it was time to jump in and try things out for
14		myself.
	8	Starting as a developer, I have largely stayed away from hardware-based hobbies
	9	(other than building a gaming desktop). However, as the quarantine for COVID-19
	10	stretches out further and further, I found myself bored and in search of new
	11	hobbies. After spending the last few months browsing the [[https://www.reddit.com/r/homelab/][r/homelab]] subreddit, I
	12	decided it was time to jump in and try things out for myself.
15	13
16		Since I am a beginner and just recently graduated from college,
17		everything I've done so far in my homelab is fairly low-budget.
	14	Since I am a beginner and just recently graduated from college, everything I've
	15	done so far in my homelab is fairly low-budget.
18	16
19	17	* Hardware
20	18
21	19	** Raspberry Pi 4
22	20
23		Luckily, I had actually purchased a
24		[[https://www.raspberrypi.org/products/raspberry-pi-4-model-b/][Raspberry
25		Pi 4]] before the quarantine started so that I could try to keep Plex
26		Media Center running, even while my desktop computer was turned off. I
27		started here, using the Pi to hold Plex and Pi-hole until I grew tired
28		with the slow performance.
	21	Luckily, I had actually purchased a [[https://www.raspberrypi.org/products/raspberry-pi-4-model-b/][Raspberry Pi 4]] before the quarantine started
	22	so that I could try to keep Plex Media Center running, even while my desktop
	23	computer was turned off. I started here, using the Pi to hold Plex and Pi-hole
	24	until I grew tired with the slow performance.
29	25
30	26	Here are the specifications for the Pi 4:
31	27
		@@ -37,12 +33,12 @@ Here are the specifications for the Pi 4:
37	33
38	34	** Dell Optiplex 5040
39	35
40		Since I wasn't happy with the Pi as my main server, I turned to
41		Craigslist. I know a lot of other homelabbers use Ebay, but I can't seem
42		to ever trust it enough to purchase items on there. So I used Craigslist
43		and found a Dell Optiplex 5040 desktop computer on sale for $90. While
44		this computer might be underpowered, it was one of the few computers
45		under $100 that was available during quarantine.
	36	Since I wasn't happy with the Pi as my main server, I turned to Craigslist. I
	37	know a lot of other homelabbers use Ebay, but I can't seem to ever trust it
	38	enough to purchase items on there. So I used Craigslist and found a Dell
	39	Optiplex 5040 desktop computer on sale for $90. While this computer might be
	40	underpowered, it was one of the few computers under $100 that was available
	41	during quarantine.
46	42
47	43	Here are the specifications for the Dell Optiplex 5040:
48	44
		@@ -52,111 +48,103 @@ Here are the specifications for the Dell Optiplex 5040:
52	48	- Gigabit Ethernet
53	49	- 500GB Hard Drive
54	50
55		While this hardware would be awful for a work computer or a gaming rig,
56		it turned out to be wonderful for my server purposes. The only
57		limitation I have found so far is the CPU. The i3-6100 only has enough
58		power for a single 4k video transcode at a time. I haven't tested more
59		than three 1080p streams at a time, but the maximum amount of streams
60		I've ever actually used is two.
	51	While this hardware would be awful for a work computer or a gaming rig, it
	52	turned out to be wonderful for my server purposes. The only limitation I have
	53	found so far is the CPU. The i3-6100 only has enough power for a single 4k video
	54	transcode at a time. I haven't tested more than three 1080p streams at a time,
	55	but the maximum amount of streams I've ever actually used is two.
61	56
62	57	** WD easystore 10TB & 8TB
63	58
64		Application storage and temporary files are stored on the internal hard
65		drive of the server, but all media files (movies, tv, games, books, etc)
66		are stored externally on my WD easystore hard drive. Creating auto-boot
67		configurations in the =/etc/fstab= file on my server allows the hard
68		drives to automatically mount whenever I need to restart my server.
	59	Application storage and temporary files are stored on the internal hard drive of
	60	the server, but all media files (movies, tv, games, books, etc) are stored
	61	externally on my WD easystore hard drive. Creating auto-boot configurations in
	62	the =/etc/fstab= file on my server allows the hard drives to automatically mount
	63	whenever I need to restart my server.
69	64
70	65	#+begin_quote
71		Update: In March 2022, I shucked the hard drives out of their external
72		cases, put some Kapton tape on the third power pin to prevent power
73		shutdowns, and stuck them inside my server tower using internal SATA
74		cables.
	66	Update: In March 2022, I shucked the hard drives out of their external cases,
	67	put some Kapton tape on the third power pin to prevent power shutdowns, and
	68	stuck them inside my server tower using internal SATA cables.
75	69	#+end_quote
76	70
77	71	** Netgear Unmanaged Switch
78	72
79		To manage all the ethernet cords used by my homelab, my desktop, and my
80		living room media center, I purchased an 8-port gigabit ethernet switch
81		for $50 at my local computer store. This is probably much more than I
82		should have spent on an unmanaged switch, but I am comfortable with the
83		choice.
	73	To manage all the ethernet cords used by my homelab, my desktop, and my living
	74	room media center, I purchased an 8-port gigabit ethernet switch for $50 at my
	75	local computer store. This is probably much more than I should have spent on an
	76	unmanaged switch, but I am comfortable with the choice.
84	77
85	78	** TP-Link Managed Switch
86	79
87		Since I use the unmanaged switch to group all living room devices
88		together, I use the managed switch to configure VLANs and secure my
89		network.
	80	Since I use the unmanaged switch to group all living room devices together, I
	81	use the managed switch to configure VLANs and secure my network.
90	82
91	83	** Arris TM1602A Modem & Sagecom Fast 5280 Router
92	84
93		My default modem and router, provided by my ISP, are fairly standard.
94		The Arris modem supports DOCSIS 3.0, which is something that I
95		definitely wanted as a minimum. The Sagecom router is also standard, no
96		fancy bells or whistles. However, it does support DHCP and DHCPv6, which
97		is something you can use to route all household traffic through a
98		pi-hole or firewall.
	85	My default modem and router, provided by my ISP, are fairly standard. The Arris
	86	modem supports DOCSIS 3.0, which is something that I definitely wanted as a
	87	minimum. The Sagecom router is also standard, no fancy bells or whistles.
	88	However, it does support DHCP and DHCPv6, which is something you can use to
	89	route all household traffic through a pi-hole or firewall.
99	90
100	91	** TP-Link EAP
101	92
102		In order to gain better control over the network, I use my own wireless
103		access point instead of the one included in the Sagecom router above.
104		Now I can control and organize all of my ethernet connections through
105		the VLANs on the managed switch and wireless connections through the
106		VLANS on the EAP.
	93	In order to gain better control over the network, I use my own wireless access
	94	point instead of the one included in the Sagecom router above. Now I can control
	95	and organize all of my ethernet connections through the VLANs on the managed
	96	switch and wireless connections through the VLANS on the EAP.
107	97
108	98	** Generic Printer
109	99
110		The last piece to my homelab is a standard wireless printer. Nothing
111		special here.
	100	The last piece to my homelab is a standard wireless printer. Nothing special
	101	here.
112	102
113	103	* Software
114	104
115	105	** Ubuntu Server 20.04
116	106
117		While the 20.04 version of Ubuntu was just released, I always like to
118		experiment with new features (and I don't mind breaking my system - it
119		just gives me more experience learning how to fix things). So, I have
120		Ubuntu Server 20.04 installed on the Dell Optiplex server and Ubuntu
121		Server 19.10 installed on the Raspberry Pi. Once I find an acceptable
122		use for the Pi, I will most likely switch the operating system.
	107	While the 20.04 version of Ubuntu was just released, I always like to experiment
	108	with new features (and I don't mind breaking my system - it just gives me more
	109	experience learning how to fix things). So, I have Ubuntu Server 20.04 installed
	110	on the Dell Optiplex server and Ubuntu Server 19.10 installed on the Raspberry
	111	Pi. Once I find an acceptable use for the Pi, I will most likely switch the
	112	operating system.
123	113
124	114	** Docker
125	115
126		I am /very/ new to Docker, but I have had a lot of fun playing with it
127		so far. Docker is used to create containers that can hold all the
128		contents of a system without interfering with other software on the same
129		system. So far, I have successfully installed pi-hole, GitLab, Gogs, and
130		Nextcloud in containers. However, I opted to delete all of those so that
131		I can reconfigure them more professionally at a later time.
	116	I am /very/ new to Docker, but I have had a lot of fun playing with it so far.
	117	Docker is used to create containers that can hold all the contents of a system
	118	without interfering with other software on the same system. So far, I have
	119	successfully installed pi-hole, GitLab, Gogs, and Nextcloud in containers.
	120	However, I opted to delete all of those so that I can reconfigure them more
	121	professionally at a later time.
132	122
133	123	** Plex Media Server
134	124
135		Plex is a media center software that allows you to organize your movies,
136		TV shows, music, photos, and videos automatically. It will even download
137		metadata for you so that you can easily browse these collections.
	125	Plex is a media center software that allows you to organize your movies, TV
	126	shows, music, photos, and videos automatically. It will even download metadata
	127	for you so that you can easily browse these collections.
138	128
139	129	** Pi-hole
140	130
141		Pi-hole is an alternative ad-blocker that runs at the DNS level,
142		allowing you to block traffic when it hits your network, so that you can
143		reject any traffic you deem to be bad. Pi-hole uses blacklists and
144		whitelists to decide which traffic block and, luckily, there are a lot
145		of pre-made lists out there on Reddit, GitHub, etc.
	131	Pi-hole is an alternative ad-blocker that runs at the DNS level, allowing you to
	132	block traffic when it hits your network, so that you can reject any traffic you
	133	deem to be bad. Pi-hole uses blacklists and whitelists to decide which traffic
	134	block and, luckily, there are a lot of pre-made lists out there on Reddit,
	135	GitHub, etc.
146	136
147	137	** Nextcloud
148	138
149		While I had trouble with the Docker version of Nextcloud, I was very
150		successful when setting up the snap version. Using this, I was able to
151		map Nextcloud to a subdomain of a domain I own in Namecheap.
152		Additionally, Nextcloud has an integration with Let's Encrypt that
153		allows me to issue certificates automatically to any new domain I
154		authorize.
	139	While I had trouble with the Docker version of Nextcloud, I was very successful
	140	when setting up the snap version. Using this, I was able to map Nextcloud to a
	141	subdomain of a domain I own in Namecheap. Additionally, Nextcloud has an
	142	integration with Let's Encrypt that allows me to issue certificates
	143	automatically to any new domain I authorize.
155	144
156	145	** Webmin
157	146
158		To monitor my servers, and the processes running on them, I use the
159		Webmin dashboard. This was fairly painless to set up, and I currently
160		access it straight through the server's IP address. In the future, I
161		will be looking to configure Webmin to use a custom domain just like
162		Nextcloud.
	147	To monitor my servers, and the processes running on them, I use the Webmin
	148	dashboard. This was fairly painless to set up, and I currently access it
	149	straight through the server's IP address. In the future, I will be looking to
	150	configure Webmin to use a custom domain just like Nextcloud.

content/blog/2020-05-19-customizing-ubuntu.org +80 −96

		@@ -10,145 +10,127 @@ For inspiration on designing your *nix computer, check out the
10	10
11	11	* Customizing Ubuntu
12	12
13		New to Linux and want to add a personal touch to your machine? One of
14		the best perks of Linux is that it is extremely customizable. You can
15		change the styles of the windows, shell (status bars/docks), icons,
16		fonts, terminals, and more.
	13	New to Linux and want to add a personal touch to your machine? One of the best
	14	perks of Linux is that it is extremely customizable. You can change the styles
	15	of the windows, shell (status bars/docks), icons, fonts, terminals, and more.
17	16
18		In this post, I'm going to go through customization on Ubuntu 20.04
19		(GNOME) since most new users tend to choose Ubuntu-based distros. If
20		you've found a way to install Arch with i3-gaps, I'm assuming you know
21		how to find more advanced tutorials out there on customizations.
	17	In this post, I'm going to go through customization on Ubuntu 20.04 (GNOME)
	18	since most new users tend to choose Ubuntu-based distros. If you've found a way
	19	to install Arch with i3-gaps, I'm assuming you know how to find more advanced
	20	tutorials out there on customizations.
22	21
23	22	** Required Tools
24	23
25		Ubuntu 20.04 ships with the default desktop environment
26		[[https://www.gnome.org/][Gnome]], which includes the handy
27		=gnome-tweaks= tool to quickly change designs. To install this, just
	24	Ubuntu 20.04 ships with the default desktop environment [[https://www.gnome.org/][Gnome]], which includes
	25	the handy =gnome-tweaks= tool to quickly change designs. To install this, just
28	26	open your terminal and enter the following command:
29	27
30	28	#+begin_src sh
31	29	sudo apt install gnome-tweaks
32	30	#+end_src
33	31
34		After you've finished installing the tool, simply launch the Tweaks
35		application, and you'll be able to access the various customization
36		options available by default on Ubuntu. You might even like some of the
37		pre-installed options.
	32	After you've finished installing the tool, simply launch the Tweaks application,
	33	and you'll be able to access the various customization options available by
	34	default on Ubuntu. You might even like some of the pre-installed options.
38	35
39	36	** GNOME Application Themes
40	37
41		To change the themes applied to applications in GNOME, you will need to
42		change the Applications dropdown in the Appearance section of Tweaks. To
43		add more themes, you will have to find your preferred theme online and
44		follow the steps below to have it show up in the Tweaks tool. While you
45		may find themes anywhere, one of the most popular sites for GNOME themes
46		is [[https://www.gnome-look.org/][gnome-look.org]]. This website
	38	To change the themes applied to applications in GNOME, you will need to change
	39	the Applications dropdown in the Appearance section of Tweaks. To add more
	40	themes, you will have to find your preferred theme online and follow the steps
	41	below to have it show up in the Tweaks tool. While you may find themes anywhere,
	42	one of the most popular sites for GNOME themes is [[https://www.gnome-look.org/][gnome-look.org]]. This website
47	43	contains themes for applications, shells, icons, and cursors.
48	44
49	45	Steps to import themes into Tweaks:
50	46
51	47	1. Download the theme.
52		2. These files are usually compressed (.zip, .tar.gz, .tar.xz), so you
53		will need to extract the contents. This is easiest when opening the
54		file explorer, right-clicking the compressed file, and choosing
55		"Extract here."
	48	2. These files are usually compressed (.zip, .tar.gz, .tar.xz), so you will need
	49	to extract the contents. This is easiest when opening the file explorer,
	50	right-clicking the compressed file, and choosing "Extract here."
56	51	3. Move the theme folder to =/usr/share/themes/=. You can do so with the
57	52	following command: =sudo mv theme-folder/ /usr/share/themes/=.
58	53	- Icons and cursors will be moved to the =/usr/share/icons/= folder.
59		- Fonts will be moved to the =/usr/share/fonts/= folder
60		Alternatively, you can move them to the
61		=/usr/share/fonts/opentype/= or =/usr/share/fonts/opentype/=
62		folders, if you have a specific font type.
	54	- Fonts will be moved to the =/usr/share/fonts/= folder Alternatively, you
	55	can move them to the =/usr/share/fonts/opentype/= or
	56	=/usr/share/fonts/opentype/= folders, if you have a specific font type.
63	57	4. Close tweaks if it is open. Re-open Tweaks and your new theme will be
64		available in the Applications dropdown in the Appearance section of
65		Tweaks.
	58	available in the Applications dropdown in the Appearance section of Tweaks.
66	59
67		If the theme is not showing up after you've moved it into the themes
68		folder, you may have uncompressed the folder into a sub-folder. You can
69		check this by entering the theme folder and listing the contents:
	60	If the theme is not showing up after you've moved it into the themes folder, you
	61	may have uncompressed the folder into a sub-folder. You can check this by
	62	entering the theme folder and listing the contents:
70	63
71	64	#+begin_src sh
72	65	cd /usr/share/themes/Mojave-Dark && ls -la
73	66	#+end_src
74	67
75		This is an example of what the contents of your theme folder should look
76		like. If you just see another folder there, you should move that folder
77		up into the =/usr/share/themes/= folder.
	68	This is an example of what the contents of your theme folder should look like.
	69	If you just see another folder there, you should move that folder up into the
	70	=/usr/share/themes/= folder.
78	71
79	72	#+begin_src sh
80		cinnamon COPYING gnome-shell gtk-2.0 gtk-3.0 index.theme metacity-1 plank xfwm4
	73	cinnamon COPYING gnome-shell gtk-2.0 gtk-3.0 index.theme metacity-1 plank xfwm4
81	74	#+end_src
82	75
83	76	** GNOME Shell Themes
84	77
85		To change the appearance of the title bar, default dock, app menu, and
86		other parts of the GNOME shell, you'll need to install the
87		[[https://extensions.gnome.org/extension/19/user-themes/][user themes]]
88		extension on [[https://extensions.gnome.org/][Gnome Extensions]]. To be
89		able to install extensions, you will first need to install the browser
90		extension that the website instructs you to. See this screenshot for the
91		blue box with a link to the extension.
	78	To change the appearance of the title bar, default dock, app menu, and other
	79	parts of the GNOME shell, you'll need to install the [[https://extensions.gnome.org/extension/19/user-themes/][user themes]] extension on
	80	[[https://extensions.gnome.org/][Gnome Extensions]]. To be able to install extensions, you will first need to
	81	install the browser extension that the website instructs you to. See this
	82	screenshot for the blue box with a link to the extension.
92	83
93		After the browser extension is installed, you will need to install the
94		native host connector:
	84	After the browser extension is installed, you will need to install the native
	85	host connector:
95	86
96	87	#+begin_src sh
97	88	sudo apt install chrome-gnome-shell
98	89	#+end_src
99	90
100		Finally, you can go the
101		[[https://extensions.gnome.org/extension/19/user-themes/][user themes]]
102		extension page and click the installation button. This will enable the
103		Shell option in Tweaks. Now you can move shell themes to the
104		=/usr/share/themes= directory, using the same steps mentioned in the
105		previous section, and enable the new theme in Tweaks.
	91	Finally, you can go the [[https://extensions.gnome.org/extension/19/user-themes/][user themes]] extension page and click the installation
	92	button. This will enable the Shell option in Tweaks. Now you can move shell
	93	themes to the =/usr/share/themes= directory, using the same steps mentioned in
	94	the previous section, and enable the new theme in Tweaks.
106	95
107	96	** Icons & Cursors
108	97
109		Icons and cursors are installed exactly the same way, so I'm grouping
110		these together in this post. Both of these items will need to follow the
111		same process as installing themes, except you will want to move your
112		font folders to the =/usr/share/icons/= directory instead.
	98	Icons and cursors are installed exactly the same way, so I'm grouping these
	99	together in this post. Both of these items will need to follow the same process
	100	as installing themes, except you will want to move your font folders to the
	101	=/usr/share/icons/= directory instead.
113	102
114	103	** Fonts
115	104
116		Fonts are one of the overlooked parts of customization, but a good font
117		can make the whole screen look different. For example, I have installed
118		the [[https://github.com/IBM/plex/releases][IBM Plex]] fonts on my
119		system. This follows the same process as installing themes, except you
120		will want to move your font folders to the =/usr/share/fonts/= directory
	105	Fonts are one of the overlooked parts of customization, but a good font can make
	106	the whole screen look different. For example, I have installed the [[https://github.com/IBM/plex/releases][IBM Plex]]
	107	fonts on my system. This follows the same process as installing themes, except
	108	you will want to move your font folders to the =/usr/share/fonts/= directory
121	109	instead.
122	110
123	111	** Terminal
124	112
125		If you spend a lot of time typing commands, you know how important the
126		style and functionality of the terminal is. After spending a lot of time
127		using the default GNOME terminal with
128		[[https://en.wikipedia.org/wiki/Bash_(Unix_shell)][unix shell]], I
129		decided to try some different options. I ended up choosing
130		[[https://terminator-gtk3.readthedocs.io/en/latest/][Terminator]] with
131		[[https://en.wikipedia.org/wiki/Z_shell][zsh]].
132
133		Terminator is great if you need to open multiple terminals at one time
134		by simply right-clicking and splitting the screen into as many terminals
135		as you want. While this project hasn't been updated in a while,
136		[[https://github.com/gnome-terminator/terminator/issues/1][it is coming
137		under new development]]. However, this terminal is great and I haven't
138		experienced any errors yet.
139
140		For the shell choice, I decided to choose zsh after trying it out on a
141		fresh Manjaro installation. Zsh is great if you like to change the
142		themes of your terminal, include icons, or add plugins.
143
144		The desktop uses the
145		[[https://github.com/zsh-users/zsh-autosuggestions][zsh-autosuggestions]]
146		to suggest past commands as you type. In addition, it suggests
147		corrections if you misspell a command. Lastly, it uses the =af-magic=
148		theme, which adds dashed lines between commands, moving the user@host
149		tag to the right side of the terminal, and changes the colors. There are
150		plenty of plugins and themes to choose from. Just figure out what you
151		like and add it to your =~/.zshrc= file!
	113	If you spend a lot of time typing commands, you know how important the style and
	114	functionality of the terminal is. After spending a lot of time using the default
	115	GNOME terminal with [[https://en.wikipedia.org/wiki/Bash_(Unix_shell)][unix shell]], I decided to try some different options. I ended
	116	up choosing [[https://terminator-gtk3.readthedocs.io/en/latest/][Terminator]] with [[https://en.wikipedia.org/wiki/Z_shell][zsh]].
	117
	118	Terminator is great if you need to open multiple terminals at one time by simply
	119	right-clicking and splitting the screen into as many terminals as you want.
	120	While this project hasn't been updated in a while, [[https://github.com/gnome-terminator/terminator/issues/1][it is coming under new
	121	development]]. However, this terminal is great and I haven't experienced any
	122	errors yet.
	123
	124	For the shell choice, I decided to choose zsh after trying it out on a fresh
	125	Manjaro installation. Zsh is great if you like to change the themes of your
	126	terminal, include icons, or add plugins.
	127
	128	The desktop uses the [[https://github.com/zsh-users/zsh-autosuggestions][zsh-autosuggestions]] to suggest past commands as you type.
	129	In addition, it suggests corrections if you misspell a command. Lastly, it uses
	130	the =af-magic= theme, which adds dashed lines between commands, moving the
	131	user@host tag to the right side of the terminal, and changes the colors. There
	132	are plenty of plugins and themes to choose from. Just figure out what you like
	133	and add it to your =~/.zshrc= file!
152	134
153	135	*** Steps to Replicate My Terminal
154	136
		@@ -173,18 +155,20 @@ sudo apt install terminator
173	155	To install Oh My Zsh on Ubuntu:
174	156
175	157	#+begin_src sh
176		sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
	158	sh -c "$(curl -fsSL
	159	https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
177	160	#+end_src
178	161
179	162	To install zsh-autosuggestions via Oh My Zsh:
180	163
181	164	#+begin_src sh
182		git clone https://github.com/zsh-users/zsh-autosuggestions ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-autosuggestions
	165	git clone https://github.com/zsh-users/zsh-autosuggestions
	166	${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-autosuggestions
183	167	#+end_src
184	168
185		Then, add the following plugin wording to your =~/.zshrc= file (the
186		default config usually has the =git= plugin activated, so just add any
187		other plugins to the parentheses separated by a space):
	169	Then, add the following plugin wording to your =~/.zshrc= file (the default
	170	config usually has the =git= plugin activated, so just add any other plugins to
	171	the parentheses separated by a space):
188	172
189	173	#+begin_src sh
190	174	nano ~/.zshrc
		@@ -194,5 +178,5 @@ nano ~/.zshrc
194	178	plugins=(git zsh-autosuggestions)
195	179	#+end_src
196	180
197		Finally, you need to log out of your computer and log back in so your
198		user shell can refresh.
	181	Finally, you need to log out of your computer and log back in so your user shell
	182	can refresh.

content/blog/2020-07-20-video-game-sales.org +18 −21

		@@ -5,10 +5,8 @@
5	5
6	6	* Background Information
7	7
8		This dataset (obtained from
9		[[https://www.kaggle.com/gregorut/videogamesales/data][Kaggle]])
10		contains a list of video games with sales greater than 100,000 copies.
11		It was generated by a scrape of vgchartz.com.
	8	This dataset (obtained from [[https://www.kaggle.com/gregorut/videogamesales/data][Kaggle]]) contains a list of video games with sales
	9	greater than 100,000 copies. It was generated by a scrape of vgchartz.com.
12	10
13	11	Fields include:
14	12
		@@ -24,8 +22,7 @@ Fields include:
24	22	- Other_{Sales}: Sales in the rest of the world (in millions)
25	23	- Global_{Sales}: Total worldwide sales.
26	24
27		There are 16,598 records. 2 records were dropped due to incomplete
28		information.
	25	There are 16,598 records. 2 records were dropped due to incomplete information.
29	26
30	27	* Import the Data
31	28
		@@ -138,18 +135,18 @@ df3.sort_values(by=['Global_Sales'], ascending=False).head(5)
138	135
139	136	* Discussion
140	137
141		The purpose of exploring datasets is to ask questions, answer questions,
142		and discover intelligence that can be used to inform decision-making.
143		So, what have we found in this dataset?
144
145		Today we simply explored a publicly-available dataset to see what kind
146		of information it contained. During that exploration, we found that
147		video game sales peaked in 2006. That peak was largely due to Nintendo,
148		who sold the top 5 games in 2006 and has a number of games in the top-10
149		list for the years 1980-2020. Additionally, the top four platforms by
150		global sales (Wii, NES, GB, DS) are owned by Nintendo.
151
152		We didn't explore everything this dataset has to offer, but we can tell
153		from a brief analysis that Nintendo seems to rule sales in the video
154		gaming world. Further analysis could provide insight into which genres,
155		regions, publishers, or world events are correlated with sales.
	138	The purpose of exploring datasets is to ask questions, answer questions, and
	139	discover intelligence that can be used to inform decision-making. So, what have
	140	we found in this dataset?
	141
	142	Today we simply explored a publicly-available dataset to see what kind of
	143	information it contained. During that exploration, we found that video game
	144	sales peaked in 2006. That peak was largely due to Nintendo, who sold the top 5
	145	games in 2006 and has a number of games in the top-10 list for the years
	146	1980-2020. Additionally, the top four platforms by global sales (Wii, NES, GB,
	147	DS) are owned by Nintendo.
	148
	149	We didn't explore everything this dataset has to offer, but we can tell from a
	150	brief analysis that Nintendo seems to rule sales in the video gaming world.
	151	Further analysis could provide insight into which genres, regions, publishers,
	152	or world events are correlated with sales.

content/blog/2020-07-26-business-analysis.org +57 −62

		@@ -5,9 +5,9 @@
5	5
6	6	* Background Information
7	7
8		This project aims to help investors learn more about a random city in
9		order to determine optimal locations for business investments. The data
10		used in this project was obtained using Foursquare's developer API.
	8	This project aims to help investors learn more about a random city in order to
	9	determine optimal locations for business investments. The data used in this
	10	project was obtained using Foursquare's developer API.
11	11
12	12	Fields include:
13	13
		@@ -16,13 +16,13 @@ Fields include:
16	16	- Venue Latitude
17	17	- Venue Longitude
18	18
19		There are 232 records found using the center of Lincoln as the area of
20		interest with a radius of 10,000.
	19	There are 232 records found using the center of Lincoln as the area of interest
	20	with a radius of 10,000.
21	21
22	22	* Import the Data
23	23
24		The first step is the simplest: import the applicable libraries. We will
25		be using the libraries below for this project.
	24	The first step is the simplest: import the applicable libraries. We will be
	25	using the libraries below for this project.
26	26
27	27	#+begin_src python
28	28	# Import the Python libraries we will be using
		@@ -35,10 +35,10 @@ from pandas.io.json import json_normalize
35	35	from sklearn.cluster import KMeans
36	36	#+end_src
37	37
38		To begin our analysis, we need to import the data for this project. The
39		data we are using in this project comes directly from the Foursquare
40		API. The first step is to get the latitude and longitude of the city
41		being studied (Lincoln, NE) and setting up the folium map.
	38	To begin our analysis, we need to import the data for this project. The data we
	39	are using in this project comes directly from the Foursquare API. The first step
	40	is to get the latitude and longitude of the city being studied (Lincoln, NE) and
	41	setting up the folium map.
42	42
43	43	#+begin_src python
44	44	# Define the latitude and longitude, then map the results
		@@ -49,11 +49,11 @@ map_LNK = folium.Map(location=[latitude, longitude], zoom_start=12)
49	49	map_LNK
50	50	#+end_src
51	51
52		Now that we have defined our city and created the map, we need to go get
53		the business data. The Foursquare API will limit the results to 100 per
54		API call, so we use our first API call below to determine the total
55		results that Foursquare has found. Since the total results are 232, we
56		perform the API fetching process three times (100 + 100 + 32 = 232).
	52	Now that we have defined our city and created the map, we need to go get the
	53	business data. The Foursquare API will limit the results to 100 per API call, so
	54	we use our first API call below to determine the total results that Foursquare
	55	has found. Since the total results are 232, we perform the API fetching process
	56	three times (100 + 100 + 32 = 232).
57	57
58	58	#+begin_src python
59	59	# Foursquare API credentials
		@@ -117,13 +117,12 @@ results3 = requests.get(url3).json()
117	117
118	118	* Clean the Data
119	119
120		Now that we have our data in three separate dataframes, we need to
121		combine them into a single dataframe and make sure to reset the index so
122		that we have a unique ID for each business. The =get~categorytype~=
123		function below will pull the categories and name from each business's
124		entry in the Foursquare data automatically. Once all the data has been
125		labeled and combined, the results are stored in the =nearby_venues=
126		dataframe.
	120	Now that we have our data in three separate dataframes, we need to combine them
	121	into a single dataframe and make sure to reset the index so that we have a
	122	unique ID for each business. The =get~categorytype~= function below will pull
	123	the categories and name from each business's entry in the Foursquare data
	124	automatically. Once all the data has been labeled and combined, the results are
	125	stored in the =nearby_venues= dataframe.
127	126
128	127	#+begin_src python
129	128	# This function will extract the category of the venue from the API dictionary
		@@ -192,9 +191,9 @@ nearby_venues
192	191
193	192	* Visualize the Data
194	193
195		We now have a complete, clean data set. The next step is to visualize
196		this data onto the map we created earlier. We will be using folium's
197		=CircleMarker()= function to do this.
	194	We now have a complete, clean data set. The next step is to visualize this data
	195	onto the map we created earlier. We will be using folium's =CircleMarker()=
	196	function to do this.
198	197
199	198	#+begin_src python
200	199	# add markers to map
		@@ -216,15 +215,14 @@ map_LNK
216	215
217	216	* Clustering: /k-means/
218	217
219		To cluster the data, we will be using the /k-means/ algorithm. This
220		algorithm is iterative and will automatically make sure that data points
221		in each cluster are as close as possible to each other, while being as
222		far as possible away from other clusters.
	218	To cluster the data, we will be using the /k-means/ algorithm. This algorithm is
	219	iterative and will automatically make sure that data points in each cluster are
	220	as close as possible to each other, while being as far as possible away from
	221	other clusters.
223	222
224		However, we first have to figure out how many clusters to use (defined
225		as the variable /'k'/). To do so, we will use the next two functions to
226		calculate the sum of squares within clusters and then return the optimal
227		number of clusters.
	223	However, we first have to figure out how many clusters to use (defined as the
	224	variable /'k'/). To do so, we will use the next two functions to calculate the
	225	sum of squares within clusters and then return the optimal number of clusters.
228	226
229	227	#+begin_src python
230	228	# This function will return the sum of squares found in the data
		@@ -262,9 +260,9 @@ def optimal_number_of_clusters(wcss):
262	260	n = optimal_number_of_clusters(sum_of_squares)
263	261	#+end_src
264	262
265		Now that we have found that our optimal number of clusters is six, we
266		need to perform k-means clustering. When this clustering occurs, each
267		business is assigned a cluster number from 0 to 5 in the dataframe.
	263	Now that we have found that our optimal number of clusters is six, we need to
	264	perform k-means clustering. When this clustering occurs, each business is
	265	assigned a cluster number from 0 to 5 in the dataframe.
268	266
269	267	#+begin_src python
270	268	# set number of clusters equal to the optimal number
		@@ -304,12 +302,11 @@ map_clusters
304	302
305	303	* Investigate Clusters
306	304
307		Now that we have figured out our clusters, let's do a little more
308		analysis to provide more insight into the clusters. With the information
309		below, we can see which clusters are more popular for businesses and
310		which are less popular. The results below show us that clusters 0
311		through 3 are popular, while clusters 4 and 5 are not very popular at
312		all.
	305	Now that we have figured out our clusters, let's do a little more analysis to
	306	provide more insight into the clusters. With the information below, we can see
	307	which clusters are more popular for businesses and which are less popular. The
	308	results below show us that clusters 0 through 3 are popular, while clusters 4
	309	and 5 are not very popular at all.
313	310
314	311	#+begin_src python
315	312	# Show how many venues are in each cluster
		@@ -320,9 +317,9 @@ for x in range(0,6):
320	317	print("---")
321	318	#+end_src
322	319
323		Our last piece of analysis is to summarize the categories of businesses
324		within each cluster. With these results, we can clearly see that
325		restaurants, coffee shops, and grocery stores are the most popular.
	320	Our last piece of analysis is to summarize the categories of businesses within
	321	each cluster. With these results, we can clearly see that restaurants, coffee
	322	shops, and grocery stores are the most popular.
326	323
327	324	#+begin_src python
328	325	# Calculate how many venues there are in each category
		@@ -348,19 +345,17 @@ with pd.option_context('display.max_rows', None, 'display.max_columns', None):
348	345
349	346	* Discussion
350	347
351		In this project, we gathered location data for Lincoln, Nebraska, USA
352		and clustered the data using the k-means algorithm in order to identify
353		the unique clusters of businesses in Lincoln. Through these actions, we
354		found that there are six unique business clusters in Lincoln and that
355		two of the clusters are likely unsuitable for investors. The remaining
356		four clusters have a variety of businesses, but are largely dominated by
357		restaurants and grocery stores.
358
359		Using this project, investors can now make more informed decisions when
360		deciding the location and category of business in which to invest.
361
362		Further studies may involve other attributes for business locations,
363		such as population density, average wealth across the city, or crime
364		rates. In addition, further studies may include additional location data
365		and businesses by utilizing multiple sources, such as Google Maps and
366		OpenStreetMap.
	348	In this project, we gathered location data for Lincoln, Nebraska, USA and
	349	clustered the data using the k-means algorithm in order to identify the unique
	350	clusters of businesses in Lincoln. Through these actions, we found that there
	351	are six unique business clusters in Lincoln and that two of the clusters are
	352	likely unsuitable for investors. The remaining four clusters have a variety of
	353	businesses, but are largely dominated by restaurants and grocery stores.
	354
	355	Using this project, investors can now make more informed decisions when deciding
	356	the location and category of business in which to invest.
	357
	358	Further studies may involve other attributes for business locations, such as
	359	population density, average wealth across the city, or crime rates. In addition,
	360	further studies may include additional location data and businesses by utilizing
	361	multiple sources, such as Google Maps and OpenStreetMap.

content/blog/2020-08-22-redirect-github-pages.org +44 −52

		@@ -7,18 +7,17 @@
7	7
8	8	** Step 1
9	9
10		Add a new file CNAME to your GitHub Pages repository containing only one
11		line: your top-level domain name. E.g.: =example.com=
	10	Add a new file CNAME to your GitHub Pages repository containing only one line:
	11	your top-level domain name. E.g.: =example.com=
12	12
13	13	** Step 2
14	14
15	15	[Optional] but highly recommended
16	16
17		2.1: Remove all other top-level records (prefixed with @) of type A from
18		your DNS configuration.
	17	2.1: Remove all other top-level records (prefixed with @) of type A from your
	18	DNS configuration.
19	19
20		2.2: Remove a CNAME record for the second-level domain www if it is
21		present.
	20	2.2: Remove a CNAME record for the second-level domain www if it is present.
22	21
23	22	** Step 3
24	23
		@@ -41,48 +40,45 @@ immediately. They can take up to a full day to propagate.
41	40
42	41	* Long answer
43	42
44		This issue has two sides. One is the DNS configuration itself. Another
45		one is the way GitHub Pages will forward HTTP requests.
	43	This issue has two sides. One is the DNS configuration itself. Another one is
	44	the way GitHub Pages will forward HTTP requests.
46	45
47		We need to know a few things to understand what GitHub is trying to say
48		in their documentation.
	46	We need to know a few things to understand what GitHub is trying to say in their
	47	documentation.
49	48
50	49	** DNS Entry Types
51	50
52	51	There are two types of DNS records which interest us: CNAME and A.
53	52
54		=A= is also known as =Apex= or sometimes as =root entry=. It forwards
55		requests to a specified fixed IP address. =CNAME= entry forwards
56		requests to a specified URL (actual valid plain text URL, not an IP
57		address).
	53	=A= is also known as =Apex= or sometimes as =root entry=. It forwards requests
	54	to a specified fixed IP address. =CNAME= entry forwards requests to a specified
	55	URL (actual valid plain text URL, not an IP address).
58	56
59	57	** DNS Load balancing
60	58
61		GitHub has one central URL address which accepts all DNS requests for
62		GitHub Pages: =http://username.github.io=. That URL is resolved to
63		different IP addresses based on your geographical location. Website
64		hosted on GitHub Pages is a simple collection of =HTML=, =CSS= and =JS=
65		files. GitHub distributes these files to different servers across the
66		globe. So that when your browser sends a request from Europe, it
67		receives data from a server in Europe. The same is valid for the
68		requests from Asia and the USA.
	59	GitHub has one central URL address which accepts all DNS requests for GitHub
	60	Pages: =http://username.github.io=. That URL is resolved to different IP
	61	addresses based on your geographical location. Website hosted on GitHub Pages is
	62	a simple collection of =HTML=, =CSS= and =JS= files. GitHub distributes these
	63	files to different servers across the globe. So that when your browser sends a
	64	request from Europe, it receives data from a server in Europe. The same is valid
	65	for the requests from Asia and the USA.
69	66
70	67	** What GitHub is trying to say
71	68
72		Since =A= records in DNS must contain IP addresses, and they must be
73		either =185.199.108.153= or =185.199.109.153= or =185.199.110.153= or
74		=185.199.111.153=, there is no way to forward requests to a server
75		located somewhere in Europe or Asia. Your website hosted at GitHub Pages
76		will be downloaded from a central GitHub Pages server. There is a minor
77		risk that if GitHub Pages DNS servers (=x.x.x.153=) are down for some
78		reason, all custom domains which use fixed GitHub Pages IP addresses
79		will not be accessible (their DNS requests will not be resolvable).
80
81		That is why GitHub strongly suggests to either use a second-level domain
82		for your GitHub Pages (e.g. =blog.example.com=) or use a DNS service
83		provider that supports a record type =ALIAS= that acts as =A= record but
84		forwards request to a URL address (e.g. =username.github.io=) instead of
85		a fixed IP address.
	69	Since =A= records in DNS must contain IP addresses, and they must be either
	70	=185.199.108.153= or =185.199.109.153= or =185.199.110.153= or
	71	=185.199.111.153=, there is no way to forward requests to a server located
	72	somewhere in Europe or Asia. Your website hosted at GitHub Pages will be
	73	downloaded from a central GitHub Pages server. There is a minor risk that if
	74	GitHub Pages DNS servers (=x.x.x.153=) are down for some reason, all custom
	75	domains which use fixed GitHub Pages IP addresses will not be accessible (their
	76	DNS requests will not be resolvable).
	77
	78	That is why GitHub strongly suggests to either use a second-level domain for
	79	your GitHub Pages (e.g. =blog.example.com=) or use a DNS service provider that
	80	supports a record type =ALIAS= that acts as =A= record but forwards request to a
	81	URL address (e.g. =username.github.io=) instead of a fixed IP address.
86	82
87	83	** How GitHub Pages treats HTTP requests
88	84
		@@ -101,12 +97,12 @@ curl --header "Host: example.com" http://185.199.108.153/
101	97	This way GitHub Pages servers know which user website to serve.
102	98
103	99	#+begin_quote
104		GitHub Pages server will automatically redirect HTTP requests to the
105		top-level domain if your =CNAME= file contains =example.com= but
106		=www.example.com= is requested.
	100	GitHub Pages server will automatically redirect HTTP requests to the top-level
	101	domain if your =CNAME= file contains =example.com= but =www.example.com= is
	102	requested.
107	103
108		The same is valid if your =CNAME= file contains =www.example.com= but
109		the header =Host= in the =HTTP= request contains =example.com=.
	104	The same is valid if your =CNAME= file contains =www.example.com= but the header
	105	=Host= in the =HTTP= request contains =example.com=.
110	106	#+end_quote
111	107
112	108	** Why can't I add a =CNAME= record entry that accepts a top-level request (=@=) to my DNS configuration?
		@@ -114,18 +110,14 @@ the header =Host= in the =HTTP= request contains =example.com=.
114	110	Quote from the GitHub Pages documentation:
115	111
116	112	#+begin_quote
117		Warning: Do not create a CNAME record for your custom apex domain! Doing
118		so may cause issues with other services, such as email, on that domain.
	113	Warning: Do not create a CNAME record for your custom apex domain! Doing so may
	114	cause issues with other services, such as email, on that domain.
119	115	#+end_quote
120	116
121	117	** References:
122	118
123		1. [[https://docs.github.com/en/github/working-with-github-pages/configuring-a-custom-domain-for-your-github-pages-site][Setting
124		up a custom domain with GitHub Pages]]
125		2. [[https://docs.github.com/en/github/working-with-github-pages/troubleshooting-custom-domains-and-github-pages][My
126		custom domain isn't working]]
127		3. [[https://serverfault.com/questions/589370/cannot-access-my-github-pages-website-by-ip-address][Cannot
128		access my GitHub Pages website by IP Address]]
129		4. [[https://stackoverflow.com/questions/23375422/how-do-i-set-up-github-pages-to-redirect-dns-requests-from-a-subdomain-e-g-www][How
130		do I set up GitHub Pages to redirect DNS requests from a subdomain
131		(e.g. www) to the top-level domain (TLD, Apex record)?]]
	119	1. [[https://docs.github.com/en/github/working-with-github-pages/configuring-a-custom-domain-for-your-github-pages-site][Setting up a custom domain with GitHub Pages]]
	120	2. [[https://docs.github.com/en/github/working-with-github-pages/troubleshooting-custom-domains-and-github-pages][My custom domain isn't working]]
	121	3. [[https://serverfault.com/questions/589370/cannot-access-my-github-pages-website-by-ip-address][Cannot access my GitHub Pages website by IP Address]]
	122	4. [[https://stackoverflow.com/questions/23375422/how-do-i-set-up-github-pages-to-redirect-dns-requests-from-a-subdomain-e-g-www][How do I set up GitHub Pages to redirect DNS requests from a subdomain (e.g.
	123	www) to the top-level domain (TLD, Apex record)?]]

content/blog/2020-08-29-php-auth-flow.org +40 −47

		@@ -5,16 +5,15 @@
5	5
6	6	* Introduction
7	7
8		When creating websites that will allow users to create accounts, the
9		developer always needs to consider the proper authentication flow for
10		their app. For example, some developers will utilize an API for
11		authentication, some will use OAuth, and some may just use their own
12		simple database.
	8	When creating websites that will allow users to create accounts, the developer
	9	always needs to consider the proper authentication flow for their app. For
	10	example, some developers will utilize an API for authentication, some will use
	11	OAuth, and some may just use their own simple database.
13	12
14		For those using pre-built libraries, authentication may simply be a
15		problem of copying and pasting the code from their library's
16		documentation. For example, here's the code I use to authenticate users
17		with the Tumblr OAuth API for my Tumblr client, Vox Populi:
	13	For those using pre-built libraries, authentication may simply be a problem of
	14	copying and pasting the code from their library's documentation. For example,
	15	here's the code I use to authenticate users with the Tumblr OAuth API for my
	16	Tumblr client, Vox Populi:
18	17
19	18	#+begin_src php
20	19	// Start the session
		@@ -39,24 +38,23 @@ $client = new Tumblr\API\Client(
39	38	);
40	39	#+end_src
41	40
42		However, developers creating authentication flows from scratch will need
43		to think carefully about when to make sure a web page will check the
44		user's authenticity.
	41	However, developers creating authentication flows from scratch will need to
	42	think carefully about when to make sure a web page will check the user's
	43	authenticity.
45	44
46		In this article, we're going to look at a simple authentication flow
47		using a MySQL database and PHP.
	45	In this article, we're going to look at a simple authentication flow using a
	46	MySQL database and PHP.
48	47
49	48	* Creating User Accounts
50	49
51		The beginning to any type of user authentication is to create a user
52		account. This process can take many formats, but the simplest is to
53		accept user input from a form (e.g., username and password) and send it
54		over to your database. For example, here's a snippet that shows how to
55		get username and password parameters that would come when a user submits
56		a form to your PHP script.
	50	The beginning to any type of user authentication is to create a user account.
	51	This process can take many formats, but the simplest is to accept user input
	52	from a form (e.g., username and password) and send it over to your database. For
	53	example, here's a snippet that shows how to get username and password parameters
	54	that would come when a user submits a form to your PHP script.
57	55
58		Note: Ensure that your password column is large enough to hold the
59		hashed value (at least 60 characters or longer).
	56	Note: Ensure that your password column is large enough to hold the hashed
	57	value (at least 60 characters or longer).
60	58
61	59	#+begin_src php
62	60	// Get the values from the URL
		@@ -95,9 +93,9 @@ $conn->close();
95	93
96	94	** Validate Returning Users
97	95
98		To be able to verify that a returning user has a valid username and
99		password in your database is as simple as having users fill out a form
100		and comparing their inputs to your database.
	96	To be able to verify that a returning user has a valid username and password in
	97	your database is as simple as having users fill out a form and comparing their
	98	inputs to your database.
101	99
102	100	#+begin_src php
103	101	// Query the database for username and password
		@@ -114,24 +112,23 @@ if(password_verify($password_input, $hashed_password)) {
114	112
115	113	* Storing Authentication State
116	114
117		Once you've created the user's account, now you're ready to initialize
118		the user's session. *You will need to do this on every page you load
119		while the user is logged in.* To do so, simply enter the following code
120		snippet:
	115	Once you've created the user's account, now you're ready to initialize the
	116	user's session. *You will need to do this on every page you load while the user
	117	is logged in.* To do so, simply enter the following code snippet:
121	118
122	119	#+begin_src php
123	120	session_start();
124	121	#+end_src
125	122
126		Once you've initialized the session, the next step is to store the
127		session in a cookie so that you can access it later.
	123	Once you've initialized the session, the next step is to store the session in a
	124	cookie so that you can access it later.
128	125
129	126	#+begin_src php
130	127	setcookie(session_name());
131	128	#+end_src
132	129
133		Now that the session name has been stored, you'll be able to check if
134		there's an active session whenever you load a page.
	130	Now that the session name has been stored, you'll be able to check if there's an
	131	active session whenever you load a page.
135	132
136	133	#+begin_src php
137	134	if(isset(session_name())) {
		@@ -141,9 +138,9 @@ if(isset(session_name())) {
141	138
142	139	** Removing User Authentication
143	140
144		The next logical step is to give your users the option to log out once
145		they are done using your application. This can be tricky in PHP since a
146		few of the standard ways do not always work.
	141	The next logical step is to give your users the option to log out once they are
	142	done using your application. This can be tricky in PHP since a few of the
	143	standard ways do not always work.
147	144
148	145	#+begin_src php
149	146	// Initialize the session.
		@@ -181,14 +178,10 @@ die();
181	178
182	179	* Wrapping Up
183	180
184		Now you should be ready to begin your authentication programming with
185		PHP. You can create user accounts, create sessions for users across
186		different pages of your site, and then destroy the user data when
187		they're ready to leave.
188
189		For more information on this subject, I recommend reading the
190		[[https://www.php.net/][PHP Documentation]]. Specifically, you may want
191		to look at [[https://www.php.net/manual/en/features.http-auth.php][HTTP
192		Authentication with PHP]],
193		[[https://www.php.net/manual/en/book.session.php][session handling]],
194		and [[https://www.php.net/manual/en/function.hash.php][hash]].
	181	Now you should be ready to begin your authentication programming with PHP. You
	182	can create user accounts, create sessions for users across different pages of
	183	your site, and then destroy the user data when they're ready to leave.
	184
	185	For more information on this subject, I recommend reading the [[https://www.php.net/][PHP Documentation]].
	186	Specifically, you may want to look at [[https://www.php.net/manual/en/features.http-auth.php][HTTP Authentication with PHP]], [[https://www.php.net/manual/en/book.session.php][session
	187	handling]], and [[https://www.php.net/manual/en/function.hash.php][hash]].

content/blog/2020-09-01-visual-recognition.org +60 −71

		@@ -5,38 +5,31 @@
5	5
6	6	* What is IBM Watson?
7	7
8		If you've never heard of [[https://www.ibm.com/watson][Watson]], this
9		service is a suite of enterprise-ready AI services, applications, and
10		tooling provided by IBM. Watson contains quite a few useful tools for
11		data scientists and students, including the subject of this post today:
12		visual recognition.
	8	If you've never heard of [[https://www.ibm.com/watson][Watson]], this service is a suite of enterprise-ready AI
	9	services, applications, and tooling provided by IBM. Watson contains quite a few
	10	useful tools for data scientists and students, including the subject of this
	11	post today: visual recognition.
13	12
14		If you'd like to view the official documentation for the Visual
15		Recognition API, visit the
16		[[https://cloud.ibm.com/apidocs/visual-recognition/visual-recognition-v3?code=python][API
17		Docs]].
	13	If you'd like to view the official documentation for the Visual Recognition API,
	14	visit the [[https://cloud.ibm.com/apidocs/visual-recognition/visual-recognition-v3?code=python][API Docs]].
18	15
19	16	* Prerequisites
20	17
21	18	To be able to use Watson Visual Recognition, you'll need the following:
22	19
23		1. Create a free account on
24		[[https://www.ibm.com/cloud/watson-studio][IBM Watson Studio]].
25		2. Add the [[https://www.ibm.com/cloud/watson-visual-recognition][Watson
26		Visual Recognition]] service to your IBM Watson account.
27		3. Get your API key and URL. To do this, first go to the
28		[[https://dataplatform.cloud.ibm.com/home2?context=cpdaas][profile
29		dashboard]] for your IBM account and click on the Watson Visual
30		Recognition service you created. This will be listed in the section
31		titled Your services. Then click the Credentials tab and open the
32		Auto-generated credentials dropdown. Copy your API key and URL so
33		that you can use them in the Python script later.
34		4. [Optional] While not required, you can also create the Jupyter
35		Notebook for this project right inside
36		[[https://www.ibm.com/cloud/watson-studio][Watson Studio]]. Watson
37		Studio will save your notebooks inside an organized project and allow
38		you to use their other integrated products, such as storage
39		containers, AI models, documentation, external sharing, etc.
	20	1. Create a free account on [[https://www.ibm.com/cloud/watson-studio][IBM Watson Studio]].
	21	2. Add the [[https://www.ibm.com/cloud/watson-visual-recognition][Watson Visual Recognition]] service to your IBM Watson account.
	22	3. Get your API key and URL. To do this, first go to the [[https://dataplatform.cloud.ibm.com/home2?context=cpdaas][profile dashboard]] for
	23	your IBM account and click on the Watson Visual Recognition service you
	24	created. This will be listed in the section titled Your services. Then
	25	click the Credentials tab and open the Auto-generated credentials
	26	dropdown. Copy your API key and URL so that you can use them in the Python
	27	script later.
	28	4. [Optional] While not required, you can also create the Jupyter Notebook for
	29	this project right inside [[https://www.ibm.com/cloud/watson-studio][Watson Studio]]. Watson Studio will save your
	30	notebooks inside an organized project and allow you to use their other
	31	integrated products, such as storage containers, AI models, documentation,
	32	external sharing, etc.
40	33
41	34	* Calling the IBM Watson Visual Recognition API
42	35
		@@ -48,8 +41,8 @@ To begin, we need to install the proper Python package for IBM Watson.
48	41	pip install --upgrade --user "ibm-watson>=4.5.0"
49	42	#+end_src
50	43
51		Next, we need to specify the API key, version, and URL given to us when
52		we created the Watson Visual Recognition service.
	44	Next, we need to specify the API key, version, and URL given to us when we
	45	created the Watson Visual Recognition service.
53	46
54	47	#+begin_src python
55	48	apikey = "<your-apikey>"
		@@ -73,15 +66,15 @@ visual_recognition = VisualRecognitionV3(
73	66	visual_recognition.set_service_url(url)
74	67	#+end_src
75	68
76		[Optional] If you'd like to tell the API not to use any data to
77		improve their products, set the following header.
	69	[Optional] If you'd like to tell the API not to use any data to improve their
	70	products, set the following header.
78	71
79	72	#+begin_src python
80	73	visual_recognition.set_default_headers({'x-watson-learning-opt-out': "true"})
81	74	#+end_src
82	75
83		Now we have our API all set and ready to go. For this example, I'm going
84		to include a =dict= of photos to load as we test out the API.
	76	Now we have our API all set and ready to go. For this example, I'm going to
	77	include a =dict= of photos to load as we test out the API.
85	78
86	79	#+begin_src python
87	80	data = [
		@@ -112,14 +105,14 @@ data = [
112	105	]
113	106	#+end_src
114	107
115		Now that we've set up our libraries and have the photos ready, let's
116		create a loop to call the API for each image. The code below shows a
117		loop that calls the URL of each image and sends it to the API,
118		requesting results with at least 60% confidence. The results are output
119		to the console with dotted lines separating each section.
	108	Now that we've set up our libraries and have the photos ready, let's create a
	109	loop to call the API for each image. The code below shows a loop that calls the
	110	URL of each image and sends it to the API, requesting results with at least 60%
	111	confidence. The results are output to the console with dotted lines separating
	112	each section.
120	113
121		In the case of an API error, the codes and explanations are output to
122		the console.
	114	In the case of an API error, the codes and explanations are output to the
	115	console.
123	116
124	117	#+begin_src python
125	118	from ibm_watson import ApiException
		@@ -146,23 +139,22 @@ except ApiException as ex:
146	139
147	140	* The Results
148	141
149		Here we can see the full result set of our function above. If you view
150		each of the URLs that we sent to the API, you'll be able to see that it
151		was remarkably accurate. To be fair, these are clear high-resolution,
152		clear photos shot with a professional camera. In reality, you will most
153		likely be processing images that are lower quality and may have a lot of
154		noise in the photo.
	142	Here we can see the full result set of our function above. If you view each of
	143	the URLs that we sent to the API, you'll be able to see that it was remarkably
	144	accurate. To be fair, these are clear high-resolution, clear photos shot with a
	145	professional camera. In reality, you will most likely be processing images that
	146	are lower quality and may have a lot of noise in the photo.
155	147
156		However, we can clearly see the benefit of being able to call this API
157		instead of attempting to write our own image recognition function. Each
158		of the classifications returned was a fair description of the image.
	148	However, we can clearly see the benefit of being able to call this API instead
	149	of attempting to write our own image recognition function. Each of the
	150	classifications returned was a fair description of the image.
159	151
160		If you wanted to restrict the results to those that are at least 90%
161		confident or greater, you would simply adjust the =threshold= in the
	152	If you wanted to restrict the results to those that are at least 90% confident
	153	or greater, you would simply adjust the =threshold= in the
162	154	=visual_recognition.classify()= function.
163	155
164		When your program runs, it should show the output below for each photo
165		you provide.
	156	When your program runs, it should show the output below for each photo you
	157	provide.
166	158
167	159	#+begin_src txt
168	160	----------------------------------------------------------------
		@@ -181,22 +173,19 @@ greenishness color ( 0.975 )
181	173
182	174	* Discussion
183	175
184		Now, this was a very minimal implementation of the API. We simply
185		supplied some images and looked to see how accurate the results were.
186		However, you could implement this type of API into many machine learning
187		(ML) models.
188
189		For example, you could be working for a company that scans their
190		warehouses or inventory using drones. Would you want to pay employees to
191		sit there and watch drone footage all day in order to identify or count
192		things in the video? Probably not. Instead, you could use a
193		classification system similar to this one in order to train your machine
194		learning model to correctly identify items that the drones show through
195		video. More specifically, you could have your machine learning model
196		watch a drone fly over a field of sheep in order to count how many sheep
197		are living in that field.
198
199		There are many ways to implement machine learning functionality, but
200		hopefully this post helped inspire some deeper thought about the tools
201		that can help propel us further into the future of machine learning and
202		AI.
	176	Now, this was a very minimal implementation of the API. We simply supplied some
	177	images and looked to see how accurate the results were. However, you could
	178	implement this type of API into many machine learning (ML) models.
	179
	180	For example, you could be working for a company that scans their warehouses or
	181	inventory using drones. Would you want to pay employees to sit there and watch
	182	drone footage all day in order to identify or count things in the video?
	183	Probably not. Instead, you could use a classification system similar to this one
	184	in order to train your machine learning model to correctly identify items that
	185	the drones show through video. More specifically, you could have your machine
	186	learning model watch a drone fly over a field of sheep in order to count how
	187	many sheep are living in that field.
	188
	189	There are many ways to implement machine learning functionality, but hopefully
	190	this post helped inspire some deeper thought about the tools that can help
	191	propel us further into the future of machine learning and AI.

content/blog/2020-09-22-internal-audit.org +161 −176

		@@ -5,69 +5,67 @@
5	5
6	6	* Definitions
7	7
8		One of the many reasons that Internal Audit needs such thorough
9		explaining to non-auditors is that Internal Audit can serve many
10		purposes, depending on the organization's size and needs. However, the
11		Institute of Internal Auditors (IIA) defines Internal Auditing as:
	8	One of the many reasons that Internal Audit needs such thorough explaining to
	9	non-auditors is that Internal Audit can serve many purposes, depending on the
	10	organization's size and needs. However, the Institute of Internal Auditors (IIA)
	11	defines Internal Auditing as:
12	12
13	13	#+begin_quote
14		Internal auditing is an independent, objective assurance and consulting
15		activity designed to add value and improve an organization's operations.
16		It helps an organization accomplish its objectives by bringing a
17		systematic, disciplined approach to evaluate and improve the
18		effectiveness of risk management, control, and governance processes.
	14	Internal auditing is an independent, objective assurance and consulting activity
	15	designed to add value and improve an organization's operations. It helps an
	16	organization accomplish its objectives by bringing a systematic, disciplined
	17	approach to evaluate and improve the effectiveness of risk management, control,
	18	and governance processes.
19	19	#+end_quote
20	20
21		However, this definition uses quite a few terms that aren't clear unless
22		the reader already has a solid understanding of the auditing profession.
23		To further explain, the following is a list of definitions that can help
24		supplement understanding of internal auditing.
	21	However, this definition uses quite a few terms that aren't clear unless the
	22	reader already has a solid understanding of the auditing profession. To further
	23	explain, the following is a list of definitions that can help supplement
	24	understanding of internal auditing.
25	25
26	26	** Independent
27	27
28		Independence is the freedom from conditions that threaten the ability of
29		the internal audit activity to carry out internal audit responsibilities
30		in an unbiased manner. To achieve the degree of independence necessary
31		to effectively carry out the responsibilities of the internal audit
32		activity, the chief audit executive has direct and unrestricted access
33		to senior management and the board. This can be achieved through a
34		dual-reporting relationship. Threats to independence must be managed at
35		the individual auditor, engagement, functional, and organizational
36		levels.
	28	Independence is the freedom from conditions that threaten the ability of the
	29	internal audit activity to carry out internal audit responsibilities in an
	30	unbiased manner. To achieve the degree of independence necessary to effectively
	31	carry out the responsibilities of the internal audit activity, the chief audit
	32	executive has direct and unrestricted access to senior management and the board.
	33	This can be achieved through a dual-reporting relationship. Threats to
	34	independence must be managed at the individual auditor, engagement, functional,
	35	and organizational levels.
37	36
38	37	** Objective
39	38
40		Objectivity is an unbiased mental attitude that allows internal auditors
41		to perform engagements in such a manner that they believe in their work
42		product and that no quality compromises are made. Objectivity requires
43		that internal auditors do not subordinate their judgment on audit
44		matters to others. Threats to objectivity must be managed at the
45		individual auditor, engagement, functional, and organizational levels.
	39	Objectivity is an unbiased mental attitude that allows internal auditors to
	40	perform engagements in such a manner that they believe in their work product and
	41	that no quality compromises are made. Objectivity requires that internal
	42	auditors do not subordinate their judgment on audit matters to others. Threats
	43	to objectivity must be managed at the individual auditor, engagement,
	44	functional, and organizational levels.
46	45
47	46	** Assurance
48	47
49		Assurance services involve the internal auditor's objective assessment
50		of evidence to provide opinions or conclusions regarding an entity,
51		operation, function, process, system, or other subject matters. The
52		internal auditor determines the nature and scope of an assurance
53		engagement. Generally, three parties are participants in assurance
54		services: (1) the person or group directly involved with the entity,
55		operation, function, process, system, or other subject
	48	Assurance services involve the internal auditor's objective assessment of
	49	evidence to provide opinions or conclusions regarding an entity, operation,
	50	function, process, system, or other subject matters. The internal auditor
	51	determines the nature and scope of an assurance engagement. Generally, three
	52	parties are participants in assurance services: (1) the person or group directly
	53	involved with the entity, operation, function, process, system, or other subject
56	54
57		- (the process owner), (2) the person or group making the assessment -
58		(the internal auditor), and (3) the person or group using the
59		assessment - (the user).
	55	- (the process owner), (2) the person or group making the assessment - (the
	56	internal auditor), and (3) the person or group using the assessment - (the
	57	user).
60	58
61	59	** Consulting
62	60
63		Consulting services are advisory in nature and are generally performed
64		at the specific request of an engagement client. The nature and scope of
65		the consulting engagement are subject to agreement with the engagement
66		client. Consulting services generally involve two parties: (1) the
67		person or group offering the advice (the internal auditor), and (2) the
68		person or group seeking and receiving the advice (the engagement
69		client). When performing consulting services, the internal auditor
70		should maintain objectivity and not assume management responsibility.
	61	Consulting services are advisory in nature and are generally performed at the
	62	specific request of an engagement client. The nature and scope of the consulting
	63	engagement are subject to agreement with the engagement client. Consulting
	64	services generally involve two parties: (1) the person or group offering the
	65	advice (the internal auditor), and (2) the person or group seeking and receiving
	66	the advice (the engagement client). When performing consulting services, the
	67	internal auditor should maintain objectivity and not assume management
	68	responsibility.
71	69
72	70	** Governance, Risk Management, & Compliance (GRC)
73	71
		@@ -77,172 +75,159 @@ reliably achieve objectives, address uncertainty and act with integrity.
77	75	* Audit Charter & Standards
78	76
79	77	First, it's important to note that not every organization needs internal
80		auditors. In fact, it's unwise for an organization to hire internal
81		auditors unless they have regulatory requirements for auditing and have
82		the capital to support the department. Internal audit is a cost center
83		that can only affect revenue indirectly.
84
85		Once an organization determines the need for internal assurance
86		services, they will hire a Chief Audit Executive and create the audit
87		charter. This charter is a document, approved by the company's governing
88		body, that will define internal audit's purpose, authority,
89		responsibility, and position within the organization. Fortunately, the
90		IIA has model charters available to IIA members for those developing or
91		improving their charter.
92
93		Beyond the charter and organizational documents, internal auditors
94		follow a few different standards in order to perform their job. First is
95		the International Professional Practices Framework (IPPF) by the IIA,
96		which is the model of standards for internal auditing. In addition,
97		ISACA's Information Technology Assurance Framework (ITAF) helps guide
98		auditors in reference to information technology (IT) compliance and
99		assurance. Finally, additional standards such as FASB, GAAP, and
100		industry-specific standards are used when performing internal audit
101		work.
	78	auditors. In fact, it's unwise for an organization to hire internal auditors
	79	unless they have regulatory requirements for auditing and have the capital to
	80	support the department. Internal audit is a cost center that can only affect
	81	revenue indirectly.
	82
	83	Once an organization determines the need for internal assurance services, they
	84	will hire a Chief Audit Executive and create the audit charter. This charter is
	85	a document, approved by the company's governing body, that will define internal
	86	audit's purpose, authority, responsibility, and position within the
	87	organization. Fortunately, the IIA has model charters available to IIA members
	88	for those developing or improving their charter.
	89
	90	Beyond the charter and organizational documents, internal auditors follow a few
	91	different standards in order to perform their job. First is the International
	92	Professional Practices Framework (IPPF) by the IIA, which is the model of
	93	standards for internal auditing. In addition, ISACA's Information Technology
	94	Assurance Framework (ITAF) helps guide auditors in reference to information
	95	technology (IT) compliance and assurance. Finally, additional standards such as
	96	FASB, GAAP, and industry-specific standards are used when performing internal
	97	audit work.
102	98
103	99	* Three Lines of Defense
104	100
105		[[https://theiia.org][The IIA]] released the original Three Lines of
106		Defense model in 2013, but have released an updated version in 2020.
	101	[[https://theiia.org][The IIA]] released the original Three Lines of Defense model in 2013, but have
	102	released an updated version in 2020.
107	103
108		I won't go into depth about the changes made to the model in this
109		article. Instead, let's take a look at the most current model.
	104	I won't go into depth about the changes made to the model in this article.
	105	Instead, let's take a look at the most current model.
110	106
111	107	The updated model forgets the strict idea of areas performing their own
112		functions or line of defense. Instead of talking about management, risk,
113		and internal audit as 1-2-3, the new model creates a more fluid and
114		cooperative model.
115
116		Looking at this model from an auditing perspective shows us that
117		auditors will need to align, communicate, and collaborate with
118		management, including business area managers and chief officers, as well
119		as reporting to the governing body. The governing body will instruct
120		internal audit /functionally/ on their goals and track their progress
121		periodically.
122
123		However, the internal audit department will report /administratively/ to
124		a chief officer in the company for the purposes of collaboration,
125		direction, and assistance with the business. Note that in most
126		situations, the governing body is the audit committee on the company's
127		board of directors.
128
129		The result of this structure is that internal audit is an independent
130		and objective function that can provide assurance over the topics they
131		audit.
	108	functions or line of defense. Instead of talking about management, risk, and
	109	internal audit as 1-2-3, the new model creates a more fluid and cooperative
	110	model.
	111
	112	Looking at this model from an auditing perspective shows us that auditors will
	113	need to align, communicate, and collaborate with management, including business
	114	area managers and chief officers, as well as reporting to the governing body.
	115	The governing body will instruct internal audit /functionally/ on their goals
	116	and track their progress periodically.
	117
	118	However, the internal audit department will report /administratively/ to a chief
	119	officer in the company for the purposes of collaboration, direction, and
	120	assistance with the business. Note that in most situations, the governing body
	121	is the audit committee on the company's board of directors.
	122
	123	The result of this structure is that internal audit is an independent and
	124	objective function that can provide assurance over the topics they audit.
132	125
133	126	* Audit Process
134	127
135		A normal audit will generally follow the same process, regardless of the
136		topic. However, certain special projects or abnormal business areas may
137		call for changes to the audit process. The audit process is not set in
138		stone, it's simply a set of best practices so that audits can be
139		performed consistently.
	128	A normal audit will generally follow the same process, regardless of the topic.
	129	However, certain special projects or abnormal business areas may call for
	130	changes to the audit process. The audit process is not set in stone, it's simply
	131	a set of best practices so that audits can be performed consistently.
140	132
141		While different organizations may tweak the process, it will generally
142		follow this flow:
	133	While different organizations may tweak the process, it will generally follow
	134	this flow:
143	135
144	136	** 1. Risk Assessment
145	137
146	138	The risk assessment part of the process has historically been performed
147		annually, but many organizations have moved to performing this process
148		much more frequently. In fact, some organizations are moving to an agile
149		approach that can take new risks into the risk assessment and
150		re-prioritize risk areas on-the-go. To perform a risk assessment,
151		leaders in internal audit will research industry risks, consult with
152		business leaders around the company, and perform analyses on company
153		data.
	139	annually, but many organizations have moved to performing this process much more
	140	frequently. In fact, some organizations are moving to an agile approach that can
	141	take new risks into the risk assessment and re-prioritize risk areas on-the-go.
	142	To perform a risk assessment, leaders in internal audit will research industry
	143	risks, consult with business leaders around the company, and perform analyses on
	144	company data.
154	145
155	146	Once a risk assessment has been documented, the audit department has a
156		prioritized list of risks that can be audited. This is usually in the
157		form of auditable entities, such as business areas or departments.
	147	prioritized list of risks that can be audited. This is usually in the form of
	148	auditable entities, such as business areas or departments.
158	149
159	150	** 2. Planning
160	151
161		During the planning phase of an audit, auditors will meet with the
162		business area to discuss the various processes, controls, and risks
163		applicable to the business. This helps the auditors determine the scope
164		limits for the audit, as well as timing and subject-matter experts.
165		Certain documents will be created in this phase that will be used to
166		keep the audit on-track an in-scope as it goes forward.
	152	During the planning phase of an audit, auditors will meet with the business area
	153	to discuss the various processes, controls, and risks applicable to the
	154	business. This helps the auditors determine the scope limits for the audit, as
	155	well as timing and subject-matter experts. Certain documents will be created in
	156	this phase that will be used to keep the audit on-track an in-scope as it goes
	157	forward.
167	158
168	159	** 3. Testing
169	160
170		The testing phase, also known as fieldwork or execution, is where
171		internal auditors will take the information they've discovered and test
172		it against regulations, industry standards, company rules, best
173		practices, as well as validating that any processes are complete and
174		accurate. For example, an audit of HR would most likely examine
175		processes such as employee on-boarding, employee termination, security
176		of personally identifiable information (PII), or the IT systems involved
177		in these processes. Company standards would be examined and compared
178		against how the processes are actually being performed day-to-day, as
179		well as compared against regulations such as the Equal Employment
180		Opportunity (EEO), American with Disabilities Act, and National Labor
181		Relations Act.
	161	The testing phase, also known as fieldwork or execution, is where internal
	162	auditors will take the information they've discovered and test it against
	163	regulations, industry standards, company rules, best practices, as well as
	164	validating that any processes are complete and accurate. For example, an audit
	165	of HR would most likely examine processes such as employee on-boarding, employee
	166	termination, security of personally identifiable information (PII), or the IT
	167	systems involved in these processes. Company standards would be examined and
	168	compared against how the processes are actually being performed day-to-day, as
	169	well as compared against regulations such as the Equal Employment Opportunity
	170	(EEO), American with Disabilities Act, and National Labor Relations Act.
182	171
183	172	** 4. Reporting
184	173
185		Once all the tests have been completed, the audit will enter the
186		reporting phase. This is when the audit team will conclude on the
187		evidence they've collected, interviews they've held, and any opinions
188		they've formed on the controls in place. A summary of the audit
189		findings, conclusions, and specific recommendations are officially
190		communicated to the client through a draft report. Clients have the
191		opportunity to respond to the report and submit an action plan and time
192		frame. These responses become part of the final report which is
193		distributed to the appropriate level of administration.
	174	Once all the tests have been completed, the audit will enter the reporting
	175	phase. This is when the audit team will conclude on the evidence they've
	176	collected, interviews they've held, and any opinions they've formed on the
	177	controls in place. A summary of the audit findings, conclusions, and specific
	178	recommendations are officially communicated to the client through a draft
	179	report. Clients have the opportunity to respond to the report and submit an
	180	action plan and time frame. These responses become part of the final report
	181	which is distributed to the appropriate level of administration.
194	182
195	183	** 5. Follow-Up
196	184
197		After audits have been completed and management has formed action plans
198		and time frames for audit issues, internal audit will follow up once
199		that due date has arrived. In most cases, the follow-up will simply
200		consist of a meeting to discuss how the action plan has been completed
201		and to request documentation to prove it.
	185	After audits have been completed and management has formed action plans and time
	186	frames for audit issues, internal audit will follow up once that due date has
	187	arrived. In most cases, the follow-up will simply consist of a meeting to
	188	discuss how the action plan has been completed and to request documentation to
	189	prove it.
202	190
203	191	* Audit Department Structure
204	192
205	193	While an internal audit department is most often thought of as a team of
206	194	full-time employees, there are actually many different ways in which a
207		department can be structured. As the world becomes more digital and
208		fast-paced, outsourcing has become a more attractive option for some
209		organizations. Internal audit can be fully outsourced or partially
210		outsourced, allowing for flexibility in cases where turnover is high.
211
212		In addition, departments can implement a rotational model. This allows
213		for interested employees around the organization to rotate into the
214		internal audit department for a period of time, allowing them to obtain
215		knowledge of risks and controls and allowing the internal audit team to
216		obtain more business area knowledge. This program is popular in very
217		large organizations, but organizations tend to rotate lower-level audit
218		staff instead of managers. This helps prevent any significant knowledge
219		loss as auditors rotate out to business areas.
	195	department can be structured. As the world becomes more digital and fast-paced,
	196	outsourcing has become a more attractive option for some organizations. Internal
	197	audit can be fully outsourced or partially outsourced, allowing for flexibility
	198	in cases where turnover is high.
	199
	200	In addition, departments can implement a rotational model. This allows for
	201	interested employees around the organization to rotate into the internal audit
	202	department for a period of time, allowing them to obtain knowledge of risks and
	203	controls and allowing the internal audit team to obtain more business area
	204	knowledge. This program is popular in very large organizations, but
	205	organizations tend to rotate lower-level audit staff instead of managers. This
	206	helps prevent any significant knowledge loss as auditors rotate out to business
	207	areas.
220	208
221	209	* Consulting
222	210
223		Consulting is not an easy task at any organization, especially for a
224		department that can have negative perceptions within the organization as
225		the "compliance police." However, once an internal audit department has
226		delivered value to organization, adding consulting to their suite of
227		services is a smart move. In most cases, Internal Audit can insert
228		themselves into a consulting role without affecting the process of
229		project management at the company. This means that internal audit can
230		add objective assurance and opinions to business areas as they develop
231		new processes, instead of coming in periodically to audit an area and
232		file issues that could have been fixed at the beginning.
	211	Consulting is not an easy task at any organization, especially for a department
	212	that can have negative perceptions within the organization as the "compliance
	213	police." However, once an internal audit department has delivered value to
	214	organization, adding consulting to their suite of services is a smart move. In
	215	most cases, Internal Audit can insert themselves into a consulting role without
	216	affecting the process of project management at the company. This means that
	217	internal audit can add objective assurance and opinions to business areas as
	218	they develop new processes, instead of coming in periodically to audit an area
	219	and file issues that could have been fixed at the beginning.
233	220
234	221	* Data Science & Data Analytics
235	222
236		One major piece of the internal audit function in the modern world is
237		data science. While the process is data science, most auditors will
238		refer to anything in this realm as data analytics. Hot topics such as
239		robotic process automation (RPA), machine learning (ML), and data mining
240		have taken over the auditing world in recent years. These technologies
241		have been immensely helpful with increasing the effectiveness and
242		efficiency of auditors.
243
244		For example, mundane and repetitive tasks can be automated in order for
245		auditors to make more room in their schedules for labor-intensive work.
246		Further, auditors will need to adapt technologies like machine learning
247		in order to extract more value from the data they're using to form
248		conclusions.
	223	One major piece of the internal audit function in the modern world is data
	224	science. While the process is data science, most auditors will refer to anything
	225	in this realm as data analytics. Hot topics such as robotic process automation
	226	(RPA), machine learning (ML), and data mining have taken over the auditing world
	227	in recent years. These technologies have been immensely helpful with increasing
	228	the effectiveness and efficiency of auditors.
	229
	230	For example, mundane and repetitive tasks can be automated in order for auditors
	231	to make more room in their schedules for labor-intensive work. Further, auditors
	232	will need to adapt technologies like machine learning in order to extract more
	233	value from the data they're using to form conclusions.

content/blog/2020-09-25-happiness-map.org +32 −37

		@@ -5,10 +5,9 @@
5	5
6	6	* Background Information
7	7
8		The dataset (obtained from
9		[[https://www.kaggle.com/unsdsn/world-happiness][Kaggle]]) used in this
10		article contains a list of countries around the world, their happiness
11		rankings and scores, as well as other national scoring measures.
	8	The dataset (obtained from [[https://www.kaggle.com/unsdsn/world-happiness][Kaggle]]) used in this article contains a list of
	9	countries around the world, their happiness rankings and scores, as well as
	10	other national scoring measures.
12	11
13	12	Fields include:
14	13
		@@ -21,8 +20,8 @@ Fields include:
21	20	- Generosity
22	21	- Perceptions of corruption
23	22
24		There are 156 records. Since there are ~195 countries in the world, we
25		can see that around 40 countries will be missing from this dataset.
	23	There are 156 records. Since there are ~195 countries in the world, we can see
	24	that around 40 countries will be missing from this dataset.
26	25
27	26	* Install Packages
28	27
		@@ -35,9 +34,8 @@ analysis.
35	34
36	35	* Import the Data
37	36
38		We only need a couple packages to create a choropleth map. We will use
39		[[https://python-visualization.github.io/folium/][Folium]], which
40		provides map visualizations in Python. We will also use geopandas and
	37	We only need a couple packages to create a choropleth map. We will use [[https://python-visualization.github.io/folium/][Folium]],
	38	which provides map visualizations in Python. We will also use geopandas and
41	39	pandas to wrangle our data before we put it on a map.
42	40
43	41	#+begin_src python
		@@ -47,14 +45,14 @@ import geopandas as gpd
47	45	import pandas as pd
48	46	#+end_src
49	47
50		To get anything to show up on a map, we need a file that will specify
51		the boundaries of each country. Luckily, GeoJSON files exist (for free!)
52		on the internet. To get the boundaries of every country in the world, we
53		will use the GeoJSON link shown below.
	48	To get anything to show up on a map, we need a file that will specify the
	49	boundaries of each country. Luckily, GeoJSON files exist (for free!) on the
	50	internet. To get the boundaries of every country in the world, we will use the
	51	GeoJSON link shown below.
54	52
55		GeoPandas will take this data and load it into a dataframe so that we
56		can easily match it to the data we're trying to analyze. Let's look at
57		the GeoJSON dataframe:
	53	GeoPandas will take this data and load it into a dataframe so that we can easily
	54	match it to the data we're trying to analyze. Let's look at the GeoJSON
	55	dataframe:
58	56
59	57	#+begin_src python
60	58	# Load the GeoJSON data with geopandas
		@@ -62,9 +60,9 @@ geo_data = gpd.read_file('https://raw.githubusercontent.com/datasets/geo-countri
62	60	geo_data.head()
63	61	#+end_src
64	62
65		Next, let's load the data from the Kaggle dataset. I've downloaded this
66		file, so update the file path if you have it somewhere else. After
67		loading, let's take a look at this dataframe:
	63	Next, let's load the data from the Kaggle dataset. I've downloaded this file, so
	64	update the file path if you have it somewhere else. After loading, let's take a
	65	look at this dataframe:
68	66
69	67	#+begin_src python
70	68	# Load the world happiness data with pandas
		@@ -74,12 +72,11 @@ happy_data.head()
74	72
75	73	* Clean the Data
76	74
77		Some countries need to be renamed, or they will be lost when you merge
78		the happiness and GeoJSON dataframes. This is something I discovered
79		when the map below showed empty countries. I searched both data frames
80		for the missing countries to see the naming differences. Any countries
81		that do not have records in the =happy_data= df will not show up on the
82		map.
	75	Some countries need to be renamed, or they will be lost when you merge the
	76	happiness and GeoJSON dataframes. This is something I discovered when the map
	77	below showed empty countries. I searched both data frames for the missing
	78	countries to see the naming differences. Any countries that do not have records
	79	in the =happy_data= df will not show up on the map.
83	80
84	81	#+begin_src python
85	82	# Rename some countries to match our GeoJSON data
		@@ -104,11 +101,11 @@ happy_data.at[democratic_congo_index, 'Country or region'] = 'Democratic Republi
104	101	* Merge the Data
105	102
106	103	Now that we have clean data, we need to merge the GeoJSON data with the
107		happiness data. Since we've stored them both in dataframes, we just need
108		to call the =.merge()= function.
	104	happiness data. Since we've stored them both in dataframes, we just need to call
	105	the =.merge()= function.
109	106
110		We will also rename a couple columns, just so that they're a little
111		easier to use when we create the map.
	107	We will also rename a couple columns, just so that they're a little easier to
	108	use when we create the map.
112	109
113	110	#+begin_src python
114	111	# Merge the two previous dataframes into a single geopandas dataframe
		@@ -122,10 +119,9 @@ merged_df = merged_df.rename(columns = {'Country or region':'Country'})
122	119	* Create the Map
123	120
124	121	The data is finally ready to be added to a map. The code below shows the
125		simplest way to find the center of the map and create a Folium map
126		object. The important part is to remember to reference the merged
127		dataframe for our GeoJSON data and value data. The columns specify which
128		geo data and value data to use.
	122	simplest way to find the center of the map and create a Folium map object. The
	123	important part is to remember to reference the merged dataframe for our GeoJSON
	124	data and value data. The columns specify which geo data and value data to use.
129	125
130	126	#+begin_src python
131	127	# Assign centroids to map
		@@ -157,10 +153,9 @@ Let's look at the resulting map.
157	153
158	154	* Create a Tooltip on Hover
159	155
160		Now that we have a map set up, we could stop. However, I want to add a
161		tooltip so that I can see more information about each country. The
162		=tooltip_data= code below will show a popup on hover with all the data
163		fields shown.
	156	Now that we have a map set up, we could stop. However, I want to add a tooltip
	157	so that I can see more information about each country. The =tooltip_data= code
	158	below will show a popup on hover with all the data fields shown.
164	159
165	160	#+begin_src python
166	161	# Adding labels to map

content/blog/2020-10-12-mediocrity.org +84 −95

		@@ -5,120 +5,109 @@
5	5
6	6	* Perfect is the Enemy of Good
7	7
8		As the saying goes, "the best is the enemy of the good." As we strive
9		for perfection, we often fail to realize the implications of such an
10		undertaking. Attempting to reach perfection is often unrealistic. Even
11		worse, it can get in the way of achieving a good outcome. In certain
12		situations, we try so hard to achieve the ideal solution that we have
13		burned the bridges that would have allowed us to reach a lesser yet
14		still superb solution.
15
16		Philosophers throughout history have inspected this plight from many
17		viewpoints. Greek mythology speaks of the
18		[[https://en.wikipedia.org/wiki/Golden_mean_(philosophy)][golden mean]],
19		which uses the story of Icarus to illustrate that sometimes "the middle
20		course" is the best solution. In this story, Daedalus, a famous artist
21		of his time, built feathered wings for himself and his son so that they
22		might escape the clutches of King Minos. Daedalus warns his beloved son
23		whom he loved so much to "fly the middle course", between the sea spray
24		and the sun's heat. Icarus did not heed his father; he flew up and up
25		until the sun melted the wax off his wings. For not heeding the middle
26		course, he fell into the sea and drowned.
27
28		More recently, management scholars have explored the
29		[[https://en.wikipedia.org/wiki/Pareto_principle][Pareto principle]] and
30		found that as we increase the frequency of something, or strive to
31		perform actions to achieve some form of perfection, we run into
32		[[https://en.wikipedia.org/wiki/Diminishing_returns][diminishing
33		returns]].
34
35		Even further, Harold Demsetz is noted as coining the term
36		[[https://en.wikipedia.org/wiki/Nirvana_fallacy][the Nirvana fallacy]]
37		in 1969, which shows the fallacy of comparing actual things with
38		unrealistic, idealized alternatives. This is another trap that we may
39		fall into, where we are constantly thinking of the ultimate solutions to
40		problems, when something more realistic needs to be considered.
	8	As the saying goes, "the best is the enemy of the good." As we strive for
	9	perfection, we often fail to realize the implications of such an undertaking.
	10	Attempting to reach perfection is often unrealistic. Even worse, it can get in
	11	the way of achieving a good outcome. In certain situations, we try so hard to
	12	achieve the ideal solution that we have burned the bridges that would have
	13	allowed us to reach a lesser yet still superb solution.
	14
	15	Philosophers throughout history have inspected this plight from many viewpoints.
	16	Greek mythology speaks of the [[https://en.wikipedia.org/wiki/Golden_mean_(philosophy)][golden mean]], which uses the story of Icarus to
	17	illustrate that sometimes "the middle course" is the best solution. In this
	18	story, Daedalus, a famous artist of his time, built feathered wings for himself
	19	and his son so that they might escape the clutches of King Minos. Daedalus warns
	20	his beloved son whom he loved so much to "fly the middle course", between the
	21	sea spray and the sun's heat. Icarus did not heed his father; he flew up and up
	22	until the sun melted the wax off his wings. For not heeding the middle course,
	23	he fell into the sea and drowned.
	24
	25	More recently, management scholars have explored the [[https://en.wikipedia.org/wiki/Pareto_principle][Pareto principle]] and found
	26	that as we increase the frequency of something, or strive to perform actions to
	27	achieve some form of perfection, we run into [[https://en.wikipedia.org/wiki/Diminishing_returns][diminishing returns]].
	28
	29	Even further, Harold Demsetz is noted as coining the term [[https://en.wikipedia.org/wiki/Nirvana_fallacy][the Nirvana fallacy]] in
	30	1969, which shows the fallacy of comparing actual things with unrealistic,
	31	idealized alternatives. This is another trap that we may fall into, where we are
	32	constantly thinking of the ultimate solutions to problems, when something more
	33	realistic needs to be considered.
41	34
42	35	Over and over throughout history, we've found that perfection is often
43		unrealistic and unachievable. However, we push ourselves and our peers
44		to "give 100%" or "go the extra mile," while it may be that the better
45		course is to give a valuable level of effort while considering the
46		effects of further effort on the outcome. Working harder does not always
47		help us achieve loftier goals.
48
49		This has presented itself to me most recently during my time studying at
50		my university. I was anxious and feeling the stresses of my courses,
51		career, and personal life for quite a while, which was greatly affecting
52		how well I was doing at school and my level of effort at work. One day,
53		I happened to be talking to my father when he said something simple that
54		hit home:
	36	unrealistic and unachievable. However, we push ourselves and our peers to "give
	37	100%" or "go the extra mile," while it may be that the better course is to give
	38	a valuable level of effort while considering the effects of further effort on
	39	the outcome. Working harder does not always help us achieve loftier goals.
	40
	41	This has presented itself to me most recently during my time studying at my
	42	university. I was anxious and feeling the stresses of my courses, career, and
	43	personal life for quite a while, which was greatly affecting how well I was
	44	doing at school and my level of effort at work. One day, I happened to be
	45	talking to my father when he said something simple that hit home:
55	46
56	47	#+begin_quote
57		All you can do is show up and do your best. Worrying about the outcomes
58		won't affect the outcome itself.
	48	All you can do is show up and do your best. Worrying about the outcomes won't
	49	affect the outcome itself.
59	50	#+end_quote
60	51
61	52	The thought was extremely straightforward and uncomplicated, yet it was
62		something that I had lost sight of during my stress-filled years at
63		school. Ever since then, I've found myself pausing and remembering that
64		quote every time I get anxious or stressed. It helps to stop and think
65		"Can I do anything to affect the outcome, or am I simply worrying over
66		something I can't change?"
	53	something that I had lost sight of during my stress-filled years at school. Ever
	54	since then, I've found myself pausing and remembering that quote every time I
	55	get anxious or stressed. It helps to stop and think "Can I do anything to affect
	56	the outcome, or am I simply worrying over something I can't change?"
67	57
68	58	* When Mediocrity Isn't Enough
69	59
70		One problem with the philosophies presented in this post is that they
71		are implemented far too often in situations where mediocrity simply
72		isn't adequate. For example, let's take a look at digital user data,
73		specifically personally-identifiable information (PII). As a
74		cybersecurity auditor in the United States, I have found that most
75		companies are concerned more with compliance than any actual safeguards
76		over the privacy or protection of user data. Other than companies who
77		have built their reputation on privacy and security, most companies will
78		use [[https://en.wikipedia.org/wiki/Satisficing][satisficing]] as their
79		primary decision-making strategy around user data.
	60	One problem with the philosophies presented in this post is that they are
	61	implemented far too often in situations where mediocrity simply isn't adequate.
	62	For example, let's take a look at digital user data, specifically
	63	personally-identifiable information (PII). As a cybersecurity auditor in the
	64	United States, I have found that most companies are concerned more with
	65	compliance than any actual safeguards over the privacy or protection of user
	66	data. Other than companies who have built their reputation on privacy and
	67	security, most companies will use [[https://en.wikipedia.org/wiki/Satisficing][satisficing]] as their primary decision-making
	68	strategy around user data.
80	69
81	70	#+begin_quote
82		Satisficing is a decision-making strategy or cognitive heuristic that
83		entails searching through the available alternatives until an
84		acceptability threshold is met.
	71	Satisficing is a decision-making strategy or cognitive heuristic that entails
	72	searching through the available alternatives until an acceptability threshold is
	73	met.
85	74	#+end_quote
86	75
87		This means that each decision will be met with certain possible
88		solutions until one of the solutions meets their minimum acceptable
89		standards. For companies that deal with user data, the
90		minimum-acceptable standards come from three areas:
	76	This means that each decision will be met with certain possible solutions until
	77	one of the solutions meets their minimum acceptable standards. For companies
	78	that deal with user data, the minimum-acceptable standards come from three
	79	areas:
91	80
92	81	1. Laws and regulations
93	82	2. Competitive pressure
94	83	3. Risk of monetary or reputation loss
95	84
96		Working with project management or auditing, the primary concern here is
97		the risk of legal ramifications. Since the primary risk comes from laws
98		and regulations, companies will require that any project that involves
99		user data must follow all the rules of those laws so that the company
100		can protect itself from fines or other penalties.
101
102		Following this, companies will consider best practices in order to place
103		itself in a competitive position (e.g. Google vs. Apple) and review any
104		recent or ongoing litigation against companies regarding user data. In a
105		perfect company, management would then consider the ethical
106		responsibilities of their organization and discuss their
107		responsibilities over things like personally-identifiable information.
108
109		However, as we mentioned above, most companies follow the idea of
110		satisficing, which states that they have met the minimum acceptable
111		standards and can now move on to other decisions. Modern business
112		culture in the United States dictates that profits are the golden
113		measure of how well a company or manager is performing, so we often
114		don't think about our responsibilities beyond these basic standards.
115
116		Not all situations demand excellence, but I believe that applying any
117		philosophy as a broad stroke across one's life can be a mistake. We must
118		be able to think critically about what we are doing as we do it and ask
119		ourselves a few questions. Have I done everything I can in this
120		situation? Is mediocrity an acceptable outcome, or should we strive for
121		perfection, even if we can't attain it?
	85	Working with project management or auditing, the primary concern here is the
	86	risk of legal ramifications. Since the primary risk comes from laws and
	87	regulations, companies will require that any project that involves user data
	88	must follow all the rules of those laws so that the company can protect itself
	89	from fines or other penalties.
	90
	91	Following this, companies will consider best practices in order to place itself
	92	in a competitive position (e.g. Google vs. Apple) and review any recent or
	93	ongoing litigation against companies regarding user data. In a perfect company,
	94	management would then consider the ethical responsibilities of their
	95	organization and discuss their responsibilities over things like
	96	personally-identifiable information.
	97
	98	However, as we mentioned above, most companies follow the idea of satisficing,
	99	which states that they have met the minimum acceptable standards and can now
	100	move on to other decisions. Modern business culture in the United States
	101	dictates that profits are the golden measure of how well a company or manager is
	102	performing, so we often don't think about our responsibilities beyond these
	103	basic standards.
	104
	105	Not all situations demand excellence, but I believe that applying any philosophy
	106	as a broad stroke across one's life can be a mistake. We must be able to think
	107	critically about what we are doing as we do it and ask ourselves a few
	108	questions. Have I done everything I can in this situation? Is mediocrity an
	109	acceptable outcome, or should we strive for perfection, even if we can't attain
	110	it?
122	111
123	112	Taking a few moments to think critically throughout our day, as we make
124	113	decisions, can have a tremendous effect on the outcomes we create.

content/blog/2020-12-27-website-redesign.org +71 −84

		@@ -5,96 +5,83 @@
5	5
6	6	* A Brief History
7	7
8		As a form of continuous learning and entertainment, I've been running a
9		handful of websites since 2016 when I took my first programming courses
10		in college. I maintain one main website, the place I consider the
11		official website to represent me. Under this site, I have a handful of
12		subdirectories and subdomains.
13
14		One of the parts I've enjoyed the most about web development is the
15		aspect of designing an identity for a web page and working to find
16		exciting ways to display the site's content. Inevitably, this means I've
17		changed the designs for my websites more times than I could possibly
18		count. Since I don't really host anything on my main webpage that's
19		vital, it allows me the freedom to change things as inspiration strikes.
20
21		Historically, I've relied on core utilities for spacing, components, and
22		layouts from [[https://getbootstrap.com][Bootstrap]] and added custom
23		CSS for fonts, accents, colors, and other items. I also tend to create
24		sites with no border radius on items, visible borders, and content that
25		takes up the entire screen (using whitespace inside components instead
26		of whitespace around my components).
	8	As a form of continuous learning and entertainment, I've been running a handful
	9	of websites since 2016 when I took my first programming courses in college. I
	10	maintain one main website, the place I consider the official website to
	11	represent me. Under this site, I have a handful of subdirectories and
	12	subdomains.
	13
	14	One of the parts I've enjoyed the most about web development is the aspect of
	15	designing an identity for a web page and working to find exciting ways to
	16	display the site's content. Inevitably, this means I've changed the designs for
	17	my websites more times than I could possibly count. Since I don't really host
	18	anything on my main webpage that's vital, it allows me the freedom to change
	19	things as inspiration strikes.
	20
	21	Historically, I've relied on core utilities for spacing, components, and layouts
	22	from [[https://getbootstrap.com][Bootstrap]] and added custom CSS for fonts, accents, colors, and other items.
	23	I also tend to create sites with no border radius on items, visible borders, and
	24	content that takes up the entire screen (using whitespace inside components
	25	instead of whitespace around my components).
27	26
28	27	* The Redesign Process
29	28
30		About a week ago, I found myself wishing for a new design yet again. The
31		prior design was largely inspired by IBM's
32		[[https://www.carbondesignsystem.com][Carbon Design System]] and relied
33		on jQuery, Bootstrap, along with some compressed
34		[[https://en.wikipedia.org/wiki/WebP][.webp]] images.
35
36		To anyone who knows my preferences toward web design - and even in my
37		personal life - it should be no surprise that I immediately started
38		looking for inspiration on minimalism. While there are some decent
39		minimalistic designs on sites like
40		[[https://dribbble.com/search/shots/popular/web-design?q=minimalism][Dribbble]],
41		people seem to mostly discuss [[https://brutalist-web.design][brutalist
42		web design]] when you ask about minimalism. While brutalist web design
43		doesn't have to be minimal, it often is.
44
45		I suppose, in a way, I did create a brutalist website since my HTML is
46		semantic and accessible, hyperlinks are colored and underlined, and all
47		native browser functions like scrolling and the back button work as
48		expected. However, I didn't think about brutalism while designing these
49		sites.
50
51		The new design followed a simple design process. I walked through the
52		screens on my blog and asked myself: "Is this element necessary for a
53		user?" This allowed me to first start by removing all javascript, which
54		had the sole purpose of allowing users to open a collapsed navbar on
55		mobile. Replacing the collapsible navbar allowed me to remove both
56		jQuery and Bootstrap's javascript.
57
58		Next, I removed things like author names (since I'm literally the only
59		person who will ever write on this site), multiple ways to click on a
60		blog post card, blog post descriptions, and the scroll-to-top button. It
61		also helped to move all categories to a single page, rather than have
62		each category on its own page.
63
64		The final big piece to finish the
65		"[[https://en.wikipedia.org/wiki/Marie_Kondo#KonMari_method][KonMari]]"-like
66		part of my process was to remove Bootstrap CSS in its entirety. However,
67		this meant pulling out a few very useful classes, such as =.img-fluid=
68		and the default font stacks to keep in my custom CSS.
69
70		After removing all the unnecessary pieces, I was finally able to
71		reorganize my content and add a very small amount of custom CSS to make
72		everything pretty. This took a brief amount of time, effectively just
73		consisting of me converting =<div>= tags into things like =<ul>= lists
74		and choosing accent colors.
	29	About a week ago, I found myself wishing for a new design yet again. The prior
	30	design was largely inspired by IBM's [[https://www.carbondesignsystem.com][Carbon Design System]] and relied on jQuery,
	31	Bootstrap, along with some compressed [[https://en.wikipedia.org/wiki/WebP][.webp]] images.
	32
	33	To anyone who knows my preferences toward web design - and even in my personal
	34	life - it should be no surprise that I immediately started looking for
	35	inspiration on minimalism. While there are some decent minimalistic designs on
	36	sites like [[https://dribbble.com/search/shots/popular/web-design?q=minimalism][Dribbble]], people seem to mostly discuss [[https://brutalist-web.design][brutalist web design]] when you
	37	ask about minimalism. While brutalist web design doesn't have to be minimal, it
	38	often is.
	39
	40	I suppose, in a way, I did create a brutalist website since my HTML is semantic
	41	and accessible, hyperlinks are colored and underlined, and all native browser
	42	functions like scrolling and the back button work as expected. However, I didn't
	43	think about brutalism while designing these sites.
	44
	45	The new design followed a simple design process. I walked through the screens on
	46	my blog and asked myself: "Is this element necessary for a user?" This allowed
	47	me to first start by removing all javascript, which had the sole purpose of
	48	allowing users to open a collapsed navbar on mobile. Replacing the collapsible
	49	navbar allowed me to remove both jQuery and Bootstrap's javascript.
	50
	51	Next, I removed things like author names (since I'm literally the only person
	52	who will ever write on this site), multiple ways to click on a blog post card,
	53	blog post descriptions, and the scroll-to-top button. It also helped to move all
	54	categories to a single page, rather than have each category on its own page.
	55
	56	The final big piece to finish the "[[https://en.wikipedia.org/wiki/Marie_Kondo#KonMari_method][KonMari]]"-like part of my process was to
	57	remove Bootstrap CSS in its entirety. However, this meant pulling out a few very
	58	useful classes, such as =.img-fluid= and the default font stacks to keep in my
	59	custom CSS.
	60
	61	After removing all the unnecessary pieces, I was finally able to reorganize my
	62	content and add a very small amount of custom CSS to make everything pretty.
	63	This took a brief amount of time, effectively just consisting of me converting
	64	=<div>= tags into things like =<ul>= lists and choosing accent colors.
75	65
76	66	* The Results
77	67
78	68	** Reflection
79	69
80	70	So, what did all of this reorganizing do to my webpages? Well, first, my
81		websites are now ridiculously fast. Since the prior designs were also
82		minimal and didn't have many images, they measured up in Firefox's
83		Network Monitor around 300 KB - 600KB. After making the changes, my main
84		site is at 5 KB transferred (22 KB total), and my blog is at 6.5 KB
85		transferred (13 KB total). *That means the redesigned pages are less
86		than 2% the size of the old designs.*
87
88		Google Lighthouse ranks the new webpage as 100 in performance,
89		accessibility, and best practices, with SEO at 92 since they think tap
90		targets are not sized appropriately for mobile users. First contextual
91		paints of the pages are under 0.8 seconds with 0 ms of blocking time.
92		However, the blog subdomain ranks at 100 for all four categories! First
93		contextual paints of the blog homepage are under 1.0 seconds with 0 ms
94		of blocking time, due to the fact that the CSS for my blog is within a
95		separate CSS file, and the CSS for my main website is simply embedded in
96		the HTML file.
97
98		Now that everything is complete, I can confidently say I'm happy with
99		the result and proud to look at the fastest set of websites I've created
100		so far.
	71	websites are now ridiculously fast. Since the prior designs were also minimal
	72	and didn't have many images, they measured up in Firefox's Network Monitor
	73	around 300 KB - 600KB. After making the changes, my main site is at 5 KB
	74	transferred (22 KB total), and my blog is at 6.5 KB transferred (13 KB total).
	75	That means the redesigned pages are less than 2% the size of the old designs.
	76
	77	Google Lighthouse ranks the new webpage as 100 in performance, accessibility,
	78	and best practices, with SEO at 92 since they think tap targets are not sized
	79	appropriately for mobile users. First contextual paints of the pages are under
	80	0.8 seconds with 0 ms of blocking time. However, the blog subdomain ranks at 100
	81	for all four categories! First contextual paints of the blog homepage are under
	82	1.0 seconds with 0 ms of blocking time, due to the fact that the CSS for my blog
	83	is within a separate CSS file, and the CSS for my main website is simply
	84	embedded in the HTML file.
	85
	86	Now that everything is complete, I can confidently say I'm happy with the result
	87	and proud to look at the fastest set of websites I've created so far.

content/blog/2020-12-28-neon-drive.org +38 −49

		@@ -5,80 +5,69 @@
5	5
6	6	* Game Description
7	7
8		[[https://store.steampowered.com/app/433910/Neon_Drive/][Neon Drive]]
9		presents itself as a simple arcade-style game inspired by the arcade
10		race games of the 1980s, yet it has managed to take up hours of my life
11		without much effort. The game description, directly from the Steam page,
12		is intriguing enough to entice anyone who's been looking for a good
13		arcade racing game:
	8	[[https://store.steampowered.com/app/433910/Neon_Drive/][Neon Drive]] presents itself as a simple arcade-style game inspired by the arcade
	9	race games of the 1980s, yet it has managed to take up hours of my life without
	10	much effort. The game description, directly from the Steam page, is intriguing
	11	enough to entice anyone who's been looking for a good arcade racing game:
14	12
15	13	#+begin_quote
16		Neon Drive is a slick retro-futuristic arcade game that will make your
17		brain melt. You've been warned. From beautiful cityscapes and ocean
18		roads to exploding enemy spaceships, Neon Drive has it all.
	14	Neon Drive is a slick retro-futuristic arcade game that will make your brain
	15	melt. You've been warned. From beautiful cityscapes and ocean roads to exploding
	16	enemy spaceships, Neon Drive has it all.
19	17	#+end_quote
20	18
21	19	* Gameplay
22	20
23		The game holds true to the
24		[[https://en.wikipedia.org/wiki/Retrofuturism][retro-futurism]] style,
25		including chrome female robots, pixelated arcade machines, and
26		[[https://teddit.net/r/outrun/][outrun]] aesthetics.
	21	The game holds true to the [[https://en.wikipedia.org/wiki/Retrofuturism][retro-futurism]] style, including chrome female robots,
	22	pixelated arcade machines, and [[https://teddit.net/r/outrun/][outrun]] aesthetics.
27	23
28		Each level of the game is shown as a separate arcade machine. Each
29		arcade machine lets you play on Normal, Hard, Insane, Practice, and Free
30		Run. To beat each arcade, you must reach the end of the level without
31		crashing your car into the various obstacles on the course. Basic levels
32		let you move left or right to avoid blocks in the road. Later levels put
33		you through other tests, such as dodging traffic or blasting asteroids.
	24	Each level of the game is shown as a separate arcade machine. Each arcade
	25	machine lets you play on Normal, Hard, Insane, Practice, and Free Run. To beat
	26	each arcade, you must reach the end of the level without crashing your car into
	27	the various obstacles on the course. Basic levels let you move left or right to
	28	avoid blocks in the road. Later levels put you through other tests, such as
	29	dodging traffic or blasting asteroids.
34	30
35		The game uses synthwave music to keep you on track to make the correct
36		moves by timing the beats of the songs to the correct moves on the
37		screen. It reminds me of the early Guitar Hero games, as well as mobile
38		apps like VOEZ - repetition and staying on-beat is the only way to win.
	31	The game uses synthwave music to keep you on track to make the correct moves by
	32	timing the beats of the songs to the correct moves on the screen. It reminds me
	33	of the early Guitar Hero games, as well as mobile apps like VOEZ - repetition
	34	and staying on-beat is the only way to win.
39	35
40	36	* In-Game Screenshots
41	37
42		Taking a look at the main menu, you can see that Neon Drive plays into
43		every stereotype you can think of around retro-futuristic, synthwave
44		arcades (in a good way).
	38	Taking a look at the main menu, you can see that Neon Drive plays into every
	39	stereotype you can think of around retro-futuristic, synthwave arcades (in a
	40	good way).
45	41
46		Once you get into the first level, we see that the choice of car fits
47		right in with the stereotypical cars of the 80s, like the
48		[[https://en.wikipedia.org/wiki/DMC_DeLorean][DeLorean]] or the
49		[[https://en.wikipedia.org/wiki/Ferrari_F40][Ferrari F40]]. Each new
50		level comes with new color schemes and cars, so you should never get
	42	Once you get into the first level, we see that the choice of car fits right in
	43	with the stereotypical cars of the 80s, like the [[https://en.wikipedia.org/wiki/DMC_DeLorean][DeLorean]] or the [[https://en.wikipedia.org/wiki/Ferrari_F40][Ferrari F40]].
	44	Each new level comes with new color schemes and cars, so you should never get
51	45	tired of the aesthetic.
52	46
53	47	Personally, I love the orange and blue colors used in level 2:
54	48
55		If you're the competitive type and getting 100% on all arcade machines
56		isn't enough, there are leaderboards for the regular part of the game,
57		and the endurance game mode.
	49	If you're the competitive type and getting 100% on all arcade machines isn't
	50	enough, there are leaderboards for the regular part of the game, and the
	51	endurance game mode.
58	52
59	53	* Other Suggestions
60	54
61		Neon Drive sits nicely within the well-founded cult genre of Outrun.
62		Other games that I've enjoyed in this same spectrum are:
	55	Neon Drive sits nicely within the well-founded cult genre of Outrun. Other games
	56	that I've enjoyed in this same spectrum are:
63	57
64		- [[https://store.steampowered.com/app/233270/Far_Cry_3__Blood_Dragon/][Far
65		Cry 3: Blood Dragon]]
	58	- [[https://store.steampowered.com/app/233270/Far_Cry_3__Blood_Dragon/][Far Cry 3: Blood Dragon]]
66	59	- [[https://store.steampowered.com/app/1239690/Retrowave/][Retrowave]]
67	60	- [[https://store.steampowered.com/app/732810/Slipstream/][Slipstream]]
68	61
69		Although these games aren't necessarily in the same genre, they do have
70		aspects that place them close enough to interest gamers that enjoyed
71		Neon Drive:
	62	Although these games aren't necessarily in the same genre, they do have aspects
	63	that place them close enough to interest gamers that enjoyed Neon Drive:
72	64
73	65	- [[https://store.steampowered.com/app/311800/Black_Ice/][Black Ice]]
74	66	- [[https://store.steampowered.com/app/746850/Cloudpunk/][Cloudpunk]]
75		- [[https://store.steampowered.com/app/1222680/Need_for_Speed_Heat/][Need
76		for Speed: Heat]]
	67	- [[https://store.steampowered.com/app/1222680/Need_for_Speed_Heat/][Need for Speed: Heat]]
77	68	- [[https://store.steampowered.com/app/1019310/VirtuaVerse/][VirtuaVerse]]
78	69
79		Of course, if all you really care about is the arcade aspect of these
80		games, you can check out the
81		[[https://store.steampowered.com/app/400020/Atari_Vault/][Atari Vault]]
82		or any of the other classic games sold on Steam by companies like Namco,
83		Atari. For something like Nintendo, you'd have to settle for buying used
84		classic consoles or delve into the world of emulation.
	70	Of course, if all you really care about is the arcade aspect of these games, you
	71	can check out the [[https://store.steampowered.com/app/400020/Atari_Vault/][Atari Vault]] or any of the other classic games sold on Steam by
	72	companies like Namco, Atari. For something like Nintendo, you'd have to settle
	73	for buying used classic consoles or delve into the world of emulation.

content/blog/2020-12-29-zork.org +44 −56

		@@ -5,28 +5,24 @@
5	5
6	6	* Download (Free)
7	7
8		Before we get into the game itself, you should know that you can
9		download Zork for free from Infocom's
10		[[http://infocom-if.org/downloads/downloads.html][download page]]. So
11		feel free to boot it up and take a ride back to the 1980s with this
12		masterpiece.
	8	Before we get into the game itself, you should know that you can download Zork
	9	for free from Infocom's [[http://infocom-if.org/downloads/downloads.html][download page]]. So feel free to boot it up and take a
	10	ride back to the 1980s with this masterpiece.
13	11
14	12	* Game Description
15	13
16		Zork is an interactive, text-based computer game originally released
17		in 1980. This series, split into three separate games, introduced a
18		robust and sophisticated text parser to gamers. People were largely used
19		to the simple commands used in the popular game
20		[[https://en.wikipedia.org/wiki/Colossal_Cave_Adventure][Colossal Cave
21		Adventure]], but Zork allowed users to send more complex commands that
22		included prepositions and conjunctions.
23
24		Zork tracks your score as you explore the map, find tools, and collect
25		trophy items (e.g., a jewel-encrusted egg). When you place your trophy
26		items in the trophy case found in the Living Room area, you gain score
27		points. Collecting the Twenty Treasures of Zork and placing them within
28		the trophy case wins the game. However, you must explore the map, solve
29		puzzles, and avoid being eaten by a grue to collect these treasures.
	14	Zork is an interactive, text-based computer game originally released in 1980.
	15	This series, split into three separate games, introduced a robust and
	16	sophisticated text parser to gamers. People were largely used to the simple
	17	commands used in the popular game [[https://en.wikipedia.org/wiki/Colossal_Cave_Adventure][Colossal Cave Adventure]], but Zork allowed
	18	users to send more complex commands that included prepositions and conjunctions.
	19
	20	Zork tracks your score as you explore the map, find tools, and collect trophy
	21	items (e.g., a jewel-encrusted egg). When you place your trophy items in the
	22	trophy case found in the Living Room area, you gain score points. Collecting the
	23	Twenty Treasures of Zork and placing them within the trophy case wins the game.
	24	However, you must explore the map, solve puzzles, and avoid being eaten by a
	25	grue to collect these treasures.
30	26
31	27	* The Map
32	28
		@@ -42,45 +38,37 @@ map.
42	38
43	39	* In-Game Screenshots
44	40
45		After playing the game (for the first time ever) for several weeks
46		around 2014, I was finally able to beat the game with some online help
47		to find the last couple items. As I was writing this post, I installed
48		the game again to grab some screenshots to show off the true glory of
49		this game. As noted in
50		[[https://www.filfre.net/2012/01/exploring-zork-part-1/][Jimmy Maher's
51		playthrough]], the original Zork games looked quite a bit different due
52		to the older hardware of computers like the Apple II and multiple bug
53		fixes that Infocom pushed out after the game's initial release. My
54		play-through uses the
55		[[https://store.steampowered.com/app/570580/Zork_Anthology/][Zork
56		Anthology]] version, which utilizes DOSBox on Windows.
57
58		The first screenshot here shows the introductory information, which
59		doesn't include instructions of any kind for the player. If you haven't
60		played text adventures before, try to use simple commands like "go
61		west," "look around," or "hit troll with elvish sword."
62
63		In this second screenshot, we see the player has entered the house and
64		found the trophy case in the living room. The lantern and sword in this
65		room allow the player to explore dark areas and attack enemies. If you
66		don't use the lantern, you won't be able to see anything in dark areas,
67		and you may be eaten by a grue.
68
69		Finally, we see that the player has found the first treasure: a
70		jewel-encrusted egg. These treasures can be taken back to the house and
71		placed in the trophy case or carried until you feel like you want to put
72		things away.
	41	After playing the game (for the first time ever) for several weeks around 2014,
	42	I was finally able to beat the game with some online help to find the last
	43	couple items. As I was writing this post, I installed the game again to grab
	44	some screenshots to show off the true glory of this game. As noted in [[https://www.filfre.net/2012/01/exploring-zork-part-1/][Jimmy
	45	Maher's playthrough]], the original Zork games looked quite a bit different due to
	46	the older hardware of computers like the Apple II and multiple bug fixes that
	47	Infocom pushed out after the game's initial release. My play-through uses the
	48	[[https://store.steampowered.com/app/570580/Zork_Anthology/][Zork Anthology]] version, which utilizes DOSBox on Windows.
	49
	50	The first screenshot here shows the introductory information, which doesn't
	51	include instructions of any kind for the player. If you haven't played text
	52	adventures before, try to use simple commands like "go west," "look around," or
	53	"hit troll with elvish sword."
	54
	55	In this second screenshot, we see the player has entered the house and found the
	56	trophy case in the living room. The lantern and sword in this room allow the
	57	player to explore dark areas and attack enemies. If you don't use the lantern,
	58	you won't be able to see anything in dark areas, and you may be eaten by a grue.
	59
	60	Finally, we see that the player has found the first treasure: a jewel-encrusted
	61	egg. These treasures can be taken back to the house and placed in the trophy
	62	case or carried until you feel like you want to put things away.
73	63
74	64	* Conclusion
75	65
76		It's been quite a few years since I first played Zork, but I clearly
77		remember the late nights and bloodshot eyes that helped me find all the
78		treasures. This game is well worth the time and effort, even though the
79		text-based aspect may be off-putting to gamers who didn't have to grow
80		up playing games without graphics. However, I believe that the strategy
81		and skills learned in early video games like Zork can actually help you,
82		even when playing newer games.
	66	It's been quite a few years since I first played Zork, but I clearly remember
	67	the late nights and bloodshot eyes that helped me find all the treasures. This
	68	game is well worth the time and effort, even though the text-based aspect may be
	69	off-putting to gamers who didn't have to grow up playing games without graphics.
	70	However, I believe that the strategy and skills learned in early video games
	71	like Zork can actually help you, even when playing newer games.
83	72
84	73	If you do decide to play Zork, you can download Zork I, II, and III from
85		Infocom's [[http://infocom-if.org/downloads/downloads.html][download
86		page]] for free or search the internet for an online version.
	74	Infocom's [[http://infocom-if.org/downloads/downloads.html][download page]] for free or search the internet for an online version.

Commit 972b15ecc9

Commit `972b15ecc9`