Commit `eac7b5d084`

eac7b5d0841f62d4cf1dc81f0fed3f207316bca0

parent: 24106aeff1

Unsigned

cmc <hello@cleberg.net> · 2024-04-22 19:07 UTC

format a portion of blog posts

Layout: unified · split

README.org +7

		@@ -50,5 +50,12 @@ files to the target through any number of methods, such as =scp= or SFTP.
50	50
51	51	*** DONE Create RSS feed
52	52	*** TODO Format all blog posts with =M q=
	53	**** DONE 2018
	54	**** DONE 2019
	55	**** DONE 2020
	56	**** TODO 2021
	57	**** TODO 2022
	58	**** TODO 2023
	59	**** TODO 2024
53	60	*** DONE Create script to auto-generate the =/blog/= list and =/= most recent posts
54	61	*** TODO Figure out how to get filetags to show up

content/blog/2018-11-28-cpp-compiler.org +44 −51

		@@ -4,14 +4,13 @@
4	4	#+filetags: :dev:
5	5
6	6	* A Brief Introduction
7		[[https://en.wikipedia.org/wiki/C%2B%2B][C++]] is a general-purpose
8		programming language with object-oriented, generic, and functional
9		features in addition to facilities for low-level memory manipulation.
	7	[[https://en.wikipedia.org/wiki/C%2B%2B][C++]] is a general-purpose programming language with object-oriented, generic, and
	8	functional features in addition to facilities for low-level memory manipulation.
10	9
11		The source code, shown in the snippet below, must be compiled before it
12		can be executed. There are many steps and intricacies to the compilation
13		process, and this post was a personal exercise to learn and remember as
14		much information as I can.
	10	The source code, shown in the snippet below, must be compiled before it can be
	11	executed. There are many steps and intricacies to the compilation process, and
	12	this post was a personal exercise to learn and remember as much information as I
	13	can.
15	14
16	15	#+begin_src cpp
17	16	#include <iostream>
		@@ -24,51 +23,45 @@ int main()
24	23
25	24	** Compilation Process
26	25	*** An Overview
27		Compiling C++ projects is a frustrating task most days. Seemingly
28		nonexistent errors keeping your program from successfully compiling can
29		be annoying (especially since you know you wrote it perfectly the first
30		time, right?).
	26	Compiling C++ projects is a frustrating task most days. Seemingly nonexistent
	27	errors keeping your program from successfully compiling can be annoying
	28	(especially since you know you wrote it perfectly the first time, right?).
31	29
32		I'm learning more and more about C++ these days and decided to write
33		this concept down so that I can cement it even further in my own head.
34		However, C++ is not the only compiled language. Check out
35		[[https://en.wikipedia.org/wiki/Compiled_language][the Wikipedia entry
36		for compiled languages]] for more examples of compiled languages.
	30	I'm learning more and more about C++ these days and decided to write this
	31	concept down so that I can cement it even further in my own head. However, C++
	32	is not the only compiled language. Check out [[https://en.wikipedia.org/wiki/Compiled_language][the Wikipedia entry for compiled
	33	languages]] for more examples of compiled languages.
37	34
38		I'll start with a wonderful, graphical way to conceptualize the C++
39		compiler. View
40		[[https://web.archive.org/web/20190419035048/http://faculty.cs.niu.edu/~mcmahon/CS241/Notes/compile.html][The
41		C++ Compilation Process]] by Kurt MacMahon, an NIU professor, to see the
42		graphic and an explanation. The goal of the compilation process is to
43		take the C++ code and produce a shared library, dynamic library, or an
44		executable file.
	35	I'll start with a wonderful, graphical way to conceptualize the C++ compiler.
	36	View [[https://web.archive.org/web/20190419035048/http://faculty.cs.niu.edu/~mcmahon/CS241/Notes/compile.html][The C++ Compilation Process]] by Kurt MacMahon, an NIU professor, to see the
	37	graphic and an explanation. The goal of the compilation process is to take the
	38	C++ code and produce a shared library, dynamic library, or an executable file.
45	39
46	40	** Compilation Phases
47	41	Let's break down the compilation process. There are four major steps to
48	42	compiling C++ code.
49	43
50	44	*** Step 1
51		The first step is to expand the source code file to meet all
52		dependencies. The C++ preprocessor includes the code from all the header
53		files, such as =#include <iostream>=. Now, what does that mean? The
54		previous example includes the =iostream= header. This tells the computer
55		that you want to use the =iostream= standard library, which contains
56		classes and functions written in the core language. This specific header
57		allows you to manipulate input/output streams. After all this, you'll
58		end up which a temporary file that contains the expanded source code.
	45	The first step is to expand the source code file to meet all dependencies. The
	46	C++ preprocessor includes the code from all the header files, such as =#include
	47	<iostream>=. Now, what does that mean? The previous example includes the
	48	=iostream= header. This tells the computer that you want to use the =iostream=
	49	standard library, which contains classes and functions written in the core
	50	language. This specific header allows you to manipulate input/output streams.
	51	After all this, you'll end up which a temporary file that contains the expanded
	52	source code.
59	53
60		In the example of the C++ code above, the =iostream= class would be
61		included in the expanded code.
	54	In the example of the C++ code above, the =iostream= class would be included in
	55	the expanded code.
62	56
63	57	*** Step 2
64		After the code is expanded, the compiler comes into play. The compiler
65		takes the C++ code and converts this code into the assembly language,
66		understood by the platform. You can see this in action if you head over
67		to the [[https://godbolt.org][GodBolt Compiler Explorer]], which shows
68		C++ being converted into assembly dynamically.
	58	After the code is expanded, the compiler comes into play. The compiler takes the
	59	C++ code and converts this code into the assembly language, understood by the
	60	platform. You can see this in action if you head over to the [[https://godbolt.org][GodBolt Compiler
	61	Explorer]], which shows C++ being converted into assembly dynamically.
69	62
70		For example, the =Hello, world!= code snippet above compiles into the
71		following assembly code:
	63	For example, the =Hello, world!= code snippet above compiles into the following
	64	assembly code:
72	65
73	66	#+begin_src asm
74	67	.LC0:
		@@ -113,16 +106,16 @@ _GLOBAL__sub_I_main:
113	106	#+end_src
114	107
115	108	*** Step 3
116		Third, the assembly code generated by the compiler is assembled into the
117		object code for the platform. Essentially, this is when the compiler
118		takes the assembly code and assembles it into machine code in a binary
119		format. After researching this online, I figured out that a lot of
120		compilers will allow you to stop compilation at this step. This would be
121		useful for compiling each source code file separately. This saves time
122		later if a single file changes; only that file needs to be recompiled.
	109	Third, the assembly code generated by the compiler is assembled into the object
	110	code for the platform. Essentially, this is when the compiler takes the assembly
	111	code and assembles it into machine code in a binary format. After researching
	112	this online, I figured out that a lot of compilers will allow you to stop
	113	compilation at this step. This would be useful for compiling each source code
	114	file separately. This saves time later if a single file changes; only that file
	115	needs to be recompiled.
123	116
124	117	*** Step 4
125		Finally, the object code file generated by the assembler is linked
126		together with the object code files for any library functions used to
127		produce a shared library, dynamic library, or an executable file. It
128		replaces all references to undefined symbols with the correct addresses.
	118	Finally, the object code file generated by the assembler is linked together with
	119	the object code files for any library functions used to produce a shared
	120	library, dynamic library, or an executable file. It replaces all references to
	121	undefined symbols with the correct addresses.

content/blog/2019-01-07-useful-css.org +51 −62

		@@ -4,34 +4,30 @@
4	4	#+filetags: :dev:
5	5
6	6	* Introduction to CSS
7		[[https://en.wikipedia.org/wiki/CSS][CSS]], the language used to markup
8		HTML code and make it "pretty", is one of the most effective ways to
9		increase the attractiveness of a website. It can also lead to increased
10		user engagement, retention, and satisfaction. In fact, there are whole
11		career fields are dedicated to the improvement of user experiences,
	7	[[https://en.wikipedia.org/wiki/CSS][CSS]], the language used to markup HTML code and make it "pretty", is one of the
	8	most effective ways to increase the attractiveness of a website. It can also
	9	lead to increased user engagement, retention, and satisfaction. In fact, there
	10	are whole career fields are dedicated to the improvement of user experiences,
12	11	known as UI design and UX design.
13	12
14		Some web developers are used to the common CSS properties, such as
15		element sizing, fonts, colors, etc., but are not as well versed in
16		less-used properties and values such as =flexbox=, =clip-path=, and
17		=transform=. This article will provide some insight into the less-used
18		and unique CSS properties.
	13	Some web developers are used to the common CSS properties, such as element
	14	sizing, fonts, colors, etc., but are not as well versed in less-used properties
	15	and values such as =flexbox=, =clip-path=, and =transform=. This article will
	16	provide some insight into the less-used and unique CSS properties.
19	17
20	18	* CSS Variables
21		The first topic today is CSS variables. Variables are not often used by
22		smaller developers. CSS variables allow you to give your website a
23		well-defined structure, where you can easily reuse CSS properties
24		throughout the project.
	19	The first topic today is CSS variables. Variables are not often used by smaller
	20	developers. CSS variables allow you to give your website a well-defined
	21	structure, where you can easily reuse CSS properties throughout the project.
25	22
26		You can use variables to define things, such as color palettes. Then,
27		you can use these colors for backgrounds anywhere else in the HTML. This
28		could be extended, where extra variables could be defined for
29		=primary-text=, =quoted-text=, etc. Variables can also be used to define
30		spacing (e.g. =32px= or =2rem=), which can then be applied to margins,
31		padding, font sizes, and more.
	23	You can use variables to define things, such as color palettes. Then, you can
	24	use these colors for backgrounds anywhere else in the HTML. This could be
	25	extended, where extra variables could be defined for =primary-text=,
	26	=quoted-text=, etc. Variables can also be used to define spacing (e.g. =32px= or
	27	=2rem=), which can then be applied to margins, padding, font sizes, and more.
32	28
33		For example, here are some variables defined at the root of the website,
34		which allows for any subsequent CSS rules to use those variables:
	29	For example, here are some variables defined at the root of the website, which
	30	allows for any subsequent CSS rules to use those variables:
35	31
36	32	#+begin_src css
37	33	:root {
		@@ -46,23 +42,21 @@ body {
46	42	#+end_src
47	43
48	44	* CSS Box Shadows
49		Box shadows were once my mortal enemy. No matter how hard I tried, I
50		just couldn't get them to work how I wanted. Because of this, my
51		favorite discovery has been CSSMatic's
52		[[https://www.cssmatic.com/box-shadow][box shadow generator]]. It
53		provides an excellent tool to generate box shadows using their simple
54		sliders. Surprisingly, this is the reason I learned how box shadows
55		work! You can use the sliders and watch how the CSS code changes in the
56		image that is displayed. Through this, you should understand that the
57		basic structure for box shadows is:
	45	Box shadows were once my mortal enemy. No matter how hard I tried, I just
	46	couldn't get them to work how I wanted. Because of this, my favorite discovery
	47	has been CSSMatic's [[https://www.cssmatic.com/box-shadow][box shadow generator]]. It provides an excellent tool to
	48	generate box shadows using their simple sliders. Surprisingly, this is the
	49	reason I learned how box shadows work! You can use the sliders and watch how the
	50	CSS code changes in the image that is displayed. Through this, you should
	51	understand that the basic structure for box shadows is:
58	52
59	53	#+begin_src css
60	54	box-shadow: inset horizontal vertical blur spread color;
61	55	#+end_src
62	56
63		Now, let's look at some basic examples! You can copy and paste the
64		following code into a site like CodePen or your own HTML files. Feel
65		free to play around with the code, experiment, and learn.
	57	Now, let's look at some basic examples! You can copy and paste the following
	58	code into a site like CodePen or your own HTML files. Feel free to play around
	59	with the code, experiment, and learn.
66	60
67	61	Box Shadow #1
68	62
		@@ -118,21 +112,19 @@ free to play around with the code, experiment, and learn.
118	112	}
119	113	#+end_src
120	114
121		Try these box shadows out on your own and see how changing each shadow
122		value works.
	115	Try these box shadows out on your own and see how changing each shadow value
	116	works.
123	117
124	118	* CSS Flexbox
125		Now, let's move on to the best part of this article: flexbox. The
126		flexbox is by far my favorite new toy. I originally stumbled across this
127		solution after looking for more efficient ways of centering content
128		horizontally AND vertically. I had used a few hack-ish methods before,
129		but flexbox throws those out the window. The best part of it all is that
130		flexbox is /dead simple/.
131
132		Flexbox pertains to the parent div of any element. You want the parent
133		to be the flexbox in which items are arranged to use the flex methods.
134		It's easier to see this in action that explained, so let's see an
135		example.
	119	Now, let's move on to the best part of this article: flexbox. The flexbox is by
	120	far my favorite new toy. I originally stumbled across this solution after
	121	looking for more efficient ways of centering content horizontally AND
	122	vertically. I had used a few hack-ish methods before, but flexbox throws those
	123	out the window. The best part of it all is that flexbox is /dead simple/.
	124
	125	Flexbox pertains to the parent div of any element. You want the parent to be the
	126	flexbox in which items are arranged to use the flex methods. It's easier to see
	127	this in action that explained, so let's see an example.
136	128
137	129	Flexbox
138	130
		@@ -167,23 +159,20 @@ example.
167	159	}
168	160	#+end_src
169	161
170		You may notice that we no longer need to use the =top= property for the
171		=h3= elements in our code. This is because we set the display box to be
172		a flex container for the small boxes, AND we made the small boxes flex
173		containers for their elements (the h3 tags). Flex boxes can be nested
174		like this to center content that is inside centered content.
	162	You may notice that we no longer need to use the =top= property for the =h3=
	163	elements in our code. This is because we set the display box to be a flex
	164	container for the small boxes, AND we made the small boxes flex containers for
	165	their elements (the h3 tags). Flex boxes can be nested like this to center
	166	content that is inside centered content.
175	167
176		For the example above, we designated the =justify-content= property to
177		be =flex-start= so that the boxes stack from the left side of the
178		screen. This property can be changed to =center= to make the boxes
179		appear in the center of the screen.
	168	For the example above, we designated the =justify-content= property to be
	169	=flex-start= so that the boxes stack from the left side of the screen. This
	170	property can be changed to =center= to make the boxes appear in the center of
	171	the screen.
180	172
181		For an interactive example,
182		[[https://codepen.io/LandonSchropp/pen/KpzzGo][check out this CodePen]]
183		from [[https://codepen.io/LandonSchropp/][LandonScropp]]. Resize the
	173	For an interactive example, [[https://codepen.io/LandonSchropp/pen/KpzzGo][check out this CodePen]] from [[https://codepen.io/LandonSchropp/][LandonScropp]]. Resize the
184	174	window with dice to see how they collapse and re-align.
185	175
186	176	* Even More CSS
187		For more inspiration, you can visit [[https://www.codepen.io][CodePen]],
188		[[https://dribbble.com][Dribbble]], or [[https://uimovement.com][UI
189		Movement]] to browse the collections of many amazing web designers.
	177	For more inspiration, you can visit [[https://www.codepen.io][CodePen]], [[https://dribbble.com][Dribbble]], or [[https://uimovement.com][UI Movement]] to browse
	178	the collections of many amazing web designers.

content/blog/2019-09-09-audit-analytics.org +143 −161

		@@ -4,111 +4,103 @@
4	4	#+filetags: :audit:
5	5
6	6	* What Are Data Analytics?
7		A quick aside before I dive into this post: =data analytics= is a vague
8		term that has become popular in recent years. Think of a =data analytic=
9		as the output of any data analysis you perform. For example, a pivot
10		table or a pie chart could be a data analytic.
11
12		[[https://en.wikipedia.org/wiki/Data_analysis][Data analysis]] is a
13		process that utilizes statistics and other mathematical methods to
14		discover useful information within datasets. This involves examining,
15		cleaning, transforming, and modeling data so that you can use the data
16		to support an opinion, create more useful viewpoints, and gain knowledge
17		to implement into audit planning or risk assessments.
18
19		One of the common mistakes that managers (and anyone new to the process)
20		make is assuming that everything involved with this process is "data
21		analytics". In fact, data analytics are only a small part of the
22		process.
23
24		See Figure 1* for a more accurate representation of where data analysis
25		sits within the full process. This means that data analysis does not
26		include querying or extracting data, selecting samples, or performing
27		audit tests. These steps can be necessary for an audit (and may even be
28		performed by the same associates), but they are not data analytics.
	7	A quick aside before I dive into this post: =data analytics= is a vague term
	8	that has become popular in recent years. Think of a =data analytic= as the
	9	output of any data analysis you perform. For example, a pivot table or a pie
	10	chart could be a data analytic.
	11
	12	[[https://en.wikipedia.org/wiki/Data_analysis][Data analysis]] is a process that utilizes statistics and other mathematical
	13	methods to discover useful information within datasets. This involves examining,
	14	cleaning, transforming, and modeling data so that you can use the data to
	15	support an opinion, create more useful viewpoints, and gain knowledge to
	16	implement into audit planning or risk assessments.
	17
	18	One of the common mistakes that managers (and anyone new to the process) make is
	19	assuming that everything involved with this process is "data analytics". In
	20	fact, data analytics are only a small part of the process.
	21
	22	See Figure 1* for a more accurate representation of where data analysis sits
	23	within the full process. This means that data analysis does not include querying
	24	or extracting data, selecting samples, or performing audit tests. These steps
	25	can be necessary for an audit (and may even be performed by the same
	26	associates), but they are not data analytics.
29	27
30	28	#+caption: The Intelligence Cycle
31	29	[[https://img.cleberg.net/blog/20190909-data-analysis-in-auditing/intelligence_cycle-min.png]]
32	30
33	31	* Current Use of Analytics in Auditing
34		While data analysis has been an integral part of most businesses and
35		departments for the better part of the last century, only recently have
36		internal audit functions been adopting this practice. The internal audit
37		function works exclusively to provide assurance and consulting services
38		to the business areas within the firm (except for internal auditing
39		firms who are hired by different companies to perform their roles).
	32	While data analysis has been an integral part of most businesses and departments
	33	for the better part of the last century, only recently have internal audit
	34	functions been adopting this practice. The internal audit function works
	35	exclusively to provide assurance and consulting services to the business areas
	36	within the firm (except for internal auditing firms who are hired by different
	37	companies to perform their roles).
40	38
41	39	#+begin_quote
42		Internal Auditing helps an organization accomplish its objectives by
43		bringing a systematic, disciplined approach to evaluate and improve the
44		effectiveness of risk management, control and governance processes.
	40	Internal Auditing helps an organization accomplish its objectives by bringing a
	41	systematic, disciplined approach to evaluate and improve the effectiveness of
	42	risk management, control and governance processes.
45	43
46	44	- The IIA's Definition of Internal Audit
47	45
48	46	#+end_quote
49	47
50		Part of the blame for the slow adoption of data analysis can be
51		attributed to the fact that internal auditing is strongly based on
52		tradition and following the precedents set by previous auditors.
53		However, there can be no progress without auditors who are willing to
54		break the mold and test new audit techniques. In fact, as of 2018,
55		[[https://www.cpapracticeadvisor.com/accounting-audit/news/12404086/internal-audit-groups-are-lagging-in-data-analytics][only
56		63% of internal audit departments currently utilize data analytics]] in
57		North America. This number should be as close as possible to 100%. I
58		have never been part of an audit that would not have benefited from data
	48	Part of the blame for the slow adoption of data analysis can be attributed to
	49	the fact that internal auditing is strongly based on tradition and following the
	50	precedents set by previous auditors. However, there can be no progress without
	51	auditors who are willing to break the mold and test new audit techniques. In
	52	fact, as of 2018, [[https://www.cpapracticeadvisor.com/accounting-audit/news/12404086/internal-audit-groups-are-lagging-in-data-analytics][only 63% of internal audit departments currently utilize data
	53	analytics]] in North America. This number should be as close as possible to 100%.
	54	I have never been part of an audit that would not have benefited from data
59	55	analytics.
60	56
61		So, how do internal audit functions remedy this situation? It's
62		definitely not as easy as walking into work on Monday and telling your
63		Chief Audit Executive that you're going to start implementing analytics
64		in the next audit. You need a plan and a system to make the analysis
65		process as effective as possible.
	57	So, how do internal audit functions remedy this situation? It's definitely not
	58	as easy as walking into work on Monday and telling your Chief Audit Executive
	59	that you're going to start implementing analytics in the next audit. You need a
	60	plan and a system to make the analysis process as effective as possible.
66	61
67	62	* The DELTA Model
68	63	One of the easiest ways to experiment with data analytics and gain an
69		understanding of the processes is to implement them within your own
70		department. But how do we do this if we've never worked with analysis
71		before? One of the most common places to start is to research some data
72		analysis models currently available. For this post, we'll take a look at
73		the DELTA model. You can take a look at **Figure 2*** for a quick
74		overview of the model.
	64	understanding of the processes is to implement them within your own department.
	65	But how do we do this if we've never worked with analysis before? One of the
	66	most common places to start is to research some data analysis models currently
	67	available. For this post, we'll take a look at the DELTA model. You can take a
	68	look at **Figure 2*** for a quick overview of the model.
75	69
76		The DELTA model sets a few guidelines for areas wanting to implement
77		data analytics so that the results can be as comprehensive as possible:
	70	The DELTA model sets a few guidelines for areas wanting to implement data
	71	analytics so that the results can be as comprehensive as possible:
78	72
79	73	- Data: Must be clean, accessible, and (usually) unique.
80		- Enterprise-Wide Focus: Key data systems and analytical resources
81		must be available for use (by the Internal Audit Function).
82		- Leaders: Must promote a data analytics approach and show the value
83		of analytical results.
84		- Targets: Must be set for key areas and risks that the analytics can
85		be compared against (KPIs).
86		- Analysts: There must be auditors willing and able to perform data
87		analytics or else the system cannot be sustained.
	74	- Enterprise-Wide Focus: Key data systems and analytical resources must be
	75	available for use (by the Internal Audit Function).
	76	- Leaders: Must promote a data analytics approach and show the value of
	77	analytical results.
	78	- Targets: Must be set for key areas and risks that the analytics can be
	79	compared against (KPIs).
	80	- Analysts: There must be auditors willing and able to perform data analytics
	81	or else the system cannot be sustained.
88	82
89	83	#+caption: The Delta Model
90	84	[[https://img.cleberg.net/blog/20190909-data-analysis-in-auditing/delta-min.png]]
91	85
92	86	* Finding the Proper KPIs
93		Once the Internal Audit Function has decided that they want to start
94		using data analytics internally and have ensured they're properly set up
95		to do so, they need to figure out what they will be testing against. Key
96		Performance Indicators (KPIs) are qualitative or quantitative factors
97		that can be evaluated and assessed to determine if the department is
98		performing well, usually compared to historical or industry benchmarks.
99		Once KPIs have been agreed upon and set, auditors can use data analytics
100		to assess and report on these KPIs. This allows the person performing
101		the analytics the freedom to express opinions on the results, whereas
102		the results are ambiguous if no KPIs exist.
103
104		It should be noted that tracking KPIs in the department can help ensure
105		you have a rigorous Quality Assurance and Improvement Program (QAIP) in
106		accordance with some applicable standards, such as IPPF Standard 1300.
	87	Once the Internal Audit Function has decided that they want to start using data
	88	analytics internally and have ensured they're properly set up to do so, they
	89	need to figure out what they will be testing against. Key Performance Indicators
	90	(KPIs) are qualitative or quantitative factors that can be evaluated and
	91	assessed to determine if the department is performing well, usually compared to
	92	historical or industry benchmarks. Once KPIs have been agreed upon and set,
	93	auditors can use data analytics to assess and report on these KPIs. This allows
	94	the person performing the analytics the freedom to express opinions on the
	95	results, whereas the results are ambiguous if no KPIs exist.
	96
	97	It should be noted that tracking KPIs in the department can help ensure you have
	98	a rigorous Quality Assurance and Improvement Program (QAIP) in accordance with
	99	some applicable standards, such as IPPF Standard 1300.
107	100
108	101	#+begin_quote
109		The chief audit executive must develop and maintain a quality assurance
110		and improvement program that covers all aspects of the internal audit
111		activity.
	102	The chief audit executive must develop and maintain a quality assurance and
	103	improvement program that covers all aspects of the internal audit activity.
112	104
113	105	- IPPF Standard 1300
114	106
		@@ -117,103 +109,94 @@ activity.
117	109	Additionally, IPPF Standard 2060 discusses reporting:
118	110
119	111	#+begin_quote
120		The chief audit executive must report periodically to senior management
121		and the board on the internal audit activity's purpose, authority,
122		responsibility, and performance relative to its plan and on its
123		conformance with the Code of Ethics and the Standards. Reporting must
124		also include significant risk and control issues, including fraud risks,
125		governance issues, and other matters that require the attention of
126		senior management and/or the board.
	112	The chief audit executive must report periodically to senior management and the
	113	board on the internal audit activity's purpose, authority, responsibility, and
	114	performance relative to its plan and on its conformance with the Code of Ethics
	115	and the Standards. Reporting must also include significant risk and control
	116	issues, including fraud risks, governance issues, and other matters that require
	117	the attention of senior management and/or the board.
127	118
128	119	- IPPF Standard 2060
129	120
130	121	#+end_quote
131	122
132		The hardest part of finding KPIs is to determine which KPIs are
133		appropriate for your department. Since every department is different and
134		has different goals, KPIs will vary drastically between companies. To
135		give you an idea of where to look, here are some ideas I came up with
136		when discussing the topic with a few colleagues.
	123	The hardest part of finding KPIs is to determine which KPIs are appropriate for
	124	your department. Since every department is different and has different goals,
	125	KPIs will vary drastically between companies. To give you an idea of where to
	126	look, here are some ideas I came up with when discussing the topic with a few
	127	colleagues.
137	128
138	129	- Efficiency/Budgeting:
139		- Audit hours to staff utilization ratio (annual hours divided by
140		total annual work hours).
	130	- Audit hours to staff utilization ratio (annual hours divided by total annual
	131	work hours).
141	132	- Audit hours compared to the number of audits completed.
142		- Time between audit steps or to complete the whole audit. E.g., time
143		from fieldwork completion to audit report issuance.
	133	- Time between audit steps or to complete the whole audit. E.g., time from
	134	fieldwork completion to audit report issuance.
144	135	- Reputation:
145	136	- The frequency that management has requested the services of the IAF.
146		- Management, audit committee, or external audit satisfaction survey
147		results.
148		- Education, experience, certifications, tenure, and training of the
149		auditors on staff.
	137	- Management, audit committee, or external audit satisfaction survey results.
	138	- Education, experience, certifications, tenure, and training of the auditors
	139	on staff.
150	140	- Quality:
151		- Number and frequency of audit findings. Assign monetary or numerical
152		values, if possible.
	141	- Number and frequency of audit findings. Assign monetary or numerical values,
	142	if possible.
153	143	- Percentage of recommendations issued and implemented.
154	144	- Planning:
155	145	- Percentage or number of key risks audited per year or per audit.
156	146	- Proportion of audit universe audited per year.
157	147
158	148	* Data Analysis Tools
159		Finally, to be able to analyze and report on the data analysis, auditors
160		need to evaluate the tools at their disposal. There are many options
161		available, but a few of the most common ones can easily get the job
162		done. For example, almost every auditor already has access to Microsoft
163		Excel. Excel is more powerful than most people give it credit for and
164		can accomplish a lot of basic statistics without much work. If you don't
165		know a lot about statistics but still want to see some of the more basic
166		results, Excel is a great option.
167
168		To perform more in-depth statistical analysis or to explore large
169		datasets that Excel cannot handle, auditors will need to explore other
170		options. The big three that have had a lot of success in recent years
171		are Python, R, and ACL. ACL can be used as either a graphical tool
172		(point and click) or as a scripting tool, where the auditor must write
173		the scripts manually. Python and the R-language are solely scripting
174		languages.
175
176		The general trend in the data analytics environment is that if the tool
177		allows you to do everything by clicking buttons or dragging elements,
178		you won't be able to fully utilize the analytics you need. The most
179		robust solutions are created by those who understand how to write the
180		scripts manually. It should be noted that as the utility of a tool
181		increases, it usually means that the learning curve for that tool will
182		also be higher. It will take auditors longer to learn how to utilize
183		Python, R, or ACL versus learning how to utilize Excel.
	149	Finally, to be able to analyze and report on the data analysis, auditors need to
	150	evaluate the tools at their disposal. There are many options available, but a
	151	few of the most common ones can easily get the job done. For example, almost
	152	every auditor already has access to Microsoft Excel. Excel is more powerful than
	153	most people give it credit for and can accomplish a lot of basic statistics
	154	without much work. If you don't know a lot about statistics but still want to
	155	see some of the more basic results, Excel is a great option.
	156
	157	To perform more in-depth statistical analysis or to explore large datasets that
	158	Excel cannot handle, auditors will need to explore other options. The big three
	159	that have had a lot of success in recent years are Python, R, and ACL. ACL can
	160	be used as either a graphical tool (point and click) or as a scripting tool,
	161	where the auditor must write the scripts manually. Python and the R-language are
	162	solely scripting languages.
	163
	164	The general trend in the data analytics environment is that if the tool allows
	165	you to do everything by clicking buttons or dragging elements, you won't be able
	166	to fully utilize the analytics you need. The most robust solutions are created
	167	by those who understand how to write the scripts manually. It should be noted
	168	that as the utility of a tool increases, it usually means that the learning
	169	curve for that tool will also be higher. It will take auditors longer to learn
	170	how to utilize Python, R, or ACL versus learning how to utilize Excel.
184	171
185	172	* Visualization
186		Once an auditor has finally found the right data, KPIs, and tools, they
187		must report these results so that actions can be taken. Performing
188		in-depth data analysis is only useful if the results are understood by
189		the audiences of the data. The best way to create this understanding is
190		to visualize the results of the data. Let's take a look at some of the
191		best options to visualize and report the results you've found.
192
193		Some of the most popular commercial tools for visualization are
194		Microsoft PowerBI and Tableau Desktop. However, other tools exist such
195		as JMP, Plotly, Qlikview, Alteryx, or D3. Some require commercial
196		licenses while others are simply free to use. For corporate data, you
197		may want to make sure that the tool does not communicate any of the data
198		outside the company (such as cloud storage). I won't be going into depth
199		on any of these tools since visualization is largely a subjective and
200		creative experience, but remember to constantly explore new options as
201		you repeat the process.
202
203		Lastly, let's take a look at an example of data visualization. This
204		example comes from a
205		[[https://talent.works/2018/03/28/the-science-of-the-job-search-part-iii-61-of-entry-level-jobs-require-3-years-of-experience/][blog
206		post written by Kushal Chakrabarti]] in 2018 about the percent of
207		entry-level US jobs that require experience. Figure 3* shows us an
208		easy-to-digest picture of the data. We can quickly tell that only about
209		12.5% of entry-level jobs don't require experience.
210
211		This is the kind of result that easily describes the data for you.
212		However, make sure to include an explanation of what the results mean.
213		Don't let the reader assume what the data means, especially if it
214		relates to a complex subject. /Tell a story/ about the data and why the
215		results matter. For example, Figure 4* shows a part of the explanation
216		the author gives to illustrate his point.
	173	Once an auditor has finally found the right data, KPIs, and tools, they must
	174	report these results so that actions can be taken. Performing in-depth data
	175	analysis is only useful if the results are understood by the audiences of the
	176	data. The best way to create this understanding is to visualize the results of
	177	the data. Let's take a look at some of the best options to visualize and report
	178	the results you've found.
	179
	180	Some of the most popular commercial tools for visualization are Microsoft
	181	PowerBI and Tableau Desktop. However, other tools exist such as JMP, Plotly,
	182	Qlikview, Alteryx, or D3. Some require commercial licenses while others are
	183	simply free to use. For corporate data, you may want to make sure that the tool
	184	does not communicate any of the data outside the company (such as cloud
	185	storage). I won't be going into depth on any of these tools since visualization
	186	is largely a subjective and creative experience, but remember to constantly
	187	explore new options as you repeat the process.
	188
	189	Lastly, let's take a look at an example of data visualization. This example
	190	comes from a [[https://talent.works/2018/03/28/the-science-of-the-job-search-part-iii-61-of-entry-level-jobs-require-3-years-of-experience/][blog post written by Kushal Chakrabarti]] in 2018 about the percent
	191	of entry-level US jobs that require experience. Figure 3* shows us an
	192	easy-to-digest picture of the data. We can quickly tell that only about 12.5% of
	193	entry-level jobs don't require experience.
	194
	195	This is the kind of result that easily describes the data for you. However, make
	196	sure to include an explanation of what the results mean. Don't let the reader
	197	assume what the data means, especially if it relates to a complex subject. /Tell
	198	a story/ about the data and why the results matter. For example, Figure 4*
	199	shows a part of the explanation the author gives to illustrate his point.
217	200
218	201	#+caption: Entry-Level Visualization
219	202	[[https://img.cleberg.net/blog/20190909-data-analysis-in-auditing/vis_example-min.png]]
		@@ -222,8 +205,7 @@ the author gives to illustrate his point.
222	205	[[https://img.cleberg.net/blog/20190909-data-analysis-in-auditing/vis_example_explanation-min.png]]
223	206
224	207	* Wrap-Up
225		While this is not an all-encompassing program that you can just adopt
226		into your department, it should be enough to get anyone started on the
227		process of understanding and implementing data analytics. Always
228		remember to continue learning and exploring new options as your
229		processes grow and evolve.
	208	While this is not an all-encompassing program that you can just adopt into your
	209	department, it should be enough to get anyone started on the process of
	210	understanding and implementing data analytics. Always remember to continue
	211	learning and exploring new options as your processes grow and evolve.

content/blog/2019-12-03-the-ansoff-matrix.org +78 −90

		@@ -4,114 +4,102 @@
4	4	#+filetags: :business:
5	5
6	6	* Overview
7		As the world of business evolves, managers must approach business
8		planning and strategy with a contemporary mindset. According to Dess,
9		McNamara, Eisner, and Lee, managers must be willing to adapt to the
10		modern business environment by going beyond "'incremental management',
11		whereby they view their job as making a series of small, minor changes
12		to improve the efficiency of the firm's operations"(2019).
	7	As the world of business evolves, managers must approach business planning and
	8	strategy with a contemporary mindset. According to Dess, McNamara, Eisner, and
	9	Lee, managers must be willing to adapt to the modern business environment by
	10	going beyond "'incremental management', whereby they view their job as making a
	11	series of small, minor changes to improve the efficiency of the firm's
	12	operations"(2019).
13	13
14		One reason that strategic management is crucial is because most
15		businesses that fail in the United States each year fail due to a lack
16		of strategic focus or direction(2019). The rate of failure for
17		businesses with poor strategies shows that strategic planning and
18		management are crucial to a business's strength and longevity, injecting
19		the critical factors of growth and direction into a company's business
20		plan.
	14	One reason that strategic management is crucial is because most businesses that
	15	fail in the United States each year fail due to a lack of strategic focus or
	16	direction(2019). The rate of failure for businesses with poor strategies shows
	17	that strategic planning and management are crucial to a business's strength and
	18	longevity, injecting the critical factors of growth and direction into a
	19	company's business plan.
21	20
22		One of the most significant strategic planning and management frameworks
23		that companies can use is the
24		[[https://en.wikipedia.org/wiki/Ansoff_matrix][Ansoff Matrix]]. While
25		this framework has unique purposes and use-cases, it can effectively
26		help an organization grow and compete. Specifically, the Ansoff matrix
27		is one of the most effective frameworks for companies who want to focus
28		on increasing sales revenue or profitability(2019).
	21	One of the most significant strategic planning and management frameworks that
	22	companies can use is the [[https://en.wikipedia.org/wiki/Ansoff_matrix][Ansoff Matrix]]. While this framework has unique purposes
	23	and use-cases, it can effectively help an organization grow and compete.
	24	Specifically, the Ansoff matrix is one of the most effective frameworks for
	25	companies who want to focus on increasing sales revenue or profitability(2019).
29	26
30		This framework uses a two-by-two figure to show the four strategic
31		options for companies to use in this framework: market penetration,
32		market development, product development, and diversification (see
33		Figure 1). The x-axis of the matrix focuses on the firm's markets and
34		also determines if the firm is looking to enter new markets or innovate
35		in its current markets. The y-axis of the matrix focuses on the firm's
36		products and determines if the firm wants to pursue strategies around
37		their existing products or explore new products.
	27	This framework uses a two-by-two figure to show the four strategic options for
	28	companies to use in this framework: market penetration, market development,
	29	product development, and diversification (see Figure 1). The x-axis of the
	30	matrix focuses on the firm's markets and also determines if the firm is looking
	31	to enter new markets or innovate in its current markets. The y-axis of the
	32	matrix focuses on the firm's products and determines if the firm wants to pursue
	33	strategies around their existing products or explore new products.
38	34
39	35	#+caption: The Ansoff Matrix by JaisonAbeySabu, Own work, CC BY-SA 3.0
40	36	[[https://img.cleberg.net/blog/20191203-the-ansoff-matrix/ansoff_matrix-min.png]]
41	37
42	38	* Strategic Options
43	39	** Market Penetration
44		The most straightforward strategy in the Ansoff matrix is to focus on
45		existing products in existing markets, also known as market
46		penetration(2019). Companies such as Coca-Cola have used market
47		penetration successfully by investing a lot of money to get further
48		value out of their current markets. Coca-Cola does this by introducing
49		new features such as Christmas-themed bottles, personal names on the
50		bottles, and other marketing schemes.
	40	The most straightforward strategy in the Ansoff matrix is to focus on existing
	41	products in existing markets, also known as market penetration(2019). Companies
	42	such as Coca-Cola have used market penetration successfully by investing a lot
	43	of money to get further value out of their current markets. Coca-Cola does this
	44	by introducing new features such as Christmas-themed bottles, personal names on
	45	the bottles, and other marketing schemes.
51	46
52	47	** Market Development
53		Market development extends existing products into new markets in an
54		attempt to increase the number of buyers. One interesting way that
55		Coca-Cola used this strategy comes from the stigma that Diet Coke is a
56		woman's drink(2019). Coca-Cola introduced Coca-Cola Zero, which
57		contained the same nutritional content as Diet Coke, but was packaged in
58		a dark black can to appear more "manly"(2019).
	48	Market development extends existing products into new markets in an attempt to
	49	increase the number of buyers. One interesting way that Coca-Cola used this
	50	strategy comes from the stigma that Diet Coke is a woman's drink(2019).
	51	Coca-Cola introduced Coca-Cola Zero, which contained the same nutritional
	52	content as Diet Coke, but was packaged in a dark black can to appear more
	53	"manly"(2019).
59	54
60	55	** Product Development
61		Product development uses existing markets to introduce new products so
62		that the firm can better meet customer needs(2019). The extreme end of
63		diversification is home to companies such as Johnson & Johnson, a
64		healthcare company that has developed a business portfolio of more than
65		60,000 different products(2019). Johnson & Johnson's dedication to
66		continuous diversification has led them to a balance sheet rating of
67		"AAA", industry recognition for diversification, and increases in their
68		investor dividends for 57 consecutive years(2019).
	56	Product development uses existing markets to introduce new products so that the
	57	firm can better meet customer needs(2019). The extreme end of diversification is
	58	home to companies such as Johnson & Johnson, a healthcare company that has
	59	developed a business portfolio of more than 60,000 different products(2019).
	60	Johnson & Johnson's dedication to continuous diversification has led them to a
	61	balance sheet rating of "AAA", industry recognition for diversification, and
	62	increases in their investor dividends for 57 consecutive years(2019).
69	63
70	64	** Related Diversification
71		Diversification, the final strategy of the Ansoff Matrix, is more
72		difficult than the others since it involves exploring both new markets
73		and new products. Related diversification is a diversification strategy
74		that closely relates to the firm's core business. Coca-Cola's best
75		example of related diversification is its acquisition of Glaceau and
76		Vitamin Water, which expanded their drinking lines of business(2019).
	65	Diversification, the final strategy of the Ansoff Matrix, is more difficult than
	66	the others since it involves exploring both new markets and new products.
	67	Related diversification is a diversification strategy that closely relates to
	68	the firm's core business. Coca-Cola's best example of related diversification is
	69	its acquisition of Glaceau and Vitamin Water, which expanded their drinking
	70	lines of business(2019).
77	71
78	72	** Unrelated Diversification
79		Unrelated diversification is a diversification strategy that does not
80		really relate to the firm's core business but still diversifies their
81		business portfolio. A good example of this would be a coffee company who
82		has decided to enter the market for bicycle sales. The main purpose of
83		this strategy is to an extremely diverse company that will not go
84		bankrupt if one market goes through difficult times. However, this
85		requires a lot of independent skills and heavy investments since the
86		company most likely cannot easily transfer knowledge between the markets
87		they compete in.
	73	Unrelated diversification is a diversification strategy that does not really
	74	relate to the firm's core business but still diversifies their business
	75	portfolio. A good example of this would be a coffee company who has decided to
	76	enter the market for bicycle sales. The main purpose of this strategy is to an
	77	extremely diverse company that will not go bankrupt if one market goes through
	78	difficult times. However, this requires a lot of independent skills and heavy
	79	investments since the company most likely cannot easily transfer knowledge
	80	between the markets they compete in.
88	81
89	82	* Requirements for Success
90		To use the Ansoff Matrix framework, managers need to formulate corporate
91		goals and objectives. Without goals and direction, management frameworks
92		do not present much practical utility. Further, the Ansoff Matrix
93		requires the managers involved to make tactical decisions and create a
94		path for the company to take toward their goals. Lastly, both the Ansoff
95		Matrix needs to consider both internal and external perspectives
96		throughout the strategy formulation process.
	83	To use the Ansoff Matrix framework, managers need to formulate corporate goals
	84	and objectives. Without goals and direction, management frameworks do not
	85	present much practical utility. Further, the Ansoff Matrix requires the managers
	86	involved to make tactical decisions and create a path for the company to take
	87	toward their goals. Lastly, both the Ansoff Matrix needs to consider both
	88	internal and external perspectives throughout the strategy formulation process.
97	89
98		One interesting probability is that companies will be using multiple
99		strategic planning and management frameworks at the same time. While
100		this may sound like it could crowd the management process, there are
101		numerous reasons to do so. For example, the Ansoff Matrix and the
102		Balanced Scorecard are relatively popular, and they cover entirely
103		different parts of a company's strategy. Using the results from the
104		Balanced Scorecard could inform a company of the potential product and
105		market demands, such as from customer or supplier survey results, to
106		help the company determine which Ansoff Matrix strategy to pursue.
107		However, a combined approach at this level would require mature
108		frameworks and focused managers who are able to strategize at a high
109		level.
	90	One interesting probability is that companies will be using multiple strategic
	91	planning and management frameworks at the same time. While this may sound like
	92	it could crowd the management process, there are numerous reasons to do so. For
	93	example, the Ansoff Matrix and the Balanced Scorecard are relatively popular,
	94	and they cover entirely different parts of a company's strategy. Using the
	95	results from the Balanced Scorecard could inform a company of the potential
	96	product and market demands, such as from customer or supplier survey results, to
	97	help the company determine which Ansoff Matrix strategy to pursue. However, a
	98	combined approach at this level would require mature frameworks and focused
	99	managers who are able to strategize at a high level.
110	100
111		Lastly, it should be noted that the author of the Ansoff matrix, Igor
112		Ansoff, often used the term
113		[[https://en.wikipedia.org/wiki/Analysis_paralysis][paralysis by
114		analysis]] to explain the mistake of companies who overuse analysis and
115		spend too much time planning. Companies need to understand the utility
116		of a strategic management framework while ensuring that the company is
117		poised to execute as efficiently as they have planned.
	101	Lastly, it should be noted that the author of the Ansoff matrix, Igor Ansoff,
	102	often used the term [[https://en.wikipedia.org/wiki/Analysis_paralysis][paralysis by analysis]] to explain the mistake of companies
	103	who overuse analysis and spend too much time planning. Companies need to
	104	understand the utility of a strategic management framework while ensuring that
	105	the company is poised to execute as efficiently as they have planned.

content/blog/2019-12-16-password-security.org +70 −88

		@@ -5,117 +5,99 @@
5	5
6	6	* Users
7	7	** Why Does It Matter?
8		Information security, including passwords and identities, has become one
9		of the most important digital highlights of the last decade. With
10		[[https://www.usatoday.com/story/money/2018/12/28/data-breaches-2018-billions-hit-growing-number-cyberattacks/2413411002/][billions
11		of people affected by data breaches each year]], there's a greater need
12		to introduce strong information security systems. If you think you've
13		been part of a breach, or you want to check and see, you can use
14		[[https://haveibeenpwned.com/][Have I Been Pwned]] to see if your email
15		has been involved in any public breaches. Remember that there's a
16		possibility that a company experienced a breach and did not report it to
17		anyone.
	8	Information security, including passwords and identities, has become one of the
	9	most important digital highlights of the last decade. With [[https://www.usatoday.com/story/money/2018/12/28/data-breaches-2018-billions-hit-growing-number-cyberattacks/2413411002/][billions of people
	10	affected by data breaches each year]], there's a greater need to introduce strong
	11	information security systems. If you think you've been part of a breach, or you
	12	want to check and see, you can use [[https://haveibeenpwned.com/][Have I Been Pwned]] to see if your email has
	13	been involved in any public breaches. Remember that there's a possibility that a
	14	company experienced a breach and did not report it to anyone.
18	15
19	16	** How Do I Protect Myself?
20		The first place to start with any personal security check-up is to
21		gather a list of all the different websites, apps, or programs that
22		require you to have login credentials. Optionally, once you know where
23		your information is being stored, you can sort the list from the
24		most-important items such as banks or government logins to less
25		important items such as your favorite meme site. You will want to ensure
26		that your critical logins are secure before getting to the others.
	17	The first place to start with any personal security check-up is to gather a list
	18	of all the different websites, apps, or programs that require you to have login
	19	credentials. Optionally, once you know where your information is being stored,
	20	you can sort the list from the most-important items such as banks or government
	21	logins to less important items such as your favorite meme site. You will want to
	22	ensure that your critical logins are secure before getting to the others.
27	23
28	24	Once you think you have a good idea of all your different authentication
29		methods, I recommend using a password manager such as
30		[[https://bitwarden.com/][Bitwarden]]. Using a password manager allows
31		you to automatically save your logins, create randomized passwords, and
32		transfer passwords across devices. However, you'll need to memorize your
33		"vault password" that allows you to open the password manager. It's
34		important to make this something hard to guess since it would allow
35		anyone who has it to access every password you've stored in there.
	25	methods, I recommend using a password manager such as [[https://bitwarden.com/][Bitwarden]]. Using a
	26	password manager allows you to automatically save your logins, create randomized
	27	passwords, and transfer passwords across devices. However, you'll need to
	28	memorize your "vault password" that allows you to open the password manager.
	29	It's important to make this something hard to guess since it would allow anyone
	30	who has it to access every password you've stored in there.
36	31
37		Personally, I recommend using a
38		[[https://en.wikipedia.org/wiki/Passphrase][passphrase]] instead of a
39		[[https://en.wikipedia.org/wiki/Password][password]] for your vault
40		password. Instead of using a string of characters (whether random or
41		simple), use a phrase and add in symbols and a number. For example, your
42		vault password could be =Racing-Alphabet-Gourd-Parrot3=. Swap the
43		symbols out for whichever symbol you want, move the number around, and
44		fine-tune the passphrase until you are confident that you can remember
45		it whenever necessary.
	32	Personally, I recommend using a [[https://en.wikipedia.org/wiki/Passphrase][passphrase]] instead of a [[https://en.wikipedia.org/wiki/Password][password]] for your vault
	33	password. Instead of using a string of characters (whether random or simple),
	34	use a phrase and add in symbols and a number. For example, your vault password
	35	could be =Racing-Alphabet-Gourd-Parrot3=. Swap the symbols out for whichever
	36	symbol you want, move the number around, and fine-tune the passphrase until you
	37	are confident that you can remember it whenever necessary.
46	38
47		Once you've stored your passwords, make sure you continually check up on
48		your account and make sure you aren't following bad password practices.
49		Krebs on Security has a great
50		[[https://krebsonsecurity.com/password-dos-and-donts/][blog post on
51		password recommendations]]. Any time that a data breach happens, make
52		sure you check to see if you were included, and if you need to reset any
53		account passwords.
	39	Once you've stored your passwords, make sure you continually check up on your
	40	account and make sure you aren't following bad password practices. Krebs on
	41	Security has a great [[https://krebsonsecurity.com/password-dos-and-donts/][blog post on password recommendations]]. Any time that a data
	42	breach happens, make sure you check to see if you were included, and if you need
	43	to reset any account passwords.
54	44
55	45	* Developers
56	46	** What Are the Basic Requirements?
57		When developing any password-protected application, there are a few
58		basic rules that anyone should follow even if they do not follow any
59		official guidelines such as NIST. The foremost practice is to require
60		users to use passwords that are at least 8 characters and cannot easily
61		be guessed. This sounds extremely simple, but it requires quite a few
62		different strategies. First, the application should check the potential
63		passwords against a dictionary of insecure passwords such =password=,
64		=1234abc=, or =application_name=.
	47	When developing any password-protected application, there are a few basic rules
	48	that anyone should follow even if they do not follow any official guidelines
	49	such as NIST. The foremost practice is to require users to use passwords that
	50	are at least 8 characters and cannot easily be guessed. This sounds extremely
	51	simple, but it requires quite a few different strategies. First, the application
	52	should check the potential passwords against a dictionary of insecure passwords
	53	such =password=, =1234abc=, or =application_name=.
65	54
66		Next, the application should offer guidance on the strength of passwords
67		being entered during enrollment. Further, NIST officially recommends
68		not* implementing any composition rules that make passwords hard to
69		remember (e.g. passwords with letters, numbers, and special characters)
70		and instead encouraging the use of long pass phrases which can include
71		spaces. It should be noted that to be able to keep spaces within
72		passwords, all unicode characters should be supported, and passwords
73		should not be truncated.
	55	Next, the application should offer guidance on the strength of passwords being
	56	entered during enrollment. Further, NIST officially recommends not*
	57	implementing any composition rules that make passwords hard to remember (e.g.
	58	passwords with letters, numbers, and special characters) and instead encouraging
	59	the use of long pass phrases which can include spaces. It should be noted that
	60	to be able to keep spaces within passwords, all unicode characters should be
	61	supported, and passwords should not be truncated.
74	62
75	63	** What Does NIST Recommend?
76		The National Institute of Standards and Technology
77		([[https://www.nist.gov][NIST]]) in the US Department of Commerce
78		regularly publishes information around information security and digital
79		identity guidelines. Recently, NIST published
80		[[https://pages.nist.gov/800-63-3/sp800-63b.html][Special Publication
	64	The National Institute of Standards and Technology ([[https://www.nist.gov][NIST]]) in the US Department
	65	of Commerce regularly publishes information around information security and
	66	digital identity guidelines. Recently, NIST published [[https://pages.nist.gov/800-63-3/sp800-63b.html][Special Publication
81	67	800-63b]]: Digital Identity Guidelines and Authentication and Lifecycle
82	68	Management.
83	69
84	70	#+begin_quote
85		A Memorized Secret authenticator - commonly referred to as a password
86		or, if numeric, a PIN - is a secret value intended to be chosen and
87		memorized by the user. Memorized secrets need to be of sufficient
88		complexity and secrecy that it would be impractical for an attacker to
89		guess or otherwise discover the correct secret value. A memorized secret
90		is something you know.
	71	A Memorized Secret authenticator - commonly referred to as a password or, if
	72	numeric, a PIN - is a secret value intended to be chosen and memorized by the
	73	user. Memorized secrets need to be of sufficient complexity and secrecy that it
	74	would be impractical for an attacker to guess or otherwise discover the correct
	75	secret value. A memorized secret is something you know.
91	76
92	77	- NIST Special Publication 800-63B
93	78	#+end_quote
94	79
95		NIST offers a lot of guidance on passwords, but I'm going to highlight
96		just a few of the important factors:
	80	NIST offers a lot of guidance on passwords, but I'm going to highlight just a
	81	few of the important factors:
97	82
98		- Require passwords to be a minimum of 8 characters (6 characters if
99		randomly generated and be generated using an approved random bit
100		generator).
101		- Compare potential passwords against a list that contains values known
102		to be commonly-used, expected, or compromised.
	83	- Require passwords to be a minimum of 8 characters (6 characters if randomly
	84	generated and be generated using an approved random bit generator).
	85	- Compare potential passwords against a list that contains values known to be
	86	commonly-used, expected, or compromised.
103	87	- Offer guidance on password strength, such as a strength meter.
104	88	- Implement a rate-limiting mechanism to limit the number of failed
105	89	authentication attempts for each user account.
106		- Do not require composition rules for passwords and do not require
107		passwords to be changed periodically (unless compromised).
108		- Allow pasting of user identification and passwords to facilitate the
109		use of password managers.
	90	- Do not require composition rules for passwords and do not require passwords to
	91	be changed periodically (unless compromised).
	92	- Allow pasting of user identification and passwords to facilitate the use of
	93	password managers.
110	94	- Allow users to view the password as it is being entered.
111		- Use secure forms of communication and storage, including salting and
112		hashing passwords using a one-way key derivation function.
	95	- Use secure forms of communication and storage, including salting and hashing
	96	passwords using a one-way key derivation function.
113	97
114		NIST offers further guidance on other devices that require specific
115		security policies, querying for passwords, and more. All the information
116		discussed so far comes from
117		[[https://pages.nist.gov/800-63-3/sp800-63b.html][NIST SP800-63b]] but
118		NIST offers a lot of information on digital identities, enrollment,
119		identity proofing, authentication, lifecycle management, federation, and
120		assertions in the total [[https://pages.nist.gov/800-63-3/][NIST
121		SP800-63 Digital Identity Guidelines]].
	98	NIST offers further guidance on other devices that require specific security
	99	policies, querying for passwords, and more. All the information discussed so far
	100	comes from [[https://pages.nist.gov/800-63-3/sp800-63b.html][NIST SP800-63b]] but NIST offers a lot of information on digital
	101	identities, enrollment, identity proofing, authentication, lifecycle management,
	102	federation, and assertions in the total [[https://pages.nist.gov/800-63-3/][NIST SP800-63 Digital Identity
	103	Guidelines]].

content/blog/2020-01-25-linux-software.org +64 −86

		@@ -8,24 +8,22 @@
8	8	#+caption: Etcher Screenshot
9	9	[[https://img.cleberg.net/blog/20200125-the-best-linux-software/etcher.png]]
10	10
11		[[https://www.balena.io/etcher/][Etcher]] is a quick and easy way to
12		burn ISO images to CDs and USB devices. There are two different ways you
13		can install this program. First, you can navigate to the
14		[[https://www.balena.io/etcher/][official website]] and download the
15		AppImage file, which can run without installation.
16
17		However, AppImage files are not executable by default, so you'll either
18		need to right-click to open the properties of the file and click the
19		"Allow executing file as program" box in the Permissions tab or use the
20		following command:
	11	[[https://www.balena.io/etcher/][Etcher]] is a quick and easy way to burn ISO images to CDs and USB devices. There
	12	are two different ways you can install this program. First, you can navigate to
	13	the [[https://www.balena.io/etcher/][official website]] and download the AppImage file, which can run without
	14	installation.
	15
	16	However, AppImage files are not executable by default, so you'll either need to
	17	right-click to open the properties of the file and click the "Allow executing
	18	file as program" box in the Permissions tab or use the following command:
21	19
22	20	#+begin_src sh
23	21	chmod u+x FILE_NAME
24	22	#+end_src
25	23
26		If you don't like AppImage files or just prefer repositories, you can
27		use the following commands to add the author's repository and install it
28		through the command-line only.
	24	If you don't like AppImage files or just prefer repositories, you can use the
	25	following commands to add the author's repository and install it through the
	26	command-line only.
29	27
30	28	First, you'll have to echo the repo and write it to a list file:
31	29
		@@ -45,8 +43,7 @@ Finally, update the repositories and install the app.
45	43	sudo apt update && sudo apt install balena-etcher-electron
46	44	#+end_src
47	45
48		Using Arch, Manjaro, or another distro using the AUR? Use this command
49		instead:
	46	Using Arch, Manjaro, or another distro using the AUR? Use this command instead:
50	47
51	48	#+begin_src sh
52	49	sudo pacman -S etcher
		@@ -56,11 +53,9 @@ sudo pacman -S etcher
56	53	#+caption: Atom Screenshot
57	54	[[https://img.cleberg.net/blog/20200125-the-best-linux-software/atom.png]]
58	55
59		[[https://atom.io][Atom]] is the self-proclaimed "hackable text editor
60		for the 21st century". This text editor is made by GitHub,
61		[[https://news.microsoft.com/2018/06/04/microsoft-to-acquire-github-for-7-5-billion/][now
62		owned by Microsoft]], and has some of the best add-ons available to
63		customize the layout and abilities of the app.
	56	[[https://atom.io][Atom]] is the self-proclaimed "hackable text editor for the 21st century". This
	57	text editor is made by GitHub, [[https://news.microsoft.com/2018/06/04/microsoft-to-acquire-github-for-7-5-billion/][now owned by Microsoft]], and has some of the best
	58	add-ons available to customize the layout and abilities of the app.
64	59
65	60	First, add the Atom repository to your sources.
66	61
		@@ -74,26 +69,23 @@ Next, update your package listings and install atom.
74	69	sudo apt update && sudo apt install atom
75	70	#+end_src
76	71
77		If you have issues updating your packages with the Atom repository,
78		you'll need to use the snap package described below instead of the
79		repository. To remove the repository we just added, use this command:
	72	If you have issues updating your packages with the Atom repository, you'll need
	73	to use the snap package described below instead of the repository. To remove the
	74	repository we just added, use this command:
80	75
81	76	#+begin_src sh
82	77	sudo add-apt-repository -r ppa:webupd8team/atom
83	78	#+end_src
84	79
85		You can also install Atom as a snap package, but it must be installed
86		with the =--classic= flag. A
87		[[https://language-bash.com/blog/how-to-snap-introducing-classic-confinement][full
88		explanation is available]] if you'd like to read more about why you need
89		the classic flag.
	80	You can also install Atom as a snap package, but it must be installed with the
	81	=--classic= flag. A [[https://language-bash.com/blog/how-to-snap-introducing-classic-confinement][full explanation is available]] if you'd like to read more
	82	about why you need the classic flag.
90	83
91	84	#+begin_src sh
92	85	snap install atom --classic
93	86	#+end_src
94	87
95		Using Arch, Manjaro, or another distro using the AUR? Use this command
96		instead:
	88	Using Arch, Manjaro, or another distro using the AUR? Use this command instead:
97	89
98	90	#+begin_src sh
99	91	sudo pacman -S atom
		@@ -103,28 +95,23 @@ sudo pacman -S atom
103	95	#+caption: Visual Studio Code Code
104	96	[[https://img.cleberg.net/blog/20200125-the-best-linux-software/vscode.png]]
105	97
106		[[https://code.visualstudio.com][Visual Studio Code]] is yet another
107		fantastic choice for programming on Linux, especially if you need those
108		extra add-ons to spice up your late-night coding sessions. The theme
109		used in the screenshot is
110		[[https://marketplace.visualstudio.com/items?itemName=EliverLara.mars][Mars]]
111		by theme creator [[https://github.com/EliverLara][Eliver Lara]], who
112		makes a ton of great themes for VS Code, Atom, and various Linux desktop
	98	[[https://code.visualstudio.com][Visual Studio Code]] is yet another fantastic choice for programming on Linux,
	99	especially if you need those extra add-ons to spice up your late-night coding
	100	sessions. The theme used in the screenshot is [[https://marketplace.visualstudio.com/items?itemName=EliverLara.mars][Mars]] by theme creator [[https://github.com/EliverLara][Eliver Lara]],
	101	who makes a ton of great themes for VS Code, Atom, and various Linux desktop
113	102	environments.
114	103
115		To install VS Code, you'll need to download the =.deb= file from the
116		official website. Once you've downloaded the file, either double-click
117		it to install through the Software Center or run the following command:
	104	To install VS Code, you'll need to download the =.deb= file from the official
	105	website. Once you've downloaded the file, either double-click it to install
	106	through the Software Center or run the following command:
118	107
119	108	#+begin_src sh
120	109	sudo dpkg -i FILE_NAME.deb
121	110	#+end_src
122	111
123		You can also install VS Code as a snap package, but it must be installed
124		with the =--classic= flag. A
125		[[https://language-bash.com/blog/how-to-snap-introducing-classic-confinement][full
126		explanation is available]] if you'd like to read more about why you need
127		the classic flag.
	112	You can also install VS Code as a snap package, but it must be installed with
	113	the =--classic= flag. A [[https://language-bash.com/blog/how-to-snap-introducing-classic-confinement][full explanation is available]] if you'd like to read more
	114	about why you need the classic flag.
128	115
129	116	#+begin_src sh
130	117	snap install code --classic
		@@ -141,19 +128,18 @@ sudo pacman -S yay binutils make gcc pkg-config fakeroot yay -S visual-studio-co
141	128	#+caption: Gnome Tweaks Screenshot
142	129	[[https://img.cleberg.net/blog/20200125-the-best-linux-software/gnome-tweaks.png]]
143	130
144		[[https://gitlab.gnome.org/GNOME/gnome-tweaks][Gnome Tweaks]] is the
145		ultimate tool to use if you want to customize your GNOME desktop
146		environment. This is how you can switch application themes (GTK), shell
147		themes, icons, fonts, and more. To install GNOME Tweaks on Ubuntu, you
148		just need to install the official package.
	131	[[https://gitlab.gnome.org/GNOME/gnome-tweaks][Gnome Tweaks]] is the ultimate tool to use if you want to customize your GNOME
	132	desktop environment. This is how you can switch application themes (GTK), shell
	133	themes, icons, fonts, and more. To install GNOME Tweaks on Ubuntu, you just need
	134	to install the official package.
149	135
150	136	#+begin_src sh
151	137	sudo apt install gnome-tweaks
152	138	#+end_src
153	139
154		If you've installed Manjaro or Arch with Gnome, you should have the
155		tweak tool pre-installed. If you're on Fedora, this tool is available as
156		an official package:
	140	If you've installed Manjaro or Arch with Gnome, you should have the tweak tool
	141	pre-installed. If you're on Fedora, this tool is available as an official
	142	package:
157	143
158	144	#+begin_src sh
159	145	sudo dnf install gnome-tweaks
		@@ -163,22 +149,20 @@ sudo dnf install gnome-tweaks
163	149	#+caption: Steam Screenshot
164	150	[[https://img.cleberg.net/blog/20200125-the-best-linux-software/steam.png]]
165	151
166		[[https://steampowered.com][Steam]] is one of the most popular gaming
167		libraries for computers and is one of the main reasons that many people
168		have been able to switch to Linux in recent years, thanks to Steam
169		Proton, which makes it easier to play games not officially created for
170		Linux platforms.
	152	[[https://steampowered.com][Steam]] is one of the most popular gaming libraries for computers and is one of
	153	the main reasons that many people have been able to switch to Linux in recent
	154	years, thanks to Steam Proton, which makes it easier to play games not
	155	officially created for Linux platforms.
171	156
172		To install Steam on Ubuntu, you just need to install the official
173		package.
	157	To install Steam on Ubuntu, you just need to install the official package.
174	158
175	159	#+begin_src sh
176	160	sudo apt install steam-installer
177	161	#+end_src
178	162
179		For Arch-based systems, you'll simply need to install the =steam=
180		package. However, this requires that you enable the =multilib= source.
181		To do so, use the following command:
	163	For Arch-based systems, you'll simply need to install the =steam= package.
	164	However, this requires that you enable the =multilib= source. To do so, use the
	165	following command:
182	166
183	167	#+begin_src sh
184	168	sudo nano /etc/pacman.conf
		@@ -210,27 +194,25 @@ Click Here.]]
210	194	#+caption: Neofetch Screenshot
211	195	[[https://img.cleberg.net/blog/20200125-the-best-linux-software/neofetch.png]]
212	196
213		[[https://github.com/dylanaraps/neofetch][Neofetch]] is a customizable
214		tool used in the command-line to show system information. This is
215		exceptionally useful if you want to see your system's information
216		quickly without the clutter of some resource-heavy GUI apps.
	197	[[https://github.com/dylanaraps/neofetch][Neofetch]] is a customizable tool used in the command-line to show system
	198	information. This is exceptionally useful if you want to see your system's
	199	information quickly without the clutter of some resource-heavy GUI apps.
217	200
218		This is an official package if you're running Ubuntu 17.04 or later, so
219		simply use the following command:
	201	This is an official package if you're running Ubuntu 17.04 or later, so simply
	202	use the following command:
220	203
221	204	#+begin_src sh
222	205	sudo apt install neofetch
223	206	#+end_src
224	207
225		If you're running Ubuntu 16.10 or earlier, you'll have to use a series
226		of commands:
	208	If you're running Ubuntu 16.10 or earlier, you'll have to use a series of
	209	commands:
227	210
228	211	#+begin_src sh
229	212	sudo add-apt-repository ppa:dawidd0811/neofetch; sudo apt update; sudo apt install neofetch
230	213	#+end_src
231	214
232		Using Arch, Manjaro, or another distro using the AUR? Use this command
233		instead:
	215	Using Arch, Manjaro, or another distro using the AUR? Use this command instead:
234	216
235	217	#+begin_src sh
236	218	sudo pacman -S neofetch
		@@ -240,31 +222,27 @@ sudo pacman -S neofetch
240	222	#+caption: yt-dlp Screenshot
241	223	[[https://img.cleberg.net/blog/20200125-the-best-linux-software/yt-dlp.png]]
242	224
243		[[https://github.com/yt-dlp/yt-dlp][yt-dlp]] is an extremely handy
244		command-line tool that allows you to download video or audio files from
245		various websites, such as YouTube. There are a ton of different options
246		when running this package, so be sure to run =yt-dlp --help= first to
247		look through everything you can do (or give up and search for the best
	225	[[https://github.com/yt-dlp/yt-dlp][yt-dlp]] is an extremely handy command-line tool that allows you to download video
	226	or audio files from various websites, such as YouTube. There are a ton of
	227	different options when running this package, so be sure to run =yt-dlp --help=
	228	first to look through everything you can do (or give up and search for the best
248	229	config online).
249	230
250		While this shouldn't be a problem for most users, yt-dlp requires Python
251		2.6, 2.7, or 3.2+ to work correctly, so install Python if you don't have
252		it already. You can check to see if you have Python installed by
253		running:
	231	While this shouldn't be a problem for most users, yt-dlp requires Python 2.6,
	232	2.7, or 3.2+ to work correctly, so install Python if you don't have it already.
	233	You can check to see if you have Python installed by running:
254	234
255	235	#+begin_src sh
256	236	python -V
257	237	#+end_src
258	238
259		To get the youtube-dl package, simply curl the URL and output the
260		results.
	239	To get the youtube-dl package, simply curl the URL and output the results.
261	240
262	241	#+begin_src sh
263	242	sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
264	243	#+end_src
265	244
266		Finally, make the file executable so that it can be run from the
267		command-line.
	245	Finally, make the file executable so that it can be run from the command-line.
268	246
269	247	#+begin_src sh
270	248	sudo chmod a+rx /usr/local/bin/yt-dlp

content/blog/2020-01-26-steam-on-ntfs.org +28 −30

		@@ -7,28 +7,28 @@
7	7	#+caption: Steam Screenshot
8	8	[[https://img.cleberg.net/blog/20200125-the-best-linux-software/steam.png]]
9	9
10		If you want to see how to install Steam on Linux, see my other post:
11		[[../linux-software/][Linux Software]].
	10	If you want to see how to install Steam on Linux, see my other post: [[../linux-software/][Linux
	11	Software]].
12	12
13		Are you having trouble launching games, even though they've installed
14		correctly? This may happen if you're storing your games on an
15		NTFS-formatted drive. This shouldn't be an issue if you're storing your
16		games on the same drive that Steam is on, but some gamers prefer to put
17		Steam on their main drive and game files on another SSD or HDD.
	13	Are you having trouble launching games, even though they've installed correctly?
	14	This may happen if you're storing your games on an NTFS-formatted drive. This
	15	shouldn't be an issue if you're storing your games on the same drive that Steam
	16	is on, but some gamers prefer to put Steam on their main drive and game files on
	17	another SSD or HDD.
18	18
19		To fix this problem, you'll need to try a few things. First, you'll need
20		to install the =ntfs-3g= package, which is meant for better
21		interoperability with Linux.
	19	To fix this problem, you'll need to try a few things. First, you'll need to
	20	install the =ntfs-3g= package, which is meant for better interoperability with
	21	Linux.
22	22
23	23	#+begin_src sh
24	24	sudo apt install ntfs-3g
25	25	#+end_src
26	26
27		Next, you should set up the =/etc/fstab= file to automatically mount
28		your drives on boot. To automatically mount your drives when the
29		computer boots up, you'll have to create the folders you want to mount
30		your drive to first. I store mine in the =/mnt= folder using names that
31		I'll recognize, but you can create your folders wherever you want.
	27	Next, you should set up the =/etc/fstab= file to automatically mount your drives
	28	on boot. To automatically mount your drives when the computer boots up, you'll
	29	have to create the folders you want to mount your drive to first. I store mine
	30	in the =/mnt= folder using names that I'll recognize, but you can create your
	31	folders wherever you want.
32	32
33	33	#+begin_src sh
34	34	mkdir /path/to/folder
		@@ -40,14 +40,13 @@ For example:
40	40	mkdir /mnt/steam_library
41	41	#+end_src
42	42
43		To automatically mount drives upon system boot, you will need to collect
44		a few items. The UUID is the identification number connected to
45		whichever drive you're using to store Steam games.
	43	To automatically mount drives upon system boot, you will need to collect a few
	44	items. The UUID is the identification number connected to whichever drive you're
	45	using to store Steam games.
46	46
47		Drives are usually labeled similar to =/dev/nvme0n1p1= or =/dev/sda1=,
48		so you'll need to find the line in the output of the command below that
49		correlates to your drive and copy the UUID over to the =/etc/fstab=
50		file.
	47	Drives are usually labeled similar to =/dev/nvme0n1p1= or =/dev/sda1=, so you'll
	48	need to find the line in the output of the command below that correlates to your
	49	drive and copy the UUID over to the =/etc/fstab= file.
51	50
52	51	#+begin_src sh
53	52	sudo blkid \| grep UUID=
		@@ -60,8 +59,8 @@ command:
60	59	id -u && id -g
61	60	#+end_src
62	61
63		Now that you have collected the necessary information, open the
64		=/etc/fstab= file:
	62	Now that you have collected the necessary information, open the =/etc/fstab=
	63	file:
65	64
66	65	#+begin_src sh
67	66	sudo nano /etc/fstab
		@@ -74,9 +73,8 @@ Each drive you want to mount on boot should have its own line in the
74	73	UUID=B64E53824E5339F7 /mnt/steam_library ntfs-3g uid=1000,gid=1000 0 0
75	74	#+end_src
76	75
77		Now all you need to do is unmount your drive and re-mount it. You can
78		unmount the drive by doing this (be sure to use the correct drive name
79		here):
	76	Now all you need to do is unmount your drive and re-mount it. You can unmount
	77	the drive by doing this (be sure to use the correct drive name here):
80	78
81	79	#+begin_src sh
82	80	sudo umount /dev/sdxX
		@@ -88,6 +86,6 @@ You can re-mount all your drives by executing the following:
88	86	sudo mount -a
89	87	#+end_src
90	88
91		If you don't know what your drive name is, or you're nervous about
92		unmounting and re-mounting, simply reboot your computer, and it will be
93		done for you automatically.
	89	If you don't know what your drive name is, or you're nervous about unmounting
	90	and re-mounting, simply reboot your computer, and it will be done for you
	91	automatically.

content/blog/2020-02-09-cryptography-basics.org +125 −138

		@@ -4,168 +4,155 @@
4	4	#+filetags: :security:
5	5
6	6	* Similar Article Available
7		If you haven't already, feel free to read my post on
8		[[../aes-encryption/][AES Encryption]].
	7	If you haven't already, feel free to read my post on [[../aes-encryption/][AES Encryption]].
9	8
10	9	* What is Cryptography?
11	10	In layman's terms, cryptography is a process that can change data from a
12		readable format into an unreadable format (and vice-versa) through a
13		series of processes and secrets. More technically, this is the Internet
14		Security Glossary's definition:
	11	readable format into an unreadable format (and vice-versa) through a series of
	12	processes and secrets. More technically, this is the Internet Security
	13	Glossary's definition:
15	14
16	15	#+begin_quote
17		[Cryptography is] the mathematical science that deals with transforming
18		data to render its meaning unintelligible (i.e., to hide its semantic
19		content), prevent its undetected alteration, or prevent its unauthorized
20		use. If the transformation is reversible, cryptography also deals with
21		restoring encrypted data to an intelligible form.
22
23		- [[https://tools.ietf.org/html/rfc2828][Internet Security Glossary
24		(2000)]]
	16	[Cryptography is] the mathematical science that deals with transforming data to
	17	render its meaning unintelligible (i.e., to hide its semantic content), prevent
	18	its undetected alteration, or prevent its unauthorized use. If the
	19	transformation is reversible, cryptography also deals with restoring encrypted
	20	data to an intelligible form.
25	21
	22	- [[https://tools.ietf.org/html/rfc2828][Internet Security Glossary (2000)]]
26	23	#+end_quote
27	24
28		Cryptography cannot offer protection against the loss of data; it simply
29		offers encryption methods to protect data at-rest and data in-traffic.
30		At a high-level, encrypted is when plaintext data is encrypted to
31		ciphertext (a secure form of text that cannot be understood unless
32		decrypted back to plaintext). The encryption process is completed
33		through the use of a mathematical function that utilizes one or more
34		values called keys to encrypt or decrypt the data.
	25	Cryptography cannot offer protection against the loss of data; it simply offers
	26	encryption methods to protect data at-rest and data in-traffic. At a high-level,
	27	encrypted is when plaintext data is encrypted to ciphertext (a secure form of
	28	text that cannot be understood unless decrypted back to plaintext). The
	29	encryption process is completed through the use of a mathematical function that
	30	utilizes one or more values called keys to encrypt or decrypt the data.
35	31
36	32	* Key Elements of Cryptographic Systems
37		To create or evaluate a cryptographic system, you need to know the
38		essential pieces to the system:
39
40		- Encryption Algorithm (Primitive):* A mathematical process that
41		encrypts and decrypts data.
42		- Encryption Key:* A string of bits used within the encryption
43		algorithm as the secret that allows successful encryption or
44		decryption of data.
45		- Key Length (Size):* The maximum number of bits within the encryption
46		key. It's important to remember that key size is regulated in many
47		countries.
48		- Message Digest:* A smaller, fixed-size bit string version of the
49		original message. This is practically infeasible to reverse, which is
50		why it's commonly used to verify integrity.
	33	To create or evaluate a cryptographic system, you need to know the essential
	34	pieces to the system:
	35
	36	- Encryption Algorithm (Primitive):* A mathematical process that encrypts and
	37	decrypts data.
	38	- Encryption Key:* A string of bits used within the encryption algorithm as
	39	the secret that allows successful encryption or decryption of data.
	40	- Key Length (Size):* The maximum number of bits within the encryption key.
	41	It's important to remember that key size is regulated in many countries.
	42	- Message Digest:* A smaller, fixed-size bit string version of the original
	43	message. This is practically infeasible to reverse, which is why it's commonly
	44	used to verify integrity.
51	45
52	46	* Symmetric Systems (Secret Key Cryptography)
53		Symmetric cryptography utilizes a secret, bidirectional key to perform
54		both encryption and decryption of the data. The most common
55		implementation of symmetric cryptography is the Advanced Encryption
56		Standard, which uses keys that are 128 bits to 256 bits in size. This
57		standard came after the National Institute of Standards and Technology
58		(NIST) decided to retire the Data Encryption Standard (DES) in 2001.
59
60		Since brute force attacks strongly correlate with key length, the 56-bit
61		key length of DES was considered insecure after it was publicly broken
62		in under 24 hours. However, there is a modern implementation of DES
63		called Triple DES where the DES method is applied three times to each
64		data block.
65
66		The main advantages to symmetric systems are the ease of use, since only
67		one key is required for both encryption and decryption, and the
68		simplicity of the algorithms. This helps with bulk data encryption that
69		may unnecessarily waste time and power using asymmetric systems.
70
71		However, symmetric systems have disadvantages to keep in mind. Since the
72		key is private, it can be difficult to safely distribute keys to
73		communication partners. Additionally, the key cannot be used to sign
74		messages since it's necessary to keep the key private.
	47	Symmetric cryptography utilizes a secret, bidirectional key to perform both
	48	encryption and decryption of the data. The most common implementation of
	49	symmetric cryptography is the Advanced Encryption Standard, which uses keys that
	50	are 128 bits to 256 bits in size. This standard came after the National
	51	Institute of Standards and Technology (NIST) decided to retire the Data
	52	Encryption Standard (DES) in 2001.
	53
	54	Since brute force attacks strongly correlate with key length, the 56-bit key
	55	length of DES was considered insecure after it was publicly broken in under 24
	56	hours. However, there is a modern implementation of DES called Triple DES where
	57	the DES method is applied three times to each data block.
	58
	59	The main advantages to symmetric systems are the ease of use, since only one key
	60	is required for both encryption and decryption, and the simplicity of the
	61	algorithms. This helps with bulk data encryption that may unnecessarily waste
	62	time and power using asymmetric systems.
	63
	64	However, symmetric systems have disadvantages to keep in mind. Since the key is
	65	private, it can be difficult to safely distribute keys to communication
	66	partners. Additionally, the key cannot be used to sign messages since it's
	67	necessary to keep the key private.
75	68
76	69	* Asymmetric Systems (Public Key Cryptography)
77		Asymmetric cryptography utilizes two keys within the system: a secret
78		key that is privately-held and a public key that can be distributed
79		freely. The interesting aspect of asymmetric cryptography is that either
80		key can be used to encrypt the data, there's no rule that dictates which
81		key must be used for encryption. Once one key is used to encrypt the
82		data, only the other key can be used to decrypt the data. This means
83		that if the private key encrypts the data, only the public key can
84		decrypt the data.
85
86		An advantage of this system is that if you successfully decrypt data
87		using one of the keys, you can be sure of the sender since only the
88		other key could have encrypted the data.
89
90		One of the major implementations of an asymmetric system is a digital
91		signature. A digital signature can be generated using the sender's
92		private key, or a one-way hash function and is used to provide assurance
93		for the integrity and authenticity of the message. A couple common
94		message digest algorithms are SHA-256 and SHA-512, which securely
95		compress data and produce a 128-bit message digest.
96
97		It should be noted that man-in-the-middle attacks are one of the risks
98		with digital signatures and public keys. To combat this, applications
99		often use a public key infrastructure (PKI) to independently
100		authenticate the validity of signatures and keys.
101
102		Due to the large key size and
103		[[https://crypto.stackexchange.com/a/591][inefficient mathematical
104		functions]] of asymmetric encryption, elliptical curve cryptography
105		(ECC) is often used to increase security while using fewer resources.
	70	Asymmetric cryptography utilizes two keys within the system: a secret key that
	71	is privately-held and a public key that can be distributed freely. The
	72	interesting aspect of asymmetric cryptography is that either key can be used to
	73	encrypt the data, there's no rule that dictates which key must be used for
	74	encryption. Once one key is used to encrypt the data, only the other key can be
	75	used to decrypt the data. This means that if the private key encrypts the data,
	76	only the public key can decrypt the data.
	77
	78	An advantage of this system is that if you successfully decrypt data using one
	79	of the keys, you can be sure of the sender since only the other key could have
	80	encrypted the data.
	81
	82	One of the major implementations of an asymmetric system is a digital signature.
	83	A digital signature can be generated using the sender's private key, or a
	84	one-way hash function and is used to provide assurance for the integrity and
	85	authenticity of the message. A couple common message digest algorithms are
	86	SHA-256 and SHA-512, which securely compress data and produce a 128-bit message
	87	digest.
	88
	89	It should be noted that man-in-the-middle attacks are one of the risks with
	90	digital signatures and public keys. To combat this, applications often use a
	91	public key infrastructure (PKI) to independently authenticate the validity of
	92	signatures and keys.
	93
	94	Due to the large key size and [[https://crypto.stackexchange.com/a/591][inefficient mathematical functions]] of asymmetric
	95	encryption, elliptical curve cryptography (ECC) is often used to increase
	96	security while using fewer resources.
106	97
107	98	* Applications of Cryptographic Systems
108		There are quite a few implementations of cryptographic systems around
109		the world. Here are a few popular examples:
	99	There are quite a few implementations of cryptographic systems around the world.
	100	Here are a few popular examples:
110	101
111	102	Transport Layer Security (TLS):* One of the most famous cryptographic
112		solutions created is TLS, a session-layered or connection-layered
113		internet protocol that allows for secure communications between browsers
114		and servers. Using handshakes, peer negotiation, and authentication
115		allows TLS to prevent eavesdropping and malicious transformation of
116		data. The major reason for TLS popularity is that a major vulnerability
117		was found in the SSL protocol in 2014. Instead of SSL, TLS can be used
118		with HTTP to form HTTPS and is the preferred method for modern web
119		development due to its increased security.
120
121		Secure Hypertext Transfer Protocol (HTTPS):* An application layer
122		protocol that allows for secure transport of data between servers and
123		web clients. One of the unique parts of HTTPS is that it uses a secured
124		port number instead of the default web port address.
125
126		Virtual Private Network (VPN):* VPNs are made to securely extend a
127		private network across public networks by utilizing an encrypted layered
128		tunneling protocol paired with an authentication method, such as
129		usernames and passwords. This technology originally allowed remote
130		employees to access their company's data but have evolved into one of
131		the top choices for anyone who wishes to mask their sensitive personal
132		data.
	103	solutions created is TLS, a session-layered or connection-layered internet
	104	protocol that allows for secure communications between browsers and servers.
	105	Using handshakes, peer negotiation, and authentication allows TLS to prevent
	106	eavesdropping and malicious transformation of data. The major reason for TLS
	107	popularity is that a major vulnerability was found in the SSL protocol in 2014.
	108	Instead of SSL, TLS can be used with HTTP to form HTTPS and is the preferred
	109	method for modern web development due to its increased security.
	110
	111	Secure Hypertext Transfer Protocol (HTTPS):* An application layer protocol
	112	that allows for secure transport of data between servers and web clients. One of
	113	the unique parts of HTTPS is that it uses a secured port number instead of the
	114	default web port address.
	115
	116	Virtual Private Network (VPN):* VPNs are made to securely extend a private
	117	network across public networks by utilizing an encrypted layered tunneling
	118	protocol paired with an authentication method, such as usernames and passwords.
	119	This technology originally allowed remote employees to access their company's
	120	data but have evolved into one of the top choices for anyone who wishes to mask
	121	their sensitive personal data.
133	122
134	123	Internet Protocol Security (IPSec):* This protocol suite facilitates
135	124	communication between two or more hosts or subnets by authenticating and
136		encrypting the data packets. IPSec is used in a lot of VPNs to establish
137		the VPN connection through the transport and tunnel mode encryption
138		methods. IPSec encrypts just the data portion of packets in the
139		transport methods, but it encrypts both the data and headers in the
140		tunnel method (introducing an additional header for authentication).
141
142		Secure Shell (SSH):* SSH is another network protocol used to protect
143		network services by authenticating users through a secure channel. This
144		protocol is often used for command-line (shell) functions such as remote
145		shell commands, logins, and file transfers.
146
147		Kerberos:* Developed by MIT, Kerberos is a computer-network
148		authentication protocol that works on the basis of tickets to allow
149		nodes communicating over a non-secure network to prove their identity to
150		one another securely. This is most commonly used in business
151		environments when used as the authentication and encryption method for
152		Windows Active Directory (AD).
	125	encrypting the data packets. IPSec is used in a lot of VPNs to establish the VPN
	126	connection through the transport and tunnel mode encryption methods. IPSec
	127	encrypts just the data portion of packets in the transport methods, but it
	128	encrypts both the data and headers in the tunnel method (introducing an
	129	additional header for authentication).
	130
	131	Secure Shell (SSH):* SSH is another network protocol used to protect network
	132	services by authenticating users through a secure channel. This protocol is
	133	often used for command-line (shell) functions such as remote shell commands,
	134	logins, and file transfers.
	135
	136	Kerberos:* Developed by MIT, Kerberos is a computer-network authentication
	137	protocol that works on the basis of tickets to allow nodes communicating over a
	138	non-secure network to prove their identity to one another securely. This is most
	139	commonly used in business environments when used as the authentication and
	140	encryption method for Windows Active Directory (AD).
153	141
154	142	* Cybersecurity Controls
155		If you're someone who needs solutions on how to control risks associated
156		with utilizing a crytograhpic system, start with a few basic controls:
	143	If you're someone who needs solutions on how to control risks associated with
	144	utilizing a crytograhpic system, start with a few basic controls:
157	145
158		- Policies:* A policy on the use of cryptographic controls for
159		protection of information is implemented and is in accordance with
160		organizational objectives.
	146	- Policies:* A policy on the use of cryptographic controls for protection of
	147	information is implemented and is in accordance with organizational
	148	objectives.
161	149	- Key management:* A policy on the use, protection and lifetime of
162		cryptographic keys is implemented through the entire application
163		lifecycle.
164		- Key size:* The organization has researched the optimal key size for
165		their purposes, considering national laws, required processing power,
166		and longevity of the solution.
167		- Algorithm selection:* Implemented algorithms are sufficiently
168		appropriate for the business of the organization, robust, and align
169		with recommended guidelines.
	150	cryptographic keys is implemented through the entire application lifecycle.
	151	- Key size:* The organization has researched the optimal key size for their
	152	purposes, considering national laws, required processing power, and longevity
	153	of the solution.
	154	- Algorithm selection:* Implemented algorithms are sufficiently appropriate
	155	for the business of the organization, robust, and align with recommended
	156	guidelines.
170	157	- Protocol configuration:* Protocols have been reviewed and configured
171	158	suitable to the purpose of the business.

content/blog/2020-03-25-session-manager.org +52 −60

		@@ -4,44 +4,39 @@
4	4	#+filetags: :privacy:
5	5
6	6	* Privacy Warning
7		The company behind Session (Loki Foundation) is from Australia. If you
8		didn't know, Australia has introduced
9		[[https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_aspassed/toc_pdf/18204b01.pdf][legislation]]
10		mandating companies comply with government requests to build backdoor
11		access into applications. For more information, read my article on
12		[[./2020-01-25-aes-encryption.html][AES Encryption]].
	7	The company behind Session (Loki Foundation) is from Australia. If you didn't
	8	know, Australia has introduced [[https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_aspassed/toc_pdf/18204b01.pdf][legislation]] mandating companies comply with
	9	government requests to build backdoor access into applications. For more
	10	information, read my article on [[./2020-01-25-aes-encryption.html][AES Encryption]].
13	11
14	12	* About Session
15		[[https://getsession.org][Session]] is a private, cross-platform
16		messaging app from the [[https://loki.foundation][Loki Foundation]]. As
17		someone who has spent years looking for quality alternatives to major
18		messaging apps, I was excited when I first heard about Session. Reading
19		through [[https://arxiv.org/pdf/2002.04609.pdf][Session's white paper]],
20		you can learn the technologies behind the Session app. Part of the
21		security of Session comes from the Signal protocol, which was forked as
22		the origin of Session.
	13	[[https://getsession.org][Session]] is a private, cross-platform messaging app from the [[https://loki.foundation][Loki Foundation]]. As
	14	someone who has spent years looking for quality alternatives to major messaging
	15	apps, I was excited when I first heard about Session. Reading through [[https://arxiv.org/pdf/2002.04609.pdf][Session's
	16	white paper]], you can learn the technologies behind the Session app. Part of the
	17	security of Session comes from the Signal protocol, which was forked as the
	18	origin of Session.
23	19
24	20	#+begin_quote
25		Session is an end-to-end encrypted messenger that removes sensitive
26		metadata collection, and is designed for people who want privacy and
27		freedom from any forms of surveillance.
	21	Session is an end-to-end encrypted messenger that removes sensitive metadata
	22	collection, and is designed for people who want privacy and freedom from any
	23	forms of surveillance.
28	24	#+end_quote
29	25
30	26	In general, this app promises security through end-to-end encryption,
31		decentralized onion routing, and private identities. The biggest change
32		that the Loki Foundation has made to the Signal protocol is removing the
33		need for a phone number. Instead, a random identification string is
34		generated for any session you create. This means you can create a new
35		session for each device if you want to, or link new devices with your
36		ID.
	27	decentralized onion routing, and private identities. The biggest change that the
	28	Loki Foundation has made to the Signal protocol is removing the need for a phone
	29	number. Instead, a random identification string is generated for any session you
	30	create. This means you can create a new session for each device if you want to,
	31	or link new devices with your ID.
37	32
38		Since Session's website and white paper describe the details of
39		Session's security, I'm going to focus on using the app in this post.
	33	Since Session's website and white paper describe the details of Session's
	34	security, I'm going to focus on using the app in this post.
40	35
41	36	* Features
42		Since most people are looking for an alternative to a popular chat app,
43		I am going to list out the features that Session has so that you are
44		able to determine if the app would suit your needs:
	37	Since most people are looking for an alternative to a popular chat app, I am
	38	going to list out the features that Session has so that you are able to
	39	determine if the app would suit your needs:
45	40
46	41	- Multiple device linking (via QR code or ID)
47	42	- App locking via device screen lock, password, or fingerprint
		@@ -55,15 +50,15 @@ able to determine if the app would suit your needs:
55	50	- Account deletion, including ID, messages, sessions, and contacts
56	51
57	52	* Downloads
58		I have tested this app on Ubuntu 19.10, Android 10, macOS Monterey, and
59		iOS 15. All apps have worked well without many issues.
	53	I have tested this app on Ubuntu 19.10, Android 10, macOS Monterey, and iOS 15.
	54	All apps have worked well without many issues.
60	55
61		Below is a brief overview of the Session app on Linux. To get this app,
62		you'll need to go to the [[https://getsession.org/download/][Downloads]]
63		page and click to link to the operating system you're using.
	56	Below is a brief overview of the Session app on Linux. To get this app, you'll
	57	need to go to the [[https://getsession.org/download/][Downloads]] page and click to link to the operating system
	58	you're using.
64	59
65		For Linux, it will download an AppImage that you'll need to enable with
66		the following command:
	60	For Linux, it will download an AppImage that you'll need to enable with the
	61	following command:
67	62
68	63	#+begin_src sh
69	64	sudo chmod u+x session-messenger-desktop-linux-x86_64-1.0.5.AppImage
		@@ -73,12 +68,12 @@ sudo chmod u+x session-messenger-desktop-linux-x86_64-1.0.5.AppImage
73	68	[[https://img.cleberg.net/blog/20200325-session-private-messenger/session_downloads.png]]
74	69
75	70	* Creating an Account
76		Once you've installed the app, simply run the app and create your unique
77		Session ID. It will look something like this:
	71	Once you've installed the app, simply run the app and create your unique Session
	72	ID. It will look something like this:
78	73	=05af1835afdd63c947b47705867501d6373f486aa1ae05b1f2f3fcd24570eba608=.
79	74
80		You'll need to set a display name and, optionally, a password. If you
81		set a password, you will need to enter it every time you open the app.
	75	You'll need to set a display name and, optionally, a password. If you set a
	76	password, you will need to enter it every time you open the app.
82	77
83	78	#+caption: Session Login (Linux)
84	79	[[https://img.cleberg.net/blog/20200325-session-private-messenger/session_linux_login.png]]
		@@ -90,39 +85,36 @@ set a password, you will need to enter it every time you open the app.
90	85	[[https://img.cleberg.net/blog/20200325-session-private-messenger/session_password_authentication.png]]
91	86
92	87	* Start Messaging
93		Once you've created your account and set up your profile details, the
94		next step is to start messaging other people. To do so, you'll need to
95		share your Session ID with other people. From this point, it's fairly
96		straightforward and acts like any other messaging app, so I won't dive
97		into much detail here.
	88	Once you've created your account and set up your profile details, the next step
	89	is to start messaging other people. To do so, you'll need to share your Session
	90	ID with other people. From this point, it's fairly straightforward and acts like
	91	any other messaging app, so I won't dive into much detail here.
98	92
99	93	** macOS
100	94	#+caption: macOS Conversations
101	95	[[https://img.cleberg.net/blog/20200325-session-private-messenger/session_macos_conversations.png]]
102	96
103		One key feature to note is that the desktop application now provides a
104		helpful pop-up box explaining the process that Session uses to hide your
105		IP address:
	97	One key feature to note is that the desktop application now provides a helpful
	98	pop-up box explaining the process that Session uses to hide your IP address:
106	99
107	100	#+caption: IP Address Help Box
108	101	[[https://img.cleberg.net/blog/20200325-session-private-messenger/session_ip.png]]
109	102
110	103	** iOS
111		The mobile app is quite simple and effective, giving you all the
112		standard mobile messaging options you'd expect.
	104	The mobile app is quite simple and effective, giving you all the standard mobile
	105	messaging options you'd expect.
113	106
114	107	#+caption: iOS App
115	108	[[https://img.cleberg.net/blog/20200325-session-private-messenger/session_ios.png]]
116	109
117	110	* Potential Issues
118		I've discovered one annoying issue that would prevent from using this
119		app regularly. On a mobile device, there have been issues with receiving
120		messages on time. Even with battery optimization disabled and no network
121		restrictions, Session notifications sometimes do not display until I
122		open the app or the conversation itself and wait a few moments. This is
123		actually one of the reasons I stopped using Signal (this seems fixed as
124		of my updates in 2021/2022, so I wouldn't worry about this issue
125		anymore).
126
127		Looking for another messenger instead of Session? I recommend Signal,
128		Matrix, and IRC.
	111	I've discovered one annoying issue that would prevent from using this app
	112	regularly. On a mobile device, there have been issues with receiving messages on
	113	time. Even with battery optimization disabled and no network restrictions,
	114	Session notifications sometimes do not display until I open the app or the
	115	conversation itself and wait a few moments. This is actually one of the reasons
	116	I stopped using Signal (this seems fixed as of my updates in 2021/2022, so I
	117	wouldn't worry about this issue anymore).
	118
	119	Looking for another messenger instead of Session? I recommend Signal, Matrix,
	120	and IRC.

content/blog/2020-05-03-homelab.org +76 −89

		@@ -4,28 +4,24 @@
4	4	#+filetags: :sysadmin:
5	5
6	6	* What is a Homelab?
7		Starting as a developer, I have largely stayed away from hardware-based
8		hobbies (other than building a gaming desktop). However, as the
9		quarantine for COVID-19 stretches out further and further, I found
10		myself bored and in search of new hobbies. After spending the last few
11		months browsing the [[https://www.reddit.com/r/homelab/][r/homelab]]
12		subreddit, I decided it was time to jump in and try things out for
13		myself.
	7	Starting as a developer, I have largely stayed away from hardware-based hobbies
	8	(other than building a gaming desktop). However, as the quarantine for COVID-19
	9	stretches out further and further, I found myself bored and in search of new
	10	hobbies. After spending the last few months browsing the [[https://www.reddit.com/r/homelab/][r/homelab]] subreddit, I
	11	decided it was time to jump in and try things out for myself.
14	12
15		Since I am a beginner and just recently graduated from college,
16		everything I've done so far in my homelab is fairly low-budget.
	13	Since I am a beginner and just recently graduated from college, everything I've
	14	done so far in my homelab is fairly low-budget.
17	15
18	16	* Hardware
19	17	#+caption: HomeLab Diagram
20	18	[[https://img.cleberg.net/blog/20200503-homelab/homelab-min.png]]
21	19
22	20	*** Raspberry Pi 4
23		Luckily, I had actually purchased a
24		[[https://www.raspberrypi.org/products/raspberry-pi-4-model-b/][Raspberry
25		Pi 4]] before the quarantine started so that I could try to keep Plex
26		Media Center running, even while my desktop computer was turned off. I
27		started here, using the Pi to hold Plex and Pi-hole until I grew tired
28		with the slow performance.
	21	Luckily, I had actually purchased a [[https://www.raspberrypi.org/products/raspberry-pi-4-model-b/][Raspberry Pi 4]] before the quarantine started
	22	so that I could try to keep Plex Media Center running, even while my desktop
	23	computer was turned off. I started here, using the Pi to hold Plex and Pi-hole
	24	until I grew tired with the slow performance.
29	25
30	26	Here are the specifications for the Pi 4:
31	27
		@@ -36,12 +32,12 @@ Here are the specifications for the Pi 4:
36	32	- 64 GB MicroSD Card
37	33
38	34	** Dell Optiplex 5040
39		Since I wasn't happy with the Pi as my main server, I turned to
40		Craigslist. I know a lot of other homelabbers use Ebay, but I can't seem
41		to ever trust it enough to purchase items on there. So I used Craigslist
42		and found a Dell Optiplex 5040 desktop computer on sale for $90. While
43		this computer might be underpowered, it was one of the few computers
44		under $100 that was available during quarantine.
	35	Since I wasn't happy with the Pi as my main server, I turned to Craigslist. I
	36	know a lot of other homelabbers use Ebay, but I can't seem to ever trust it
	37	enough to purchase items on there. So I used Craigslist and found a Dell
	38	Optiplex 5040 desktop computer on sale for $90. While this computer might be
	39	underpowered, it was one of the few computers under $100 that was available
	40	during quarantine.
45	41
46	42	Here are the specifications for the Dell Optiplex 5040:
47	43
		@@ -51,99 +47,90 @@ Here are the specifications for the Dell Optiplex 5040:
51	47	- Gigabit Ethernet
52	48	- 500GB Hard Drive
53	49
54		While this hardware would be awful for a work computer or a gaming rig,
55		it turned out to be wonderful for my server purposes. The only
56		limitation I have found so far is the CPU. The i3-6100 only has enough
57		power for a single 4k video transcode at a time. I haven't tested more
58		than three 1080p streams at a time, but the maximum amount of streams
59		I've ever actually used is two.
	50	While this hardware would be awful for a work computer or a gaming rig, it
	51	turned out to be wonderful for my server purposes. The only limitation I have
	52	found so far is the CPU. The i3-6100 only has enough power for a single 4k video
	53	transcode at a time. I haven't tested more than three 1080p streams at a time,
	54	but the maximum amount of streams I've ever actually used is two.
60	55
61	56	** WD easystore 10TB & 8TB
62		Application storage and temporary files are stored on the internal hard
63		drive of the server, but all media files (movies, tv, games, books, etc)
64		are stored externally on my WD easystore hard drive. Creating auto-boot
65		configurations in the =/etc/fstab= file on my server allows the hard
66		drives to automatically mount whenever I need to restart my server.
	57	Application storage and temporary files are stored on the internal hard drive of
	58	the server, but all media files (movies, tv, games, books, etc) are stored
	59	externally on my WD easystore hard drive. Creating auto-boot configurations in
	60	the =/etc/fstab= file on my server allows the hard drives to automatically mount
	61	whenever I need to restart my server.
67	62
68	63	#+begin_quote
69		Update: In March 2022, I shucked the hard drives out of their external
70		cases, put some Kapton tape on the third power pin to prevent power
71		shutdowns, and stuck them inside my server tower using internal SATA
72		cables.
73
	64	Update: In March 2022, I shucked the hard drives out of their external cases,
	65	put some Kapton tape on the third power pin to prevent power shutdowns, and
	66	stuck them inside my server tower using internal SATA cables.
74	67	#+end_quote
75	68
76	69	** Netgear Unmanaged Switch
77		To manage all the ethernet cords used by my homelab, my desktop, and my
78		living room media center, I purchased an 8-port gigabit ethernet switch
79		for $50 at my local computer store. This is probably much more than I
80		should have spent on an unmanaged switch, but I am comfortable with the
81		choice.
	70	To manage all the ethernet cords used by my homelab, my desktop, and my living
	71	room media center, I purchased an 8-port gigabit ethernet switch for $50 at my
	72	local computer store. This is probably much more than I should have spent on an
	73	unmanaged switch, but I am comfortable with the choice.
82	74
83	75	** TP-Link Managed Switch
84		Since I use the unmanaged switch to group all living room devices
85		together, I use the managed switch to configure VLANs and secure my
86		network.
	76	Since I use the unmanaged switch to group all living room devices together, I
	77	use the managed switch to configure VLANs and secure my network.
87	78
88	79	** Arris TM1602A Modem & Sagecom Fast 5280 Router
89		My default modem and router, provided by my ISP, are fairly standard.
90		The Arris modem supports DOCSIS 3.0, which is something that I
91		definitely wanted as a minimum. The Sagecom router is also standard, no
92		fancy bells or whistles. However, it does support DHCP and DHCPv6, which
93		is something you can use to route all household traffic through a
94		pi-hole or firewall.
	80	My default modem and router, provided by my ISP, are fairly standard. The Arris
	81	modem supports DOCSIS 3.0, which is something that I definitely wanted as a
	82	minimum. The Sagecom router is also standard, no fancy bells or whistles.
	83	However, it does support DHCP and DHCPv6, which is something you can use to
	84	route all household traffic through a pi-hole or firewall.
95	85
96	86	** TP-Link EAP
97		In order to gain better control over the network, I use my own wireless
98		access point instead of the one included in the Sagecom router above.
99		Now I can control and organize all of my ethernet connections through
100		the VLANs on the managed switch and wireless connections through the
101		VLANS on the EAP.
	87	In order to gain better control over the network, I use my own wireless access
	88	point instead of the one included in the Sagecom router above. Now I can control
	89	and organize all of my ethernet connections through the VLANs on the managed
	90	switch and wireless connections through the VLANS on the EAP.
102	91
103	92	** Generic Printer
104		The last piece to my homelab is a standard wireless printer. Nothing
105		special here.
	93	The last piece to my homelab is a standard wireless printer. Nothing special
	94	here.
106	95
107	96	* Software
108	97	** Ubuntu Server 20.04
109		While the 20.04 version of Ubuntu was just released, I always like to
110		experiment with new features (and I don't mind breaking my system - it
111		just gives me more experience learning how to fix things). So, I have
112		Ubuntu Server 20.04 installed on the Dell Optiplex server and Ubuntu
113		Server 19.10 installed on the Raspberry Pi. Once I find an acceptable
114		use for the Pi, I will most likely switch the operating system.
	98	While the 20.04 version of Ubuntu was just released, I always like to experiment
	99	with new features (and I don't mind breaking my system - it just gives me more
	100	experience learning how to fix things). So, I have Ubuntu Server 20.04 installed
	101	on the Dell Optiplex server and Ubuntu Server 19.10 installed on the Raspberry
	102	Pi. Once I find an acceptable use for the Pi, I will most likely switch the
	103	operating system.
115	104
116	105	** Docker
117		I am /very/ new to Docker, but I have had a lot of fun playing with it
118		so far. Docker is used to create containers that can hold all the
119		contents of a system without interfering with other software on the same
120		system. So far, I have successfully installed pi-hole, GitLab, Gogs, and
121		Nextcloud in containers. However, I opted to delete all of those so that
122		I can reconfigure them more professionally at a later time.
	106	I am /very/ new to Docker, but I have had a lot of fun playing with it so far.
	107	Docker is used to create containers that can hold all the contents of a system
	108	without interfering with other software on the same system. So far, I have
	109	successfully installed pi-hole, GitLab, Gogs, and Nextcloud in containers.
	110	However, I opted to delete all of those so that I can reconfigure them more
	111	professionally at a later time.
123	112
124	113	** Plex Media Server
125		Plex is a media center software that allows you to organize your movies,
126		TV shows, music, photos, and videos automatically. It will even download
127		metadata for you so that you can easily browse these collections.
	114	Plex is a media center software that allows you to organize your movies, TV
	115	shows, music, photos, and videos automatically. It will even download metadata
	116	for you so that you can easily browse these collections.
128	117
129	118	** Pi-hole
130		Pi-hole is an alternative ad-blocker that runs at the DNS level,
131		allowing you to block traffic when it hits your network, so that you can
132		reject any traffic you deem to be bad. Pi-hole uses blacklists and
133		whitelists to decide which traffic block and, luckily, there are a lot
134		of pre-made lists out there on Reddit, GitHub, etc.
	119	Pi-hole is an alternative ad-blocker that runs at the DNS level, allowing you to
	120	block traffic when it hits your network, so that you can reject any traffic you
	121	deem to be bad. Pi-hole uses blacklists and whitelists to decide which traffic
	122	block and, luckily, there are a lot of pre-made lists out there on Reddit,
	123	GitHub, etc.
135	124
136	125	** Nextcloud
137		While I had trouble with the Docker version of Nextcloud, I was very
138		successful when setting up the snap version. Using this, I was able to
139		map Nextcloud to a subdomain of a domain I own in Namecheap.
140		Additionally, Nextcloud has an integration with Let's Encrypt that
141		allows me to issue certificates automatically to any new domain I
142		authorize.
	126	While I had trouble with the Docker version of Nextcloud, I was very successful
	127	when setting up the snap version. Using this, I was able to map Nextcloud to a
	128	subdomain of a domain I own in Namecheap. Additionally, Nextcloud has an
	129	integration with Let's Encrypt that allows me to issue certificates
	130	automatically to any new domain I authorize.
143	131
144	132	** Webmin
145		To monitor my servers, and the processes running on them, I use the
146		Webmin dashboard. This was fairly painless to set up, and I currently
147		access it straight through the server's IP address. In the future, I
148		will be looking to configure Webmin to use a custom domain just like
149		Nextcloud.
	133	To monitor my servers, and the processes running on them, I use the Webmin
	134	dashboard. This was fairly painless to set up, and I currently access it
	135	straight through the server's IP address. In the future, I will be looking to
	136	configure Webmin to use a custom domain just like Nextcloud.

content/blog/2020-05-19-customizing-ubuntu.org +76 −93

		@@ -8,145 +8,128 @@ For inspiration on designing your *nix computer, check out the
8	8	[[https://libredd.it/r/unixporn][r/unixporn]] subreddit!
9	9
10	10	* Customizing Ubuntu
11		New to Linux and want to add a personal touch to your machine? One of
12		the best perks of Linux is that it is extremely* customizable. You can
13		change the styles of the windows, shell (status bars/docks), icons,
14		fonts, terminals, and more.
	11	New to Linux and want to add a personal touch to your machine? One of the best
	12	perks of Linux is that it is extremely* customizable. You can change the
	13	styles of the windows, shell (status bars/docks), icons, fonts, terminals, and
	14	more.
15	15
16		In this post, I'm going to go through customization on Ubuntu 20.04
17		(GNOME) since most new users tend to choose Ubuntu-based distros. If
18		you've found a way to install Arch with i3-gaps, I'm assuming you know
19		how to find more advanced tutorials out there on customizations.
	16	In this post, I'm going to go through customization on Ubuntu 20.04 (GNOME)
	17	since most new users tend to choose Ubuntu-based distros. If you've found a way
	18	to install Arch with i3-gaps, I'm assuming you know how to find more advanced
	19	tutorials out there on customizations.
20	20
21	21	** Required Tools
22	22	#+caption: Gnome Tweaks
23	23	[[https://img.cleberg.net/blog/20200519-customizing-ubuntu/gnome-tweaks-min.png]]
24	24
25		Ubuntu 20.04 ships with the default desktop environment
26		[[https://www.gnome.org/][Gnome]], which includes the handy
27		=gnome-tweaks= tool to quickly change designs. To install this, just
	25	Ubuntu 20.04 ships with the default desktop environment [[https://www.gnome.org/][Gnome]], which includes
	26	the handy =gnome-tweaks= tool to quickly change designs. To install this, just
28	27	open your terminal and enter the following command:
29	28
30	29	#+begin_src sh
31	30	sudo apt install gnome-tweaks
32	31	#+end_src
33	32
34		After you've finished installing the tool, simply launch the Tweaks
35		application, and you'll be able to access the various customization
36		options available by default on Ubuntu. You might even like some of the
37		pre-installed options.
	33	After you've finished installing the tool, simply launch the Tweaks application,
	34	and you'll be able to access the various customization options available by
	35	default on Ubuntu. You might even like some of the pre-installed options.
38	36
39	37	** GNOME Application Themes
40		To change the themes applied to applications in GNOME, you will need to
41		change the Applications dropdown in the Appearance section of Tweaks. To
42		add more themes, you will have to find your preferred theme online and
43		follow the steps below to have it show up in the Tweaks tool. While you
44		may find themes anywhere, one of the most popular sites for GNOME themes
45		is [[https://www.gnome-look.org/][gnome-look.org]]. This website
	38	To change the themes applied to applications in GNOME, you will need to change
	39	the Applications dropdown in the Appearance section of Tweaks. To add more
	40	themes, you will have to find your preferred theme online and follow the steps
	41	below to have it show up in the Tweaks tool. While you may find themes anywhere,
	42	one of the most popular sites for GNOME themes is [[https://www.gnome-look.org/][gnome-look.org]]. This website
46	43	contains themes for applications, shells, icons, and cursors.
47	44
48	45	Steps to import themes into Tweaks:
49	46
50	47	1. Download the theme.
51		2. These files are usually compressed (.zip, .tar.gz, .tar.xz), so you
52		will need to extract the contents. This is easiest when opening the
53		file explorer, right-clicking the compressed file, and choosing
54		"Extract here."
	48	2. These files are usually compressed (.zip, .tar.gz, .tar.xz), so you will need
	49	to extract the contents. This is easiest when opening the file explorer,
	50	right-clicking the compressed file, and choosing "Extract here."
55	51	3. Move the theme folder to =/usr/share/themes/=. You can do so with the
56	52	following command: =sudo mv theme-folder/ /usr/share/themes/=.
57	53	- Icons and cursors will be moved to the =/usr/share/icons/= folder.
58		- Fonts will be moved to the =/usr/share/fonts/= folder
59		Alternatively, you can move them to the
60		=/usr/share/fonts/opentype/= or =/usr/share/fonts/opentype/=
61		folders, if you have a specific font type.
	54	- Fonts will be moved to the =/usr/share/fonts/= folder Alternatively, you
	55	can move them to the =/usr/share/fonts/opentype/= or
	56	=/usr/share/fonts/opentype/= folders, if you have a specific font type.
62	57	4. Close tweaks if it is open. Re-open Tweaks and your new theme will be
63		available in the Applications dropdown in the Appearance section of
64		Tweaks.
	58	available in the Applications dropdown in the Appearance section of Tweaks.
65	59
66		If the theme is not showing up after you've moved it into the themes
67		folder, you may have uncompressed the folder into a sub-folder. You can
68		check this by entering the theme folder and listing the contents:
	60	If the theme is not showing up after you've moved it into the themes folder, you
	61	may have uncompressed the folder into a sub-folder. You can check this by
	62	entering the theme folder and listing the contents:
69	63
70	64	#+begin_src sh
71	65	cd /usr/share/themes/Mojave-Dark && ls -la
72	66	#+end_src
73	67
74		This is an example of what the contents of your theme folder should look
75		like. If you just see another folder there, you should move that folder
76		up into the =/usr/share/themes/= folder.
	68	This is an example of what the contents of your theme folder should look like.
	69	If you just see another folder there, you should move that folder up into the
	70	=/usr/share/themes/= folder.
77	71
78	72	#+begin_src sh
79	73	cinnamon COPYING gnome-shell gtk-2.0 gtk-3.0 index.theme metacity-1 plank xfwm4
80	74	#+end_src
81	75
82	76	** GNOME Shell Themes
83		To change the appearance of the title bar, default dock, app menu, and
84		other parts of the GNOME shell, you'll need to install the
85		[[https://extensions.gnome.org/extension/19/user-themes/][user themes]]
86		extension on [[https://extensions.gnome.org/][Gnome Extensions]]. To be
87		able to install extensions, you will first need to install the browser
88		extension that the website instructs you to. See this screenshot for the
89		blue box with a link to the extension.
	77	To change the appearance of the title bar, default dock, app menu, and other
	78	parts of the GNOME shell, you'll need to install the [[https://extensions.gnome.org/extension/19/user-themes/][user themes]] extension on
	79	[[https://extensions.gnome.org/][Gnome Extensions]]. To be able to install extensions, you will first need to
	80	install the browser extension that the website instructs you to. See this
	81	screenshot for the blue box with a link to the extension.
90	82
91	83	#+caption: Gnome Extensions
92	84	[[https://img.cleberg.net/blog/20200519-customizing-ubuntu/gnome-extensions-min.png]]
93	85
94		After the browser extension is installed, you will need to install the
95		native host connector:
	86	After the browser extension is installed, you will need to install the native
	87	host connector:
96	88
97	89	#+begin_src sh
98	90	sudo apt install chrome-gnome-shell
99	91	#+end_src
100	92
101		Finally, you can go the
102		[[https://extensions.gnome.org/extension/19/user-themes/][user themes]]
103		extension page and click the installation button. This will enable the
104		Shell option in Tweaks. Now you can move shell themes to the
105		=/usr/share/themes= directory, using the same steps mentioned in the
106		previous section, and enable the new theme in Tweaks.
	93	Finally, you can go the [[https://extensions.gnome.org/extension/19/user-themes/][user themes]] extension page and click the installation
	94	button. This will enable the Shell option in Tweaks. Now you can move shell
	95	themes to the =/usr/share/themes= directory, using the same steps mentioned in
	96	the previous section, and enable the new theme in Tweaks.
107	97
108	98	** Icons & Cursors
109		Icons and cursors are installed exactly the same way, so I'm grouping
110		these together in this post. Both of these items will need to follow the
111		same process as installing themes, except you will want to move your
112		font folders to the =/usr/share/icons/= directory instead.
	99	Icons and cursors are installed exactly the same way, so I'm grouping these
	100	together in this post. Both of these items will need to follow the same process
	101	as installing themes, except you will want to move your font folders to the
	102	=/usr/share/icons/= directory instead.
113	103
114	104	** Fonts
115		Fonts are one of the overlooked parts of customization, but a good font
116		can make the whole screen look different. For example, I have installed
117		the [[https://github.com/IBM/plex/releases][IBM Plex]] fonts on my
118		system. This follows the same process as installing themes, except you
119		will want to move your font folders to the =/usr/share/fonts/= directory
	105	Fonts are one of the overlooked parts of customization, but a good font can make
	106	the whole screen look different. For example, I have installed the [[https://github.com/IBM/plex/releases][IBM Plex]]
	107	fonts on my system. This follows the same process as installing themes, except
	108	you will want to move your font folders to the =/usr/share/fonts/= directory
120	109	instead.
121	110
122	111	** Terminal
123		If you spend a lot of time typing commands, you know how important the
124		style and functionality of the terminal is. After spending a lot of time
125		using the default GNOME terminal with
126		[[https://en.wikipedia.org/wiki/Bash_(Unix_shell)][unix shell]], I
127		decided to try some different options. I ended up choosing
128		[[https://terminator-gtk3.readthedocs.io/en/latest/][Terminator]] with
129		[[https://en.wikipedia.org/wiki/Z_shell][zsh]].
130
131		Terminator is great if you need to open multiple terminals at one time
132		by simply right-clicking and splitting the screen into as many terminals
133		as you want. While this project hasn't been updated in a while,
134		[[https://github.com/gnome-terminator/terminator/issues/1][it is coming
135		under new development]]. However, this terminal is great and I haven't
136		experienced any errors yet.
137
138		For the shell choice, I decided to choose zsh after trying it out on a
139		fresh Manjaro installation. Zsh is great if you like to change the
140		themes of your terminal, include icons, or add plugins.
141
142		The desktop uses the
143		[[https://github.com/zsh-users/zsh-autosuggestions][zsh-autosuggestions]]
144		to suggest past commands as you type. In addition, it suggests
145		corrections if you misspell a command. Lastly, it uses the =af-magic=
146		theme, which adds dashed lines between commands, moving the user@host
147		tag to the right side of the terminal, and changes the colors. There are
148		plenty of plugins and themes to choose from. Just figure out what you
149		like and add it to your =~/.zshrc= file!
	112	If you spend a lot of time typing commands, you know how important the style and
	113	functionality of the terminal is. After spending a lot of time using the default
	114	GNOME terminal with [[https://en.wikipedia.org/wiki/Bash_(Unix_shell)][unix shell]], I decided to try some different options. I ended
	115	up choosing [[https://terminator-gtk3.readthedocs.io/en/latest/][Terminator]] with [[https://en.wikipedia.org/wiki/Z_shell][zsh]].
	116
	117	Terminator is great if you need to open multiple terminals at one time by simply
	118	right-clicking and splitting the screen into as many terminals as you want.
	119	While this project hasn't been updated in a while, [[https://github.com/gnome-terminator/terminator/issues/1][it is coming under new
	120	development]]. However, this terminal is great and I haven't experienced any
	121	errors yet.
	122
	123	For the shell choice, I decided to choose zsh after trying it out on a fresh
	124	Manjaro installation. Zsh is great if you like to change the themes of your
	125	terminal, include icons, or add plugins.
	126
	127	The desktop uses the [[https://github.com/zsh-users/zsh-autosuggestions][zsh-autosuggestions]] to suggest past commands as you type.
	128	In addition, it suggests corrections if you misspell a command. Lastly, it uses
	129	the =af-magic= theme, which adds dashed lines between commands, moving the
	130	user@host tag to the right side of the terminal, and changes the colors. There
	131	are plenty of plugins and themes to choose from. Just figure out what you like
	132	and add it to your =~/.zshrc= file!
150	133
151	134	*** Steps to Replicate My Terminal
152	135	To install zsh on Ubuntu, enter the following command into a terminal:
		@@ -179,9 +162,9 @@ To install zsh-autosuggestions via Oh My Zsh:
179	162	git clone https://github.com/zsh-users/zsh-autosuggestions ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-autosuggestions
180	163	#+end_src
181	164
182		Then, add the following plugin wording to your =~/.zshrc= file (the
183		default config usually has the =git= plugin activated, so just add any
184		other plugins to the parentheses separated by a space):
	165	Then, add the following plugin wording to your =~/.zshrc= file (the default
	166	config usually has the =git= plugin activated, so just add any other plugins to
	167	the parentheses separated by a space):
185	168
186	169	#+begin_src sh
187	170	nano ~/.zshrc
		@@ -191,5 +174,5 @@ nano ~/.zshrc
191	174	plugins=(git zsh-autosuggestions)
192	175	#+end_src
193	176
194		Finally, you need to log out of your computer and log back in so your
195		user shell can refresh.
	177	Finally, you need to log out of your computer and log back in so your user shell
	178	can refresh.

content/blog/2020-07-20-video-game-sales.org +20 −22

		@@ -4,10 +4,8 @@
4	4	#+filetags: :data:
5	5
6	6	* Background Information
7		This dataset (obtained from
8		[[https://www.kaggle.com/gregorut/videogamesales/data][Kaggle]])
9		contains a list of video games with sales greater than 100,000 copies.
10		It was generated by a scrape of vgchartz.com.
	7	This dataset (obtained from [[https://www.kaggle.com/gregorut/videogamesales/data][Kaggle]]) contains a list of video games with sales
	8	greater than 100,000 copies. It was generated by a scrape of vgchartz.com.
11	9
12	10	Fields include:
13	11
		@@ -23,8 +21,7 @@ Fields include:
23	21	- Other_{Sales}: Sales in the rest of the world (in millions)
24	22	- Global_{Sales}: Total worldwide sales.
25	23
26		There are 16,598 records. 2 records were dropped due to incomplete
27		information.
	24	There are 16,598 records. 2 records were dropped due to incomplete information.
28	25
29	26	* Import the Data
30	27	#+begin_src python
		@@ -45,7 +42,8 @@ df
45	42
46	43	* Explore the Data
47	44	#+begin_src python
48		# With the description function, we can see the basic stats. For example, we can also see that the 'Year' column has some incomplete values.
	45	# With the description function, we can see the basic stats. For example, we can
	46	# also see that the 'Year' column has some incomplete values.
49	47	df.describe()
50	48	#+end_src
51	49
		@@ -158,18 +156,18 @@ df3.sort_values(by=['Global_Sales'], ascending=False).head(5)
158	156	[[https://img.cleberg.net/blog/20200720-data-exploration-video-game-sales/09_outliers-min.png]]
159	157
160	158	* Discussion
161		The purpose of exploring datasets is to ask questions, answer questions,
162		and discover intelligence that can be used to inform decision-making.
163		So, what have we found in this dataset?
164
165		Today we simply explored a publicly-available dataset to see what kind
166		of information it contained. During that exploration, we found that
167		video game sales peaked in 2006. That peak was largely due to Nintendo,
168		who sold the top 5 games in 2006 and has a number of games in the top-10
169		list for the years 1980-2020. Additionally, the top four platforms by
170		global sales (Wii, NES, GB, DS) are owned by Nintendo.
171
172		We didn't explore everything this dataset has to offer, but we can tell
173		from a brief analysis that Nintendo seems to rule sales in the video
174		gaming world. Further analysis could provide insight into which genres,
175		regions, publishers, or world events are correlated with sales.
	159	The purpose of exploring datasets is to ask questions, answer questions, and
	160	discover intelligence that can be used to inform decision-making. So, what have
	161	we found in this dataset?
	162
	163	Today we simply explored a publicly-available dataset to see what kind of
	164	information it contained. During that exploration, we found that video game
	165	sales peaked in 2006. That peak was largely due to Nintendo, who sold the top 5
	166	games in 2006 and has a number of games in the top-10 list for the years
	167	1980-2020. Additionally, the top four platforms by global sales (Wii, NES, GB,
	168	DS) are owned by Nintendo.
	169
	170	We didn't explore everything this dataset has to offer, but we can tell from a
	171	brief analysis that Nintendo seems to rule sales in the video gaming world.
	172	Further analysis could provide insight into which genres, regions, publishers,
	173	or world events are correlated with sales.

content/blog/2020-07-26-business-analysis.org +59 −65

		@@ -4,9 +4,9 @@
4	4	#+filetags: :data:
5	5
6	6	* Background Information
7		This project aims to help investors learn more about a random city in
8		order to determine optimal locations for business investments. The data
9		used in this project was obtained using Foursquare's developer API.
	7	This project aims to help investors learn more about a random city in order to
	8	determine optimal locations for business investments. The data used in this
	9	project was obtained using Foursquare's developer API.
10	10
11	11	Fields include:
12	12
		@@ -15,12 +15,12 @@ Fields include:
15	15	- Venue Latitude
16	16	- Venue Longitude
17	17
18		There are 232 records found using the center of Lincoln as the area of
19		interest with a radius of 10,000.
	18	There are 232 records found using the center of Lincoln as the area of interest
	19	with a radius of 10,000.
20	20
21	21	* Import the Data
22		The first step is the simplest: import the applicable libraries. We will
23		be using the libraries below for this project.
	22	The first step is the simplest: import the applicable libraries. We will be
	23	using the libraries below for this project.
24	24
25	25	#+begin_src python
26	26	# Import the Python libraries we will be using
		@@ -33,10 +33,10 @@ from pandas.io.json import json_normalize
33	33	from sklearn.cluster import KMeans
34	34	#+end_src
35	35
36		To begin our analysis, we need to import the data for this project. The
37		data we are using in this project comes directly from the Foursquare
38		API. The first step is to get the latitude and longitude of the city
39		being studied (Lincoln, NE) and setting up the folium map.
	36	To begin our analysis, we need to import the data for this project. The data we
	37	are using in this project comes directly from the Foursquare API. The first step
	38	is to get the latitude and longitude of the city being studied (Lincoln, NE) and
	39	setting up the folium map.
40	40
41	41	#+begin_src python
42	42	# Define the latitude and longitude, then map the results
		@@ -50,11 +50,11 @@ map_LNK
50	50	#+caption: Blank Map
51	51	[[https://img.cleberg.net/blog/20200726-ibm-data-science/01_blank_map-min.png]]
52	52
53		Now that we have defined our city and created the map, we need to go get
54		the business data. The Foursquare API will limit the results to 100 per
55		API call, so we use our first API call below to determine the total
56		results that Foursquare has found. Since the total results are 232, we
57		perform the API fetching process three times (100 + 100 + 32 = 232).
	53	Now that we have defined our city and created the map, we need to go get the
	54	business data. The Foursquare API will limit the results to 100 per API call, so
	55	we use our first API call below to determine the total results that Foursquare
	56	has found. Since the total results are 232, we perform the API fetching process
	57	three times (100 + 100 + 32 = 232).
58	58
59	59	#+begin_src python
60	60	# Foursquare API credentials
		@@ -117,13 +117,12 @@ results3 = requests.get(url3).json()
117	117	#+end_src
118	118
119	119	* Clean the Data
120		Now that we have our data in three separate dataframes, we need to
121		combine them into a single dataframe and make sure to reset the index so
122		that we have a unique ID for each business. The =get~categorytype~=
123		function below will pull the categories and name from each business's
124		entry in the Foursquare data automatically. Once all the data has been
125		labeled and combined, the results are stored in the =nearby_venues=
126		dataframe.
	120	Now that we have our data in three separate dataframes, we need to combine them
	121	into a single dataframe and make sure to reset the index so that we have a
	122	unique ID for each business. The =get~categorytype~= function below will pull
	123	the categories and name from each business's entry in the Foursquare data
	124	automatically. Once all the data has been labeled and combined, the results are
	125	stored in the =nearby_venues= dataframe.
127	126
128	127	#+begin_src python
129	128	# This function will extract the category of the venue from the API dictionary
		@@ -194,9 +193,9 @@ nearby_venues
194	193	[[https://img.cleberg.net/blog/20200726-ibm-data-science/02_clean_data-min.png]]
195	194
196	195	* Visualize the Data
197		We now have a complete, clean data set. The next step is to visualize
198		this data onto the map we created earlier. We will be using folium's
199		=CircleMarker()= function to do this.
	196	We now have a complete, clean data set. The next step is to visualize this data
	197	onto the map we created earlier. We will be using folium's =CircleMarker()=
	198	function to do this.
200	199
201	200	#+begin_src python
202	201	# add markers to map
		@@ -220,15 +219,14 @@ map_LNK
220	219	data map]]
221	220
222	221	* Clustering: /k-means/
223		To cluster the data, we will be using the /k-means/ algorithm. This
224		algorithm is iterative and will automatically make sure that data points
225		in each cluster are as close as possible to each other, while being as
226		far as possible away from other clusters.
	222	To cluster the data, we will be using the /k-means/ algorithm. This algorithm is
	223	iterative and will automatically make sure that data points in each cluster are
	224	as close as possible to each other, while being as far as possible away from
	225	other clusters.
227	226
228		However, we first have to figure out how many clusters to use (defined
229		as the variable /'k'/). To do so, we will use the next two functions to
230		calculate the sum of squares within clusters and then return the optimal
231		number of clusters.
	227	However, we first have to figure out how many clusters to use (defined as the
	228	variable /'k'/). To do so, we will use the next two functions to calculate the
	229	sum of squares within clusters and then return the optimal number of clusters.
232	230
233	231	#+begin_src python
234	232	# This function will return the sum of squares found in the data
		@@ -266,9 +264,9 @@ def optimal_number_of_clusters(wcss):
266	264	n = optimal_number_of_clusters(sum_of_squares)
267	265	#+end_src
268	266
269		Now that we have found that our optimal number of clusters is six, we
270		need to perform k-means clustering. When this clustering occurs, each
271		business is assigned a cluster number from 0 to 5 in the dataframe.
	267	Now that we have found that our optimal number of clusters is six, we need to
	268	perform k-means clustering. When this clustering occurs, each business is
	269	assigned a cluster number from 0 to 5 in the dataframe.
272	270
273	271	#+begin_src python
274	272	# set number of clusters equal to the optimal number
		@@ -281,9 +279,8 @@ kmeans = KMeans(n_clusters=kclusters, random_state=0).fit(cluster_df)
281	279	nearby_venues.insert(0, 'Cluster Labels', kmeans.labels_)
282	280	#+end_src
283	281
284		Success! We now have a dataframe with clean business data, along with a
285		cluster number for each business. Now let's map the data using six
286		different colors.
	282	Success! We now have a dataframe with clean business data, along with a cluster
	283	number for each business. Now let's map the data using six different colors.
287	284
288	285	#+begin_src python
289	286	# create map with clusters
		@@ -310,12 +307,11 @@ map_clusters
310	307	[[https://img.cleberg.net/blog/20200726-ibm-data-science/04_clusters-min.png]]
311	308
312	309	* Investigate Clusters
313		Now that we have figured out our clusters, let's do a little more
314		analysis to provide more insight into the clusters. With the information
315		below, we can see which clusters are more popular for businesses and
316		which are less popular. The results below show us that clusters 0
317		through 3 are popular, while clusters 4 and 5 are not very popular at
318		all.
	310	Now that we have figured out our clusters, let's do a little more analysis to
	311	provide more insight into the clusters. With the information below, we can see
	312	which clusters are more popular for businesses and which are less popular. The
	313	results below show us that clusters 0 through 3 are popular, while clusters 4
	314	and 5 are not very popular at all.
319	315
320	316	#+begin_src python
321	317	# Show how many venues are in each cluster
		@@ -329,9 +325,9 @@ for x in range(0,6):
329	325	#+caption: Venues per Cluster
330	326	[[https://img.cleberg.net/blog/20200726-ibm-data-science/05_venues_per_cluster-min.png]]
331	327
332		Our last piece of analysis is to summarize the categories of businesses
333		within each cluster. With these results, we can clearly see that
334		restaurants, coffee shops, and grocery stores are the most popular.
	328	Our last piece of analysis is to summarize the categories of businesses within
	329	each cluster. With these results, we can clearly see that restaurants, coffee
	330	shops, and grocery stores are the most popular.
335	331
336	332	#+begin_src python
337	333	# Calculate how many venues there are in each category
		@@ -362,19 +358,17 @@ with pd.option_context('display.max_rows', None, 'display.max_columns', None):
362	358	[[https://img.cleberg.net/blog/20200726-ibm-data-science/07_categories_per_cluster_pt2-min.png]]
363	359
364	360	* Discussion
365		In this project, we gathered location data for Lincoln, Nebraska, USA
366		and clustered the data using the k-means algorithm in order to identify
367		the unique clusters of businesses in Lincoln. Through these actions, we
368		found that there are six unique business clusters in Lincoln and that
369		two of the clusters are likely unsuitable for investors. The remaining
370		four clusters have a variety of businesses, but are largely dominated by
371		restaurants and grocery stores.
372
373		Using this project, investors can now make more informed decisions when
374		deciding the location and category of business in which to invest.
375
376		Further studies may involve other attributes for business locations,
377		such as population density, average wealth across the city, or crime
378		rates. In addition, further studies may include additional location data
379		and businesses by utilizing multiple sources, such as Google Maps and
380		OpenStreetMap.
	361	In this project, we gathered location data for Lincoln, Nebraska, USA and
	362	clustered the data using the k-means algorithm in order to identify the unique
	363	clusters of businesses in Lincoln. Through these actions, we found that there
	364	are six unique business clusters in Lincoln and that two of the clusters are
	365	likely unsuitable for investors. The remaining four clusters have a variety of
	366	businesses, but are largely dominated by restaurants and grocery stores.
	367
	368	Using this project, investors can now make more informed decisions when deciding
	369	the location and category of business in which to invest.
	370
	371	Further studies may involve other attributes for business locations, such as
	372	population density, average wealth across the city, or crime rates. In addition,
	373	further studies may include additional location data and businesses by utilizing
	374	multiple sources, such as Google Maps and OpenStreetMap.

content/blog/2020-08-22-redirect-github-pages.org +48 −58

		@@ -5,17 +5,16 @@
5	5
6	6	* Short answer
7	7	** Step 1
8		Add a new file CNAME to your GitHub Pages repository containing only one
9		line: your top-level domain name. E.g.: =example.com=
	8	Add a new file CNAME to your GitHub Pages repository containing only one line:
	9	your top-level domain name. E.g.: =example.com=
10	10
11	11	** Step 2
12	12	[Optional] but highly recommended
13	13
14		2.1: Remove all other top-level records (prefixed with @) of type A from
15		your DNS configuration.
	14	2.1: Remove all other top-level records (prefixed with @) of type A from your
	15	DNS configuration.
16	16
17		2.2: Remove a CNAME record for the second-level domain www if it is
18		present.
	17	2.2: Remove a CNAME record for the second-level domain www if it is present.
19	18
20	19	** Step 3
21	20	Add these 5 entries to the very top of your DNS configuration:
		@@ -35,52 +34,48 @@ Wait for your DNS changes to propagate. DNS changes aren't effective
35	34	immediately. They can take up to a full day to propagate.
36	35
37	36	* Long answer
38		This issue has two sides. One is the DNS configuration itself. Another
39		one is the way GitHub Pages will forward HTTP requests.
	37	This issue has two sides. One is the DNS configuration itself. Another one is
	38	the way GitHub Pages will forward HTTP requests.
40	39
41		We need to know a few things to understand what GitHub is trying to say
42		in their documentation.
	40	We need to know a few things to understand what GitHub is trying to say in their
	41	documentation.
43	42
44	43	** DNS Entry Types
45	44	There are two types of DNS records which interest us: CNAME and A.
46	45
47		=A= is also known as =Apex= or sometimes as =root entry=. It forwards
48		requests to a specified fixed IP address. =CNAME= entry forwards
49		requests to a specified URL (actual valid plain text URL, not an IP
50		address).
	46	=A= is also known as =Apex= or sometimes as =root entry=. It forwards requests
	47	to a specified fixed IP address. =CNAME= entry forwards requests to a specified
	48	URL (actual valid plain text URL, not an IP address).
51	49
52	50	** DNS Load balancing
53		GitHub has one central URL address which accepts all DNS requests for
54		GitHub Pages: =http://username.github.io=. That URL is resolved to
55		different IP addresses based on your geographical location. Website
56		hosted on GitHub Pages is a simple collection of =HTML=, =CSS= and =JS=
57		files. GitHub distributes these files to different servers across the
58		globe. So that when your browser sends a request from Europe, it
59		receives data from a server in Europe. The same is valid for the
60		requests from Asia and the USA.
	51	GitHub has one central URL address which accepts all DNS requests for GitHub
	52	Pages: =http://username.github.io=. That URL is resolved to different IP
	53	addresses based on your geographical location. Website hosted on GitHub Pages is
	54	a simple collection of =HTML=, =CSS= and =JS= files. GitHub distributes these
	55	files to different servers across the globe. So that when your browser sends a
	56	request from Europe, it receives data from a server in Europe. The same is valid
	57	for the requests from Asia and the USA.
61	58
62	59	** What GitHub is trying to say
63		Since =A= records in DNS must contain IP addresses, and they must be
64		either =185.199.108.153= or =185.199.109.153= or =185.199.110.153= or
65		=185.199.111.153=, there is no way to forward requests to a server
66		located somewhere in Europe or Asia. Your website hosted at GitHub Pages
67		will be downloaded from a central GitHub Pages server. There is a minor
68		risk that if GitHub Pages DNS servers (=x.x.x.153=) are down for some
69		reason, all custom domains which use fixed GitHub Pages IP addresses
70		will not be accessible (their DNS requests will not be resolvable).
71
72		That is why GitHub strongly suggests to either use a second-level domain
73		for your GitHub Pages (e.g. =blog.example.com=) or use a DNS service
74		provider that supports a record type =ALIAS= that acts as =A= record but
75		forwards request to a URL address (e.g. =username.github.io=) instead of
76		a fixed IP address.
	60	Since =A= records in DNS must contain IP addresses, and they must be either
	61	=185.199.108.153= or =185.199.109.153= or =185.199.110.153= or
	62	=185.199.111.153=, there is no way to forward requests to a server located
	63	somewhere in Europe or Asia. Your website hosted at GitHub Pages will be
	64	downloaded from a central GitHub Pages server. There is a minor risk that if
	65	GitHub Pages DNS servers (=x.x.x.153=) are down for some reason, all custom
	66	domains which use fixed GitHub Pages IP addresses will not be accessible (their
	67	DNS requests will not be resolvable).
	68
	69	That is why GitHub strongly suggests to either use a second-level domain for
	70	your GitHub Pages (e.g. =blog.example.com=) or use a DNS service provider that
	71	supports a record type =ALIAS= that acts as =A= record but forwards request to a
	72	URL address (e.g. =username.github.io=) instead of a fixed IP address.
77	73
78	74	** How GitHub Pages treats HTTP requests
79		After a DNS request for =your_github_username.github.io= is resolved
80		into an IP address, e.g. =185.199.108.153= your browser sends an HTTP
81		request to that server with an HTTP header =Host=. Below are =curl=
82		examples that load the same website (these examples might not work if
83		you are behind a proxy server):
	75	After a DNS request for =your_github_username.github.io= is resolved into an IP
	76	address, e.g. =185.199.108.153= your browser sends an HTTP request to that
	77	server with an HTTP header =Host=. Below are =curl= examples that load the same
	78	website (these examples might not work if you are behind a proxy server):
84	79
85	80	#+begin_src sh
86	81	curl --header "Host: your_github_username.github.io" http://185.199.108.153/
		@@ -91,30 +86,25 @@ curl --header "Host: example.com" http://185.199.108.153/
91	86	This way GitHub Pages servers know which user website to serve.
92	87
93	88	#+begin_quote
94		GitHub Pages server will automatically redirect HTTP requests to the
95		top-level domain if your =CNAME= file contains =example.com= but
96		=www.example.com= is requested.
	89	GitHub Pages server will automatically redirect HTTP requests to the top-level
	90	domain if your =CNAME= file contains =example.com= but =www.example.com= is
	91	requested.
97	92
98		The same is valid if your =CNAME= file contains =www.example.com= but
99		the header =Host= in the =HTTP= request contains =example.com=.
	93	The same is valid if your =CNAME= file contains =www.example.com= but the header
	94	=Host= in the =HTTP= request contains =example.com=.
100	95	#+end_quote
101	96
102	97	** Why can't I add a =CNAME= record entry that accepts a top-level request (=@=) to my DNS configuration?
103	98	Quote from the GitHub Pages documentation:
104	99
105	100	#+begin_quote
106		Warning: Do not create a CNAME record for your custom apex domain! Doing
107		so may cause issues with other services, such as email, on that domain.
	101	Warning: Do not create a CNAME record for your custom apex domain! Doing so may
	102	cause issues with other services, such as email, on that domain.
108	103	#+end_quote
109	104
110	105	** References:
111		1. [[https://docs.github.com/en/github/working-with-github-pages/configuring-a-custom-domain-for-your-github-pages-site][Setting
112		up a custom domain with GitHub Pages]]
113		2. [[https://docs.github.com/en/github/working-with-github-pages/troubleshooting-custom-domains-and-github-pages][My
114		custom domain isn't working]]
115		3. [[https://serverfault.com/questions/589370/cannot-access-my-github-pages-website-by-ip-address][Cannot
116		access my GitHub Pages website by IP Address]]
117		4. [[https://stackoverflow.com/questions/23375422/how-do-i-set-up-github-pages-to-redirect-dns-requests-from-a-subdomain-e-g-www][How
118		do I set up GitHub Pages to redirect DNS requests from a subdomain
119		(e.g. www) to the top-level domain (TLD, Apex record)?]]
120
	106	1. [[https://docs.github.com/en/github/working-with-github-pages/configuring-a-custom-domain-for-your-github-pages-site][Setting up a custom domain with GitHub Pages]]
	107	2. [[https://docs.github.com/en/github/working-with-github-pages/troubleshooting-custom-domains-and-github-pages][My custom domain isn't working]]
	108	3. [[https://serverfault.com/questions/589370/cannot-access-my-github-pages-website-by-ip-address][Cannot access my GitHub Pages website by IP Address]]
	109	4. [[https://stackoverflow.com/questions/23375422/how-do-i-set-up-github-pages-to-redirect-dns-requests-from-a-subdomain-e-g-www][How do I set up GitHub Pages to redirect DNS requests from a subdomain (e.g.
	110	www) to the top-level domain (TLD, Apex record)?]]

content/blog/2020-08-29-php-auth-flow.org +40 −47

		@@ -4,16 +4,15 @@
4	4	#+filetags: :dev:
5	5
6	6	* Introduction
7		When creating websites that will allow users to create accounts, the
8		developer always needs to consider the proper authentication flow for
9		their app. For example, some developers will utilize an API for
10		authentication, some will use OAuth, and some may just use their own
11		simple database.
	7	When creating websites that will allow users to create accounts, the developer
	8	always needs to consider the proper authentication flow for their app. For
	9	example, some developers will utilize an API for authentication, some will use
	10	OAuth, and some may just use their own simple database.
12	11
13		For those using pre-built libraries, authentication may simply be a
14		problem of copying and pasting the code from their library's
15		documentation. For example, here's the code I use to authenticate users
16		with the Tumblr OAuth API for my Tumblr client, Vox Populi:
	12	For those using pre-built libraries, authentication may simply be a problem of
	13	copying and pasting the code from their library's documentation. For example,
	14	here's the code I use to authenticate users with the Tumblr OAuth API for my
	15	Tumblr client, Vox Populi:
17	16
18	17	#+begin_src php
19	18	// Start the session
		@@ -38,23 +37,22 @@ $client = new Tumblr\API\Client(
38	37	);
39	38	#+end_src
40	39
41		However, developers creating authentication flows from scratch will need
42		to think carefully about when to make sure a web page will check the
43		user's authenticity.
	40	However, developers creating authentication flows from scratch will need to
	41	think carefully about when to make sure a web page will check the user's
	42	authenticity.
44	43
45		In this article, we're going to look at a simple authentication flow
46		using a MySQL database and PHP.
	44	In this article, we're going to look at a simple authentication flow using a
	45	MySQL database and PHP.
47	46
48	47	* Creating User Accounts
49		The beginning to any type of user authentication is to create a user
50		account. This process can take many formats, but the simplest is to
51		accept user input from a form (e.g., username and password) and send it
52		over to your database. For example, here's a snippet that shows how to
53		get username and password parameters that would come when a user submits
54		a form to your PHP script.
	48	The beginning to any type of user authentication is to create a user account.
	49	This process can take many formats, but the simplest is to accept user input
	50	from a form (e.g., username and password) and send it over to your database. For
	51	example, here's a snippet that shows how to get username and password parameters
	52	that would come when a user submits a form to your PHP script.
55	53
56		Note: Ensure that your password column is large enough to hold the
57		hashed value (at least 60 characters or longer).
	54	Note: Ensure that your password column is large enough to hold the hashed
	55	value (at least 60 characters or longer).
58	56
59	57	#+begin_src php
60	58	// Get the values from the URL
		@@ -92,9 +90,9 @@ $conn->close();
92	90	#+end_src
93	91
94	92	** Validate Returning Users
95		To be able to verify that a returning user has a valid username and
96		password in your database is as simple as having users fill out a form
97		and comparing their inputs to your database.
	93	To be able to verify that a returning user has a valid username and password in
	94	your database is as simple as having users fill out a form and comparing their
	95	inputs to your database.
98	96
99	97	#+begin_src php
100	98	// Query the database for username and password
		@@ -110,24 +108,23 @@ if(password_verify($password_input, $hashed_password)) {
110	108	#+end_src
111	109
112	110	* Storing Authentication State
113		Once you've created the user's account, now you're ready to initialize
114		the user's session. *You will need to do this on every page you load
115		while the user is logged in.** To do so, simply enter the following code
116		snippet:
	111	Once you've created the user's account, now you're ready to initialize the
	112	user's session. *You will need to do this on every page you load while the user
	113	is logged in.** To do so, simply enter the following code snippet:
117	114
118	115	#+begin_src php
119	116	session_start();
120	117	#+end_src
121	118
122		Once you've initialized the session, the next step is to store the
123		session in a cookie so that you can access it later.
	119	Once you've initialized the session, the next step is to store the session in a
	120	cookie so that you can access it later.
124	121
125	122	#+begin_src php
126	123	setcookie(session_name());
127	124	#+end_src
128	125
129		Now that the session name has been stored, you'll be able to check if
130		there's an active session whenever you load a page.
	126	Now that the session name has been stored, you'll be able to check if there's an
	127	active session whenever you load a page.
131	128
132	129	#+begin_src php
133	130	if(isset(session_name())) {
		@@ -136,9 +133,9 @@ if(isset(session_name())) {
136	133	#+end_src
137	134
138	135	** Removing User Authentication
139		The next logical step is to give your users the option to log out once
140		they are done using your application. This can be tricky in PHP since a
141		few of the standard ways do not always work.
	136	The next logical step is to give your users the option to log out once they are
	137	done using your application. This can be tricky in PHP since a few of the
	138	standard ways do not always work.
142	139
143	140	#+begin_src php
144	141	// Initialize the session.
		@@ -175,14 +172,10 @@ die();
175	172	#+end_src
176	173
177	174	* Wrapping Up
178		Now you should be ready to begin your authentication programming with
179		PHP. You can create user accounts, create sessions for users across
180		different pages of your site, and then destroy the user data when
181		they're ready to leave.
182
183		For more information on this subject, I recommend reading the
184		[[https://www.php.net/][PHP Documentation]]. Specifically, you may want
185		to look at [[https://www.php.net/manual/en/features.http-auth.php][HTTP
186		Authentication with PHP]],
187		[[https://www.php.net/manual/en/book.session.php][session handling]],
188		and [[https://www.php.net/manual/en/function.hash.php][hash]].
	175	Now you should be ready to begin your authentication programming with PHP. You
	176	can create user accounts, create sessions for users across different pages of
	177	your site, and then destroy the user data when they're ready to leave.
	178
	179	For more information on this subject, I recommend reading the [[https://www.php.net/][PHP Documentation]].
	180	Specifically, you may want to look at [[https://www.php.net/manual/en/features.http-auth.php][HTTP Authentication with PHP]], [[https://www.php.net/manual/en/book.session.php][session
	181	handling]], and [[https://www.php.net/manual/en/function.hash.php][hash]].

content/blog/2020-09-01-visual-recognition.org +62 −73

		@@ -4,37 +4,30 @@
4	4	#+filetags: :dev:
5	5
6	6	* What is IBM Watson?
7		If you've never heard of [[https://www.ibm.com/watson][Watson]], this
8		service is a suite of enterprise-ready AI services, applications, and
9		tooling provided by IBM. Watson contains quite a few useful tools for
10		data scientists and students, including the subject of this post today:
11		visual recognition.
	7	If you've never heard of [[https://www.ibm.com/watson][Watson]], this service is a suite of enterprise-ready AI
	8	services, applications, and tooling provided by IBM. Watson contains quite a few
	9	useful tools for data scientists and students, including the subject of this
	10	post today: visual recognition.
12	11
13		If you'd like to view the official documentation for the Visual
14		Recognition API, visit the
15		[[https://cloud.ibm.com/apidocs/visual-recognition/visual-recognition-v3?code=python][API
16		Docs]].
	12	If you'd like to view the official documentation for the Visual Recognition API,
	13	visit the [[https://cloud.ibm.com/apidocs/visual-recognition/visual-recognition-v3?code=python][API Docs]].
17	14
18	15	* Prerequisites
19	16	To be able to use Watson Visual Recognition, you'll need the following:
20	17
21		1. Create a free account on
22		[[https://www.ibm.com/cloud/watson-studio][IBM Watson Studio]].
23		2. Add the [[https://www.ibm.com/cloud/watson-visual-recognition][Watson
24		Visual Recognition]] service to your IBM Watson account.
25		3. Get your API key and URL. To do this, first go to the
26		[[https://dataplatform.cloud.ibm.com/home2?context=cpdaas][profile
27		dashboard]] for your IBM account and click on the Watson Visual
28		Recognition service you created. This will be listed in the section
29		titled Your services. Then click the Credentials* tab and open the
30		Auto-generated credentials* dropdown. Copy your API key and URL so
31		that you can use them in the Python script later.
32		4. [Optional]* While not required, you can also create the Jupyter
33		Notebook for this project right inside
34		[[https://www.ibm.com/cloud/watson-studio][Watson Studio]]. Watson
35		Studio will save your notebooks inside an organized project and allow
36		you to use their other integrated products, such as storage
37		containers, AI models, documentation, external sharing, etc.
	18	1. Create a free account on [[https://www.ibm.com/cloud/watson-studio][IBM Watson Studio]].
	19	2. Add the [[https://www.ibm.com/cloud/watson-visual-recognition][Watson Visual Recognition]] service to your IBM Watson account.
	20	3. Get your API key and URL. To do this, first go to the [[https://dataplatform.cloud.ibm.com/home2?context=cpdaas][profile dashboard]] for
	21	your IBM account and click on the Watson Visual Recognition service you
	22	created. This will be listed in the section titled Your services. Then
	23	click the Credentials* tab and open the Auto-generated credentials*
	24	dropdown. Copy your API key and URL so that you can use them in the Python
	25	script later.
	26	4. [Optional]* While not required, you can also create the Jupyter Notebook
	27	for this project right inside [[https://www.ibm.com/cloud/watson-studio][Watson Studio]]. Watson Studio will save your
	28	notebooks inside an organized project and allow you to use their other
	29	integrated products, such as storage containers, AI models, documentation,
	30	external sharing, etc.
38	31
39	32	* Calling the IBM Watson Visual Recognition API
40	33	Okay, now let's get started.
		@@ -45,8 +38,8 @@ To begin, we need to install the proper Python package for IBM Watson.
45	38	pip install --upgrade --user "ibm-watson>=4.5.0"
46	39	#+end_src
47	40
48		Next, we need to specify the API key, version, and URL given to us when
49		we created the Watson Visual Recognition service.
	41	Next, we need to specify the API key, version, and URL given to us when we
	42	created the Watson Visual Recognition service.
50	43
51	44	#+begin_src python
52	45	apikey = "<your-apikey>"
		@@ -70,15 +63,15 @@ visual_recognition = VisualRecognitionV3(
70	63	visual_recognition.set_service_url(url)
71	64	#+end_src
72	65
73		[Optional] If you'd like to tell the API not to use any data to
74		improve their products, set the following header.
	66	[Optional] If you'd like to tell the API not to use any data to improve their
	67	products, set the following header.
75	68
76	69	#+begin_src python
77	70	visual_recognition.set_default_headers({'x-watson-learning-opt-out': "true"})
78	71	#+end_src
79	72
80		Now we have our API all set and ready to go. For this example, I'm going
81		to include a =dict= of photos to load as we test out the API.
	73	Now we have our API all set and ready to go. For this example, I'm going to
	74	include a =dict= of photos to load as we test out the API.
82	75
83	76	#+begin_src python
84	77	data = [
		@@ -109,14 +102,14 @@ data = [
109	102	]
110	103	#+end_src
111	104
112		Now that we've set up our libraries and have the photos ready, let's
113		create a loop to call the API for each image. The code below shows a
114		loop that calls the URL of each image and sends it to the API,
115		requesting results with at least 60% confidence. The results are output
116		to the console with dotted lines separating each section.
	105	Now that we've set up our libraries and have the photos ready, let's create a
	106	loop to call the API for each image. The code below shows a loop that calls the
	107	URL of each image and sends it to the API, requesting results with at least 60%
	108	confidence. The results are output to the console with dotted lines separating
	109	each section.
117	110
118		In the case of an API error, the codes and explanations are output to
119		the console.
	111	In the case of an API error, the codes and explanations are output to the
	112	console.
120	113
121	114	#+begin_src python
122	115	from ibm_watson import ApiException
		@@ -142,23 +135,22 @@ except ApiException as ex:
142	135	#+end_src
143	136
144	137	* The Results
145		Here we can see the full result set of our function above. If you view
146		each of the URLs that we sent to the API, you'll be able to see that it
147		was remarkably accurate. To be fair, these are clear high-resolution,
148		clear photos shot with a professional camera. In reality, you will most
149		likely be processing images that are lower quality and may have a lot of
150		noise in the photo.
151
152		However, we can clearly see the benefit of being able to call this API
153		instead of attempting to write our own image recognition function. Each
154		of the classifications returned was a fair description of the image.
155
156		If you wanted to restrict the results to those that are at least 90%
157		confident or greater, you would simply adjust the =threshold= in the
	138	Here we can see the full result set of our function above. If you view each of
	139	the URLs that we sent to the API, you'll be able to see that it was remarkably
	140	accurate. To be fair, these are clear high-resolution, clear photos shot with a
	141	professional camera. In reality, you will most likely be processing images that
	142	are lower quality and may have a lot of noise in the photo.
	143
	144	However, we can clearly see the benefit of being able to call this API instead
	145	of attempting to write our own image recognition function. Each of the
	146	classifications returned was a fair description of the image.
	147
	148	If you wanted to restrict the results to those that are at least 90% confident
	149	or greater, you would simply adjust the =threshold= in the
158	150	=visual_recognition.classify()= function.
159	151
160		When your program runs, it should show the output below for each photo
161		you provide.
	152	When your program runs, it should show the output below for each photo you
	153	provide.
162	154
163	155	#+begin_src txt
164	156	----------------------------------------------------------------
		@@ -176,22 +168,19 @@ greenishness color ( 0.975 )
176	168	#+end_src
177	169
178	170	* Discussion
179		Now, this was a very minimal implementation of the API. We simply
180		supplied some images and looked to see how accurate the results were.
181		However, you could implement this type of API into many machine learning
182		(ML) models.
183
184		For example, you could be working for a company that scans their
185		warehouses or inventory using drones. Would you want to pay employees to
186		sit there and watch drone footage all day in order to identify or count
187		things in the video? Probably not. Instead, you could use a
188		classification system similar to this one in order to train your machine
189		learning model to correctly identify items that the drones show through
190		video. More specifically, you could have your machine learning model
191		watch a drone fly over a field of sheep in order to count how many sheep
192		are living in that field.
193
194		There are many ways to implement machine learning functionality, but
195		hopefully this post helped inspire some deeper thought about the tools
196		that can help propel us further into the future of machine learning and
197		AI.
	171	Now, this was a very minimal implementation of the API. We simply supplied some
	172	images and looked to see how accurate the results were. However, you could
	173	implement this type of API into many machine learning (ML) models.
	174
	175	For example, you could be working for a company that scans their warehouses or
	176	inventory using drones. Would you want to pay employees to sit there and watch
	177	drone footage all day in order to identify or count things in the video?
	178	Probably not. Instead, you could use a classification system similar to this one
	179	in order to train your machine learning model to correctly identify items that
	180	the drones show through video. More specifically, you could have your machine
	181	learning model watch a drone fly over a field of sheep in order to count how
	182	many sheep are living in that field.
	183
	184	There are many ways to implement machine learning functionality, but hopefully
	185	this post helped inspire some deeper thought about the tools that can help
	186	propel us further into the future of machine learning and AI.

content/blog/2020-09-22-internal-audit.org +162 −177

		@@ -7,64 +7,63 @@
7	7	[[https://img.cleberg.net/blog/20200922-what-is-internal-audit/internal-audit-overview.jpg]]
8	8
9	9	* Definitions
10		One of the many reasons that Internal Audit needs such thorough
11		explaining to non-auditors is that Internal Audit can serve many
12		purposes, depending on the organization's size and needs. However, the
13		Institute of Internal Auditors (IIA) defines Internal Auditing as:
	10	One of the many reasons that Internal Audit needs such thorough explaining to
	11	non-auditors is that Internal Audit can serve many purposes, depending on the
	12	organization's size and needs. However, the Institute of Internal Auditors (IIA)
	13	defines Internal Auditing as:
14	14
15	15	#+begin_quote
16		Internal auditing is an independent, objective assurance and consulting
17		activity designed to add value and improve an organization's operations.
18		It helps an organization accomplish its objectives by bringing a
19		systematic, disciplined approach to evaluate and improve the
20		effectiveness of risk management, control, and governance processes.
	16	Internal auditing is an independent, objective assurance and consulting activity
	17	designed to add value and improve an organization's operations. It helps an
	18	organization accomplish its objectives by bringing a systematic, disciplined
	19	approach to evaluate and improve the effectiveness of risk management, control,
	20	and governance processes.
21	21
22	22	#+end_quote
23	23
24		However, this definition uses quite a few terms that aren't clear unless
25		the reader already has a solid understanding of the auditing profession.
26		To further explain, the following is a list of definitions that can help
27		supplement understanding of internal auditing.
	24	However, this definition uses quite a few terms that aren't clear unless the
	25	reader already has a solid understanding of the auditing profession. To further
	26	explain, the following is a list of definitions that can help supplement
	27	understanding of internal auditing.
28	28
29	29	** Independent
30		Independence is the freedom from conditions that threaten the ability of
31		the internal audit activity to carry out internal audit responsibilities
32		in an unbiased manner. To achieve the degree of independence necessary
33		to effectively carry out the responsibilities of the internal audit
34		activity, the chief audit executive has direct and unrestricted access
35		to senior management and the board. This can be achieved through a
36		dual-reporting relationship. Threats to independence must be managed at
37		the individual auditor, engagement, functional, and organizational
38		levels.
	30	Independence is the freedom from conditions that threaten the ability of the
	31	internal audit activity to carry out internal audit responsibilities in an
	32	unbiased manner. To achieve the degree of independence necessary to effectively
	33	carry out the responsibilities of the internal audit activity, the chief audit
	34	executive has direct and unrestricted access to senior management and the board.
	35	This can be achieved through a dual-reporting relationship. Threats to
	36	independence must be managed at the individual auditor, engagement, functional,
	37	and organizational levels.
39	38
40	39	** Objective
41		Objectivity is an unbiased mental attitude that allows internal auditors
42		to perform engagements in such a manner that they believe in their work
43		product and that no quality compromises are made. Objectivity requires
44		that internal auditors do not subordinate their judgment on audit
45		matters to others. Threats to objectivity must be managed at the
46		individual auditor, engagement, functional, and organizational levels.
	40	Objectivity is an unbiased mental attitude that allows internal auditors to
	41	perform engagements in such a manner that they believe in their work product and
	42	that no quality compromises are made. Objectivity requires that internal
	43	auditors do not subordinate their judgment on audit matters to others. Threats
	44	to objectivity must be managed at the individual auditor, engagement,
	45	functional, and organizational levels.
47	46
48	47	** Assurance
49		Assurance services involve the internal auditor's objective assessment
50		of evidence to provide opinions or conclusions regarding an entity,
51		operation, function, process, system, or other subject matters. The
52		internal auditor determines the nature and scope of an assurance
53		engagement. Generally, three parties are participants in assurance
54		services: (1) the person or group directly involved with the entity,
55		operation, function, process, system, or other subject - (the process
56		owner), (2) the person or group making the assessment - (the internal
57		auditor), and (3) the person or group using the assessment - (the user).
	48	Assurance services involve the internal auditor's objective assessment of
	49	evidence to provide opinions or conclusions regarding an entity, operation,
	50	function, process, system, or other subject matters. The internal auditor
	51	determines the nature and scope of an assurance engagement. Generally, three
	52	parties are participants in assurance services: (1) the person or group directly
	53	involved with the entity, operation, function, process, system, or other
	54	subject - (the process owner), (2) the person or group making the assessment -
	55	(the internal auditor), and (3) the person or group using the assessment - (the
	56	user).
58	57
59	58	** Consulting
60		Consulting services are advisory in nature and are generally performed
61		at the specific request of an engagement client. The nature and scope of
62		the consulting engagement are subject to agreement with the engagement
63		client. Consulting services generally involve two parties: (1) the
64		person or group offering the advice (the internal auditor), and (2) the
65		person or group seeking and receiving the advice (the engagement
66		client). When performing consulting services, the internal auditor
67		should maintain objectivity and not assume management responsibility.
	59	Consulting services are advisory in nature and are generally performed at the
	60	specific request of an engagement client. The nature and scope of the consulting
	61	engagement are subject to agreement with the engagement client. Consulting
	62	services generally involve two parties: (1) the person or group offering the
	63	advice (the internal auditor), and (2) the person or group seeking and receiving
	64	the advice (the engagement client). When performing consulting services, the
	65	internal auditor should maintain objectivity and not assume management
	66	responsibility.
68	67
69	68	** Governance, Risk Management, & Compliance (GRC)
70	69	The integrated collection of capabilities that enable an organization to
		@@ -72,176 +71,162 @@ reliably achieve objectives, address uncertainty and act with integrity.
72	71
73	72	* Audit Charter & Standards
74	73	First, it's important to note that not every organization needs internal
75		auditors. In fact, it's unwise for an organization to hire internal
76		auditors unless they have regulatory requirements for auditing and have
77		the capital to support the department. Internal audit is a cost center
78		that can only affect revenue indirectly.
79
80		Once an organization determines the need for internal assurance
81		services, they will hire a Chief Audit Executive and create the audit
82		charter. This charter is a document, approved by the company's governing
83		body, that will define internal audit's purpose, authority,
84		responsibility, and position within the organization. Fortunately, the
85		IIA has model charters available to IIA members for those developing or
86		improving their charter.
87
88		Beyond the charter and organizational documents, internal auditors
89		follow a few different standards in order to perform their job. First is
90		the International Professional Practices Framework (IPPF) by the IIA,
91		which is the model of standards for internal auditing. In addition,
92		ISACA's Information Technology Assurance Framework (ITAF) helps guide
93		auditors in reference to information technology (IT) compliance and
94		assurance. Finally, additional standards such as FASB, GAAP, and
95		industry-specific standards are used when performing internal audit
96		work.
	74	auditors. In fact, it's unwise for an organization to hire internal auditors
	75	unless they have regulatory requirements for auditing and have the capital to
	76	support the department. Internal audit is a cost center that can only affect
	77	revenue indirectly.
	78
	79	Once an organization determines the need for internal assurance services, they
	80	will hire a Chief Audit Executive and create the audit charter. This charter is
	81	a document, approved by the company's governing body, that will define internal
	82	audit's purpose, authority, responsibility, and position within the
	83	organization. Fortunately, the IIA has model charters available to IIA members
	84	for those developing or improving their charter.
	85
	86	Beyond the charter and organizational documents, internal auditors follow a few
	87	different standards in order to perform their job. First is the International
	88	Professional Practices Framework (IPPF) by the IIA, which is the model of
	89	standards for internal auditing. In addition, ISACA's Information Technology
	90	Assurance Framework (ITAF) helps guide auditors in reference to information
	91	technology (IT) compliance and assurance. Finally, additional standards such as
	92	FASB, GAAP, and industry-specific standards are used when performing internal
	93	audit work.
97	94
98	95	* Three Lines of Defense
99		[[https://theiia.org][The IIA]] released the original Three Lines of
100		Defense model in 2013, but have released an updated version in 2020.
101		Here is what the Three Lines of Defense model has historically looked
102		like:
	96	[[https://theiia.org][The IIA]] released the original Three Lines of Defense model in 2013, but have
	97	released an updated version in 2020. Here is what the Three Lines of Defense
	98	model has historically looked like:
103	99
104	100	#+caption: 2013 Three Lines of Defense Model
105	101	[[https://img.cleberg.net/blog/20200922-what-is-internal-audit/three_lines_model.png]]
106	102
107		I won't go into depth about the changes made to the model in this
108		article. Instead, let's take a look at the most current model.
	103	I won't go into depth about the changes made to the model in this article.
	104	Instead, let's take a look at the most current model.
109	105
110	106	#+caption: 2020 Three Lines of Defense Model
111	107	[[https://img.cleberg.net/blog/20200922-what-is-internal-audit/updated_three_lines_model.png]]
112	108
113	109	The updated model forgets the strict idea of areas performing their own
114		functions or line of defense. Instead of talking about management, risk,
115		and internal audit as 1-2-3, the new model creates a more fluid and
116		cooperative model.
117
118		Looking at this model from an auditing perspective shows us that
119		auditors will need to align, communicate, and collaborate with
120		management, including business area managers and chief officers, as well
121		as reporting to the governing body. The governing body will instruct
122		internal audit /functionally/ on their goals and track their progress
123		periodically.
124
125		However, the internal audit department will report /administratively/ to
126		a chief officer in the company for the purposes of collaboration,
127		direction, and assistance with the business. Note that in most
128		situations, the governing body is the audit committee on the company's
129		board of directors.
130
131		The result of this structure is that internal audit is an independent
132		and objective function that can provide assurance over the topics they
133		audit.
	110	functions or line of defense. Instead of talking about management, risk, and
	111	internal audit as 1-2-3, the new model creates a more fluid and cooperative
	112	model.
	113
	114	Looking at this model from an auditing perspective shows us that auditors will
	115	need to align, communicate, and collaborate with management, including business
	116	area managers and chief officers, as well as reporting to the governing body.
	117	The governing body will instruct internal audit /functionally/ on their goals
	118	and track their progress periodically.
	119
	120	However, the internal audit department will report /administratively/ to a chief
	121	officer in the company for the purposes of collaboration, direction, and
	122	assistance with the business. Note that in most situations, the governing body
	123	is the audit committee on the company's board of directors.
	124
	125	The result of this structure is that internal audit is an independent and
	126	objective function that can provide assurance over the topics they audit.
134	127
135	128	* Audit Process
136		A normal audit will generally follow the same process, regardless of the
137		topic. However, certain special projects or abnormal business areas may
138		call for changes to the audit process. The audit process is not set in
139		stone, it's simply a set of best practices so that audits can be
140		performed consistently.
	129	A normal audit will generally follow the same process, regardless of the topic.
	130	However, certain special projects or abnormal business areas may call for
	131	changes to the audit process. The audit process is not set in stone, it's simply
	132	a set of best practices so that audits can be performed consistently.
141	133
142	134	#+caption: The Internal Audit Process
143	135	[[https://img.cleberg.net/blog/20200922-what-is-internal-audit/internal-audit-process.jpg]]
144	136
145		While different organizations may tweak the process, it will generally
146		follow this flow:
	137	While different organizations may tweak the process, it will generally follow
	138	this flow:
147	139
148	140	** 1. Risk Assessment
149	141	The risk assessment part of the process has historically been performed
150		annually, but many organizations have moved to performing this process
151		much more frequently. In fact, some organizations are moving to an agile
152		approach that can take new risks into the risk assessment and
153		re-prioritize risk areas on-the-go. To perform a risk assessment,
154		leaders in internal audit will research industry risks, consult with
155		business leaders around the company, and perform analyses on company
156		data.
	142	annually, but many organizations have moved to performing this process much more
	143	frequently. In fact, some organizations are moving to an agile approach that can
	144	take new risks into the risk assessment and re-prioritize risk areas on-the-go.
	145	To perform a risk assessment, leaders in internal audit will research industry
	146	risks, consult with business leaders around the company, and perform analyses on
	147	company data.
157	148
158	149	Once a risk assessment has been documented, the audit department has a
159		prioritized list of risks that can be audited. This is usually in the
160		form of auditable entities, such as business areas or departments.
	150	prioritized list of risks that can be audited. This is usually in the form of
	151	auditable entities, such as business areas or departments.
161	152
162	153	** 2. Planning
163		During the planning phase of an audit, auditors will meet with the
164		business area to discuss the various processes, controls, and risks
165		applicable to the business. This helps the auditors determine the scope
166		limits for the audit, as well as timing and subject-matter experts.
167		Certain documents will be created in this phase that will be used to
168		keep the audit on-track an in-scope as it goes forward.
	154	During the planning phase of an audit, auditors will meet with the business area
	155	to discuss the various processes, controls, and risks applicable to the
	156	business. This helps the auditors determine the scope limits for the audit, as
	157	well as timing and subject-matter experts. Certain documents will be created in
	158	this phase that will be used to keep the audit on-track an in-scope as it goes
	159	forward.
169	160
170	161	** 3. Testing
171		The testing phase, also known as fieldwork or execution, is where
172		internal auditors will take the information they've discovered and test
173		it against regulations, industry standards, company rules, best
174		practices, as well as validating that any processes are complete and
175		accurate. For example, an audit of HR would most likely examine
176		processes such as employee on-boarding, employee termination, security
177		of personally identifiable information (PII), or the IT systems involved
178		in these processes. Company standards would be examined and compared
179		against how the processes are actually being performed day-to-day, as
180		well as compared against regulations such as the Equal Employment
181		Opportunity (EEO), American with Disabilities Act, and National Labor
182		Relations Act.
	162	The testing phase, also known as fieldwork or execution, is where internal
	163	auditors will take the information they've discovered and test it against
	164	regulations, industry standards, company rules, best practices, as well as
	165	validating that any processes are complete and accurate. For example, an audit
	166	of HR would most likely examine processes such as employee on-boarding, employee
	167	termination, security of personally identifiable information (PII), or the IT
	168	systems involved in these processes. Company standards would be examined and
	169	compared against how the processes are actually being performed day-to-day, as
	170	well as compared against regulations such as the Equal Employment Opportunity
	171	(EEO), American with Disabilities Act, and National Labor Relations Act.
183	172
184	173	** 4. Reporting
185		Once all the tests have been completed, the audit will enter the
186		reporting phase. This is when the audit team will conclude on the
187		evidence they've collected, interviews they've held, and any opinions
188		they've formed on the controls in place. A summary of the audit
189		findings, conclusions, and specific recommendations are officially
190		communicated to the client through a draft report. Clients have the
191		opportunity to respond to the report and submit an action plan and time
192		frame. These responses become part of the final report which is
193		distributed to the appropriate level of administration.
	174	Once all the tests have been completed, the audit will enter the reporting
	175	phase. This is when the audit team will conclude on the evidence they've
	176	collected, interviews they've held, and any opinions they've formed on the
	177	controls in place. A summary of the audit findings, conclusions, and specific
	178	recommendations are officially communicated to the client through a draft
	179	report. Clients have the opportunity to respond to the report and submit an
	180	action plan and time frame. These responses become part of the final report
	181	which is distributed to the appropriate level of administration.
194	182
195	183	** 5. Follow-Up
196		After audits have been completed and management has formed action plans
197		and time frames for audit issues, internal audit will follow up once
198		that due date has arrived. In most cases, the follow-up will simply
199		consist of a meeting to discuss how the action plan has been completed
200		and to request documentation to prove it.
	184	After audits have been completed and management has formed action plans and time
	185	frames for audit issues, internal audit will follow up once that due date has
	186	arrived. In most cases, the follow-up will simply consist of a meeting to
	187	discuss how the action plan has been completed and to request documentation to
	188	prove it.
201	189
202	190	* Audit Department Structure
203	191	While an internal audit department is most often thought of as a team of
204	192	full-time employees, there are actually many different ways in which a
205		department can be structured. As the world becomes more digital and
206		fast-paced, outsourcing has become a more attractive option for some
207		organizations. Internal audit can be fully outsourced or partially
208		outsourced, allowing for flexibility in cases where turnover is high.
209
210		In addition, departments can implement a rotational model. This allows
211		for interested employees around the organization to rotate into the
212		internal audit department for a period of time, allowing them to obtain
213		knowledge of risks and controls and allowing the internal audit team to
214		obtain more business area knowledge. This program is popular in very
215		large organizations, but organizations tend to rotate lower-level audit
216		staff instead of managers. This helps prevent any significant knowledge
217		loss as auditors rotate out to business areas.
	193	department can be structured. As the world becomes more digital and fast-paced,
	194	outsourcing has become a more attractive option for some organizations. Internal
	195	audit can be fully outsourced or partially outsourced, allowing for flexibility
	196	in cases where turnover is high.
	197
	198	In addition, departments can implement a rotational model. This allows for
	199	interested employees around the organization to rotate into the internal audit
	200	department for a period of time, allowing them to obtain knowledge of risks and
	201	controls and allowing the internal audit team to obtain more business area
	202	knowledge. This program is popular in very large organizations, but
	203	organizations tend to rotate lower-level audit staff instead of managers. This
	204	helps prevent any significant knowledge loss as auditors rotate out to business
	205	areas.
218	206
219	207	* Consulting
220		Consulting is not an easy task at any organization, especially for a
221		department that can have negative perceptions within the organization as
222		the "compliance police." However, once an internal audit department has
223		delivered value to organization, adding consulting to their suite of
224		services is a smart move. In most cases, Internal Audit can insert
225		themselves into a consulting role without affecting the process of
226		project management at the company. This means that internal audit can
227		add objective assurance and opinions to business areas as they develop
228		new processes, instead of coming in periodically to audit an area and
229		file issues that could have been fixed at the beginning.
	208	Consulting is not an easy task at any organization, especially for a department
	209	that can have negative perceptions within the organization as the "compliance
	210	police." However, once an internal audit department has delivered value to
	211	organization, adding consulting to their suite of services is a smart move. In
	212	most cases, Internal Audit can insert themselves into a consulting role without
	213	affecting the process of project management at the company. This means that
	214	internal audit can add objective assurance and opinions to business areas as
	215	they develop new processes, instead of coming in periodically to audit an area
	216	and file issues that could have been fixed at the beginning.
230	217
231	218	* Data Science & Data Analytics
232	219	#+caption: Data Science Skill Set
233	220	[[https://img.cleberg.net/blog/20200922-what-is-internal-audit/data-science-skillset.png]]
234	221
235		One major piece of the internal audit function in the modern world is
236		data science. While the process is data science, most auditors will
237		refer to anything in this realm as data analytics. Hot topics such as
238		robotic process automation (RPA), machine learning (ML), and data mining
239		have taken over the auditing world in recent years. These technologies
240		have been immensely helpful with increasing the effectiveness and
241		efficiency of auditors.
242
243		For example, mundane and repetitive tasks can be automated in order for
244		auditors to make more room in their schedules for labor-intensive work.
245		Further, auditors will need to adapt technologies like machine learning
246		in order to extract more value from the data they're using to form
247		conclusions.
	222	One major piece of the internal audit function in the modern world is data
	223	science. While the process is data science, most auditors will refer to anything
	224	in this realm as data analytics. Hot topics such as robotic process automation
	225	(RPA), machine learning (ML), and data mining have taken over the auditing world
	226	in recent years. These technologies have been immensely helpful with increasing
	227	the effectiveness and efficiency of auditors.
	228
	229	For example, mundane and repetitive tasks can be automated in order for auditors
	230	to make more room in their schedules for labor-intensive work. Further, auditors
	231	will need to adapt technologies like machine learning in order to extract more
	232	value from the data they're using to form conclusions.

content/blog/2020-09-25-happiness-map.org +34 −39

		@@ -4,10 +4,9 @@
4	4	#+filetags: :data:
5	5
6	6	* Background Information
7		The dataset (obtained from
8		[[https://www.kaggle.com/unsdsn/world-happiness][Kaggle]]) used in this
9		article contains a list of countries around the world, their happiness
10		rankings and scores, as well as other national scoring measures.
	7	The dataset (obtained from [[https://www.kaggle.com/unsdsn/world-happiness][Kaggle]]) used in this article contains a list of
	8	countries around the world, their happiness rankings and scores, as well as
	9	other national scoring measures.
11	10
12	11	Fields include:
13	12
		@@ -20,8 +19,8 @@ Fields include:
20	19	- Generosity
21	20	- Perceptions of corruption
22	21
23		There are 156 records. Since there are ~195 countries in the world, we
24		can see that around 40 countries will be missing from this dataset.
	22	There are 156 records. Since there are ~195 countries in the world, we can see
	23	that around 40 countries will be missing from this dataset.
25	24
26	25	* Install Packages
27	26	As always, run the =install= command for all packages needed to perform
		@@ -32,9 +31,8 @@ analysis.
32	31	#+end_src
33	32
34	33	* Import the Data
35		We only need a couple packages to create a choropleth map. We will use
36		[[https://python-visualization.github.io/folium/][Folium]], which
37		provides map visualizations in Python. We will also use geopandas and
	34	We only need a couple packages to create a choropleth map. We will use [[https://python-visualization.github.io/folium/][Folium]],
	35	which provides map visualizations in Python. We will also use geopandas and
38	36	pandas to wrangle our data before we put it on a map.
39	37
40	38	#+begin_src python
		@@ -44,14 +42,14 @@ import geopandas as gpd
44	42	import pandas as pd
45	43	#+end_src
46	44
47		To get anything to show up on a map, we need a file that will specify
48		the boundaries of each country. Luckily, GeoJSON files exist (for free!)
49		on the internet. To get the boundaries of every country in the world, we
50		will use the GeoJSON link shown below.
	45	To get anything to show up on a map, we need a file that will specify the
	46	boundaries of each country. Luckily, GeoJSON files exist (for free!) on the
	47	internet. To get the boundaries of every country in the world, we will use the
	48	GeoJSON link shown below.
51	49
52		GeoPandas will take this data and load it into a dataframe so that we
53		can easily match it to the data we're trying to analyze. Let's look at
54		the GeoJSON dataframe:
	50	GeoPandas will take this data and load it into a dataframe so that we can easily
	51	match it to the data we're trying to analyze. Let's look at the GeoJSON
	52	dataframe:
55	53
56	54	#+begin_src python
57	55	# Load the GeoJSON data with geopandas
		@@ -62,9 +60,9 @@ geo_data.head()
62	60	#+caption: GeoJSON Dataframe
63	61	[[https://img.cleberg.net/blog/20200925-world-choropleth-map/geojson_df.png]]
64	62
65		Next, let's load the data from the Kaggle dataset. I've downloaded this
66		file, so update the file path if you have it somewhere else. After
67		loading, let's take a look at this dataframe:
	63	Next, let's load the data from the Kaggle dataset. I've downloaded this file, so
	64	update the file path if you have it somewhere else. After loading, let's take a
	65	look at this dataframe:
68	66
69	67	#+begin_src python
70	68	# Load the world happiness data with pandas
		@@ -76,12 +74,11 @@ happy_data.head()
76	74	[[https://img.cleberg.net/blog/20200925-world-choropleth-map/happiness_df.png]]
77	75
78	76	* Clean the Data
79		Some countries need to be renamed, or they will be lost when you merge
80		the happiness and GeoJSON dataframes. This is something I discovered
81		when the map below showed empty countries. I searched both data frames
82		for the missing countries to see the naming differences. Any countries
83		that do not have records in the =happy_data= df will not show up on the
84		map.
	77	Some countries need to be renamed, or they will be lost when you merge the
	78	happiness and GeoJSON dataframes. This is something I discovered when the map
	79	below showed empty countries. I searched both data frames for the missing
	80	countries to see the naming differences. Any countries that do not have records
	81	in the =happy_data= df will not show up on the map.
85	82
86	83	#+begin_src python
87	84	# Rename some countries to match our GeoJSON data
		@@ -105,11 +102,11 @@ happy_data.at[democratic_congo_index, 'Country or region'] = 'Democratic Republi
105	102
106	103	* Merge the Data
107	104	Now that we have clean data, we need to merge the GeoJSON data with the
108		happiness data. Since we've stored them both in dataframes, we just need
109		to call the =.merge()= function.
	105	happiness data. Since we've stored them both in dataframes, we just need to call
	106	the =.merge()= function.
110	107
111		We will also rename a couple columns, just so that they're a little
112		easier to use when we create the map.
	108	We will also rename a couple columns, just so that they're a little easier to
	109	use when we create the map.
113	110
114	111	#+begin_src python
115	112	# Merge the two previous dataframes into a single geopandas dataframe
		@@ -125,10 +122,9 @@ merged_df = merged_df.rename(columns = {'Country or region':'Country'})
125	122
126	123	* Create the Map
127	124	The data is finally ready to be added to a map. The code below shows the
128		simplest way to find the center of the map and create a Folium map
129		object. The important part is to remember to reference the merged
130		dataframe for our GeoJSON data and value data. The columns specify which
131		geo data and value data to use.
	125	simplest way to find the center of the map and create a Folium map object. The
	126	important part is to remember to reference the merged dataframe for our GeoJSON
	127	data and value data. The columns specify which geo data and value data to use.
132	128
133	129	#+begin_src python
134	130	# Assign centroids to map
		@@ -162,10 +158,9 @@ Let's look at the resulting map.
162	158	[[https://img.cleberg.net/blog/20200925-world-choropleth-map/map.png]]
163	159
164	160	* Create a Tooltip on Hover
165		Now that we have a map set up, we could stop. However, I want to add a
166		tooltip so that I can see more information about each country. The
167		=tooltip_data= code below will show a popup on hover with all the data
168		fields shown.
	161	Now that we have a map set up, we could stop. However, I want to add a tooltip
	162	so that I can see more information about each country. The =tooltip_data= code
	163	below will show a popup on hover with all the data fields shown.
169	164
170	165	#+begin_src python
171	166	# Adding labels to map
		@@ -210,8 +205,8 @@ folium.LayerControl().add_to(world_map)
210	205	world_map
211	206	#+end_src
212	207
213		The final image below will show you what the tooltip looks like whenever
214		you hover over a country.
	208	The final image below will show you what the tooltip looks like whenever you
	209	hover over a country.
215	210
216	211	#+caption: Choropleth Map Tooltip
217	212	[[https://img.cleberg.net/blog/20200925-world-choropleth-map/tooltip_map.png]]

content/blog/2020-12-28-neon-drive.org +38 −48

		@@ -4,51 +4,44 @@
4	4	#+filetags: :gaming:
5	5
6	6	* Game Description
7		[[https://store.steampowered.com/app/433910/Neon_Drive/][Neon Drive]]
8		presents itself as a simple arcade-style game inspired by the arcade
9		race games of the 1980s, yet it has managed to take up hours of my life
10		without much effort. The game description, directly from the Steam page,
11		is intriguing enough to entice anyone who's been looking for a good
12		arcade racing game:
	7	[[https://store.steampowered.com/app/433910/Neon_Drive/][Neon Drive]] presents itself as a simple arcade-style game inspired by the arcade
	8	race games of the 1980s, yet it has managed to take up hours of my life without
	9	much effort. The game description, directly from the Steam page, is intriguing
	10	enough to entice anyone who's been looking for a good arcade racing game:
13	11
14	12	#+begin_quote
15		Neon Drive is a slick retro-futuristic arcade game that will make your
16		brain melt. You've been warned. From beautiful cityscapes and ocean
17		roads to exploding enemy spaceships, Neon Drive has it all.
18
	13	Neon Drive is a slick retro-futuristic arcade game that will make your brain
	14	melt. You've been warned. From beautiful cityscapes and ocean roads to exploding
	15	enemy spaceships, Neon Drive has it all.
19	16	#+end_quote
20	17
21	18	* Gameplay
22		The game holds true to the
23		[[https://en.wikipedia.org/wiki/Retrofuturism][retro-futurism]] style,
24		including chrome female robots, pixelated arcade machines, and
25		[[https://teddit.net/r/outrun/][outrun]] aesthetics.
26
27		Each level of the game is shown as a separate arcade machine. Each
28		arcade machine lets you play on Normal, Hard, Insane, Practice, and Free
29		Run. To beat each arcade, you must reach the end of the level without
30		crashing your car into the various obstacles on the course. Basic levels
31		let you move left or right to avoid blocks in the road. Later levels put
32		you through other tests, such as dodging traffic or blasting asteroids.
33
34		The game uses synthwave music to keep you on track to make the correct
35		moves by timing the beats of the songs to the correct moves on the
36		screen. It reminds me of the early Guitar Hero games, as well as mobile
37		apps like VOEZ - repetition and staying on-beat is the only way to win.
	19	The game holds true to the [[https://en.wikipedia.org/wiki/Retrofuturism][retro-futurism]] style, including chrome female robots,
	20	pixelated arcade machines, and [[https://teddit.net/r/outrun/][outrun]] aesthetics.
	21
	22	Each level of the game is shown as a separate arcade machine. Each arcade
	23	machine lets you play on Normal, Hard, Insane, Practice, and Free Run. To beat
	24	each arcade, you must reach the end of the level without crashing your car into
	25	the various obstacles on the course. Basic levels let you move left or right to
	26	avoid blocks in the road. Later levels put you through other tests, such as
	27	dodging traffic or blasting asteroids.
	28
	29	The game uses synthwave music to keep you on track to make the correct moves by
	30	timing the beats of the songs to the correct moves on the screen. It reminds me
	31	of the early Guitar Hero games, as well as mobile apps like VOEZ - repetition
	32	and staying on-beat is the only way to win.
38	33
39	34	* In-Game Screenshots
40		Taking a look at the main menu, you can see that Neon Drive plays into
41		every stereotype you can think of around retro-futuristic, synthwave
42		arcades (in a good way).
	35	Taking a look at the main menu, you can see that Neon Drive plays into every
	36	stereotype you can think of around retro-futuristic, synthwave arcades (in a
	37	good way).
43	38
44	39	#+caption: Neon Drive Menu
45	40	[[https://img.cleberg.net/blog/20201228-neon-drive/neon_drive_menu.png]]
46	41
47		Once you get into the first level, we see that the choice of car fits
48		right in with the stereotypical cars of the 80s, like the
49		[[https://en.wikipedia.org/wiki/DMC_DeLorean][DeLorean]] or the
50		[[https://en.wikipedia.org/wiki/Ferrari_F40][Ferrari F40]]. Each new
51		level comes with new color schemes and cars, so you should never get
	42	Once you get into the first level, we see that the choice of car fits right in
	43	with the stereotypical cars of the 80s, like the [[https://en.wikipedia.org/wiki/DMC_DeLorean][DeLorean]] or the [[https://en.wikipedia.org/wiki/Ferrari_F40][Ferrari F40]].
	44	Each new level comes with new color schemes and cars, so you should never get
52	45	tired of the aesthetic.
53	46
54	47	#+caption: Neon Drive Race
		@@ -59,25 +52,24 @@ Personally, I love the orange and blue colors used in level 2:
59	52	#+caption: Level 2
60	53	[[https://img.cleberg.net/blog/20201228-neon-drive/neon_drive_level_2.png]]
61	54
62		If you're the competitive type and getting 100% on all arcade machines
63		isn't enough, there are leaderboards for the regular part of the game,
64		and the endurance game mode.
	55	If you're the competitive type and getting 100% on all arcade machines isn't
	56	enough, there are leaderboards for the regular part of the game, and the
	57	endurance game mode.
65	58
66	59	#+caption: Leaderboard
67	60	[[https://img.cleberg.net/blog/20201228-neon-drive/neon_drive_leaderboard.png]]
68	61
69	62	* Other Suggestions
70		Neon Drive sits nicely within the well-founded cult genre of Outrun.
71		Other games that I've enjoyed in this same spectrum are:
	63	Neon Drive sits nicely within the well-founded cult genre of Outrun. Other games
	64	that I've enjoyed in this same spectrum are:
72	65
73	66	- [[https://store.steampowered.com/app/233270/Far_Cry_3__Blood_Dragon/][Far
74	67	Cry 3: Blood Dragon]]
75	68	- [[https://store.steampowered.com/app/1239690/Retrowave/][Retrowave]]
76	69	- [[https://store.steampowered.com/app/732810/Slipstream/][Slipstream]]
77	70
78		Although these games aren't necessarily in the same genre, they do have
79		aspects that place them close enough to interest gamers that enjoyed
80		Neon Drive:
	71	Although these games aren't necessarily in the same genre, they do have aspects
	72	that place them close enough to interest gamers that enjoyed Neon Drive:
81	73
82	74	- [[https://store.steampowered.com/app/311800/Black_Ice/][Black Ice]]
83	75	- [[https://store.steampowered.com/app/746850/Cloudpunk/][Cloudpunk]]
		@@ -85,9 +77,7 @@ Neon Drive:
85	77	for Speed: Heat]]
86	78	- [[https://store.steampowered.com/app/1019310/VirtuaVerse/][VirtuaVerse]]
87	79
88		Of course, if all you really care about is the arcade aspect of these
89		games, you can check out the
90		[[https://store.steampowered.com/app/400020/Atari_Vault/][Atari Vault]]
91		or any of the other classic games sold on Steam by companies like Namco,
92		Atari. For something like Nintendo, you'd have to settle for buying used
93		classic consoles or delve into the world of emulation.
	80	Of course, if all you really care about is the arcade aspect of these games, you
	81	can check out the [[https://store.steampowered.com/app/400020/Atari_Vault/][Atari Vault]] or any of the other classic games sold on Steam by
	82	companies like Namco, Atari. For something like Nintendo, you'd have to settle
	83	for buying used classic consoles or delve into the world of emulation.

content/blog/2020-12-29-zork.org +43 −56

		@@ -4,33 +4,28 @@
4	4	#+filetags: :gaming:
5	5
6	6	* Download (Free)
7		Before we get into the game itself, you should know that you can
8		download Zork for free from Infocom's
9		[[http://infocom-if.org/downloads/downloads.html][download page]]. So
10		feel free to boot it up and take a ride back to the 1980s with this
11		masterpiece.
	7	Before we get into the game itself, you should know that you can download Zork
	8	for free from Infocom's [[http://infocom-if.org/downloads/downloads.html][download page]]. So feel free to boot it up and take a
	9	ride back to the 1980s with this masterpiece.
12	10
13	11	* Game Description
14		Zork is an interactive, text-based computer game originally released
15		in 1980. This series, split into three separate games, introduced a
16		robust and sophisticated text parser to gamers. People were largely used
17		to the simple commands used in the popular game
18		[[https://en.wikipedia.org/wiki/Colossal_Cave_Adventure][Colossal Cave
19		Adventure]], but Zork allowed users to send more complex commands that
20		included prepositions and conjunctions.
	12	Zork is an interactive, text-based computer game originally released in 1980.
	13	This series, split into three separate games, introduced a robust and
	14	sophisticated text parser to gamers. People were largely used to the simple
	15	commands used in the popular game [[https://en.wikipedia.org/wiki/Colossal_Cave_Adventure][Colossal Cave Adventure]], but Zork allowed
	16	users to send more complex commands that included prepositions and conjunctions.
21	17
22		Zork tracks your score as you explore the map, find tools, and collect
23		trophy items (e.g., a jewel-encrusted egg). When you place your trophy
24		items in the trophy case found in the Living Room area, you gain score
25		points. Collecting the Twenty Treasures of Zork and placing them within
26		the trophy case wins the game. However, you must explore the map, solve
27		puzzles, and avoid being eaten by a grue to collect these treasures.
	18	Zork tracks your score as you explore the map, find tools, and collect trophy
	19	items (e.g., a jewel-encrusted egg). When you place your trophy items in the
	20	trophy case found in the Living Room area, you gain score points. Collecting the
	21	Twenty Treasures of Zork and placing them within the trophy case wins the game.
	22	However, you must explore the map, solve puzzles, and avoid being eaten by a
	23	grue to collect these treasures.
28	24
29	25	* The Map
30		Since Zork is a vast and complex game, it helps to have a map as you
31		explore and collect your trophies. However, if you want to play the game
32		as it was truly intended, you should try to play it without using the
33		map.
	26	Since Zork is a vast and complex game, it helps to have a map as you explore and
	27	collect your trophies. However, if you want to play the game as it was truly
	28	intended, you should try to play it without using the map.
34	29
35	30	#+caption: Zork Map
36	31	[[https://img.cleberg.net/blog/20201229-zork/zork_map.png]]
		@@ -38,53 +33,45 @@ map.
38	33	/[[https://www.filfre.net/2012/01/exploring-zork-part-1/][Map Source]]/
39	34
40	35	* In-Game Screenshots
41		After playing the game (for the first time ever) for several weeks
42		around 2014, I was finally able to beat the game with some online help
43		to find the last couple items. As I was writing this post, I installed
44		the game again to grab some screenshots to show off the true glory of
45		this game. As noted in
46		[[https://www.filfre.net/2012/01/exploring-zork-part-1/][Jimmy Maher's
47		playthrough]], the original Zork games looked quite a bit different due
48		to the older hardware of computers like the Apple II and multiple bug
49		fixes that Infocom pushed out after the game's initial release. My
50		play-through uses the
51		[[https://store.steampowered.com/app/570580/Zork_Anthology/][Zork
52		Anthology]] version, which utilizes DOSBox on Windows.
	36	After playing the game (for the first time ever) for several weeks around 2014,
	37	I was finally able to beat the game with some online help to find the last
	38	couple items. As I was writing this post, I installed the game again to grab
	39	some screenshots to show off the true glory of this game. As noted in [[https://www.filfre.net/2012/01/exploring-zork-part-1/][Jimmy
	40	Maher's playthrough]], the original Zork games looked quite a bit different due to
	41	the older hardware of computers like the Apple II and multiple bug fixes that
	42	Infocom pushed out after the game's initial release. My play-through uses the
	43	[[https://store.steampowered.com/app/570580/Zork_Anthology/][Zork Anthology]] version, which utilizes DOSBox on Windows.
53	44
54		The first screenshot here shows the introductory information, which
55		doesn't include instructions of any kind for the player. If you haven't
56		played text adventures before, try to use simple commands like "go
57		west," "look around," or "hit troll with elvish sword."
	45	The first screenshot here shows the introductory information, which doesn't
	46	include instructions of any kind for the player. If you haven't played text
	47	adventures before, try to use simple commands like "go west," "look around," or
	48	"hit troll with elvish sword."
58	49
59	50	#+caption: Zork Screen, pt. 1
60	51	[[https://img.cleberg.net/blog/20201229-zork/zork_01.png]]
61	52
62		In this second screenshot, we see the player has entered the house and
63		found the trophy case in the living room. The lantern and sword in this
64		room allow the player to explore dark areas and attack enemies. If you
65		don't use the lantern, you won't be able to see anything in dark areas,
66		and you may be eaten by a grue.
	53	In this second screenshot, we see the player has entered the house and found the
	54	trophy case in the living room. The lantern and sword in this room allow the
	55	player to explore dark areas and attack enemies. If you don't use the lantern,
	56	you won't be able to see anything in dark areas, and you may be eaten by a grue.
67	57
68	58	#+caption: Zork Screen, pt. 2
69	59	[[https://img.cleberg.net/blog/20201229-zork/zork_02.png]]
70	60
71		Finally, we see that the player has found the first treasure: a
72		jewel-encrusted egg. These treasures can be taken back to the house and
73		placed in the trophy case or carried until you feel like you want to put
74		things away.
	61	Finally, we see that the player has found the first treasure: a jewel-encrusted
	62	egg. These treasures can be taken back to the house and placed in the trophy
	63	case or carried until you feel like you want to put things away.
75	64
76	65	#+caption: Zork Screen, pt 3.
77	66	[[https://img.cleberg.net/blog/20201229-zork/zork_03.png]]
78	67
79	68	* Conclusion
80		It's been quite a few years since I first played Zork, but I clearly
81		remember the late nights and bloodshot eyes that helped me find all the
82		treasures. This game is well worth the time and effort, even though the
83		text-based aspect may be off-putting to gamers who didn't have to grow
84		up playing games without graphics. However, I believe that the strategy
85		and skills learned in early video games like Zork can actually help you,
86		even when playing newer games.
	69	It's been quite a few years since I first played Zork, but I clearly remember
	70	the late nights and bloodshot eyes that helped me find all the treasures. This
	71	game is well worth the time and effort, even though the text-based aspect may be
	72	off-putting to gamers who didn't have to grow up playing games without graphics.
	73	However, I believe that the strategy and skills learned in early video games
	74	like Zork can actually help you, even when playing newer games.
87	75
88	76	If you do decide to play Zork, you can download Zork I, II, and III from
89		Infocom's [[http://infocom-if.org/downloads/downloads.html][download
90		page]] for free or search the internet for an online version.
	77	Infocom's [[http://infocom-if.org/downloads/downloads.html][download page]] for free or search the internet for an online version.

Commit eac7b5d084

Commit `eac7b5d084`