text:
---
layout: post
title: yougov
---

Businessmodel of YouGov
------------------------

### Customer Segments

YouGov’s products and services are utilised by a range of institutional, federal and corporate customers. The Company began by pursuing business within the public service sector before diversifying in order to take advantage of more profitable opportunities in the commercial sector.

YouGov has served a range of government agencies and bodies as well as companies across multiple sectors, including high-profile names from the following sectors:

 * consumer goods
* digital, media and technology,
* automotive,
* retail
* cosmetics
* financial services
* politics
* public services and non-profit
 Among the Company’s recent clients are Airbnb, L’Oréal, Nissan Europe, Asda, Barclays, KFC, Bank of America, Google, and Microsoft.

Geographically, the US market is YouGov’s largest revenue generator, accounting for around one-third of
the Company’s revenue, followed by the UK. The Company divides the remainder of its revenue across five regions: Middle East, Germany, Nordic, France and Asia Pacific.

### Value Propositions

YouGov provides value to its customers through its provision of comprehensive research and analytics, its use of innovative technology solution, the efficiency and speed of its services and the ease with which its products acne be utilised.

YouGov implements a range of innovative data collection methods, combined with powerful analytics technology, to deliver accurate data products and expert insights. The Company claims to have effectively automated the process of data collection, analysis and presentation, enabling it to deliver results to its customers faster than competitors.

YouGov also collaborates with a network of partners to help it deliver data from a range of reliable sources, and works continuously with YouGov panelists to ensure it relays up-to-date information at all times.

### Channels

YouGov operates a website at www.yougov.com, through which customers are able to find information on the Company’s products and services. Customers are also able to access their user accounts and some of the Company’s products through the relevant YouGov web pages.

While some subscription products can be accessed via YouGov’s online channel, more specialised and complex projects require a closer relationship between the client and the Company. YouGov operates sales offices across its seven regions of operations, through which clients are able to negotiate budgets and briefs, receiving a bespoke service on a project-by-project basis.

### Customer Relationships

Many of YouGov’s products and services can be accessed on a self-service basis through its website. The Company’s more complex services must be acquired via direct interaction with members of the YouGov sales team, in order for the details of individual client briefs to be adequately met. Content published by YouGov is largely client-led.

YouGov provides a range of resource for its customers on its website, including webinars, white papers, and reports. The Company also hosts a blog to keep its customers updated with company developments and activity within the market research sector.

Customers of YouGov can also interact directly with the Company through its Facebook, Twitter and Google+ accounts.

### Key Activities

YouGov is a UK-based international market research company. It operates across seven regional divisions – UK, Middle East, Germany, Nordic, US, Asia Pacific and France – to provide a range of custom and subscription-based market research services. It principally offers three product lines, comprising Custom Research services, Data Products, and Data Services.

The Company’s products include flagship daily brand perception tracker YouGov BrandIndex, planning and segmentation tool YouGov Profiles, digital behavior tracker YouGov Pulse, national survey service YouGov Omnibus, and market intelligence analysis product YouGov Reports.

The majority of the YouGov’s revenue is generated its Custom Research segment, which refers to YouGov’s provision of complex qualitative and quantitative research projects that commissioned individually by its clients and cover briefs tailored specifically to customer requirements and budgets.

### Key Partners

YouGov cooperates with a range of companies and organisations, both to enhance its own products and services and to collaborate on joint-venture projects. The Company’s partners principally comprise:

 * Media Partners, including online and offline publications, media houses and broadcasters;
* Academic Partners, including university departments and research institutions; and
* Technology Partners, including software developers, analytics providers, and data collection specialists.
 YouGov has recently established partnerships with publications and media houses including Liberation, Huffington Post and i-Télé, and in 2015 launched an academic partnership with Cambridge University’s Department of Politics and International Studies.

YouGov also partners with many of its clients to provide analysis and presentations for public consumption, such as its project with JC Deceaux to create a landmark identification game, and a project with Kickboard to analyse school culture initiatives across more than 2,500 schools.

### Key Resources

YouGov’s key resources are its products, its data collection and analytics technology, its personnel, its network of partners, and its IT infrastructure.

YouGov’s partners in particular are key to its continuing success, extending the Company’s research and data collection reach and enabling it to provide more comprehensive results to its clients.

While YouGov’s technology is also a key factor in its operations, searches of published patent and trademark records in the US and worldwide identified no applications filed in YouGov’s name.

### Cost Structure

YouGov incurs costs in relation to its research and development activities, its research and analysis services, the management of its network of partners, the maintenance of its IT infrastructure, and the retention of its personnel.

During 2015 the Company employed an average 622 members of staff, with average revenue per head in the form of salary and benefits amounting to £122,000. These employee costs represented 46% of the Company’s annual revenue. YouGov also operates a network of offices across is seven operating regions, accruing costs in the form of rent and utilities.

### Revenue Streams

YouGov generates revenue through the provision of various market research and polling services. Its revenue is divided between its two principal operating segments – Products and Services and Custom Research – which consist of three revenue streams:

 * the sale of subscription data products such as YouGov BrandIndex, YouGov Reports and YouGov Profiles;
* the sale of data services, principally comprising the Company’s YouGov Omnibus service; and
* the sale of custom research services, comprising a range of specialist quantitative and qualitative research projects.
 YouGov also generates a small amount of revenue from media buying activities, where the Company acts as an agent.

In 2015 YouGov generated an annual revenue of £76.1 million, up 13% on the previous year. The majority of this revenue is generated by the Company’s Custom Research business, which accounted for £49.9 million of the YouGov’s total revenue for the year. The remainder was made up by the Data Products and Services segment, with data products generating £11.9 million and data services generating £14.3 million.


text:
# ServiceDiscovery.Data

## Properties
|===
|Name | Type | Description | Notes

|**planConditions** | **String** | Plan conditions of the service | [optional]
|**swagger** | link:SwaggerDocument.html[**SwaggerDocument**] | Swagger file information | [optional]
|**properties** | link:Properties.html[**[Properties]**] | Properties service information | [optional]
|**contact** | link:Contact.html[**[Contact]**] | Contact service information | [optional]
|**maintainers** | link:Maintainers.html[**[Maintainers]**] | Maintainers service informatoin | [optional]
|**tags** | **[String]** | Tags service information | [optional]
|**integrationMode** | **String** | Information related to how the service is integrated | [optional]
|**levelOfService** | **[String]** | Level of service provided | [optional]
|**name** | **String** | Name of the service | [optional]
|**description** | **String** | Description of the service | [optional]
|**image** | **String** | Image related of the service | [optional]
|**baseURL** | **String** | Base URL of the service | [optional]
|**humanURL** | **String** | URL of the human readable documentation | [optional]
|**appName** | **String** | App name of the service if the integration mode is \"app\". E.g.: \"Travel Concierge\" | [optional]
|**packageName** | **String** | Package name of the service if the integration mode is \"app\". E.g.: \"com.serviceprovider.travelconcierge\" | [optional]
|**deeplinkURL** | **String** | Base deeplink URL of the service to integrate directly with application. (This attribute will appear only if integration mode is \"app\".) | [optional]
|**planConditionsUrl** | **String** | Plan conditions URL with human readable information | [optional]
|**updatedAt** | **String** | Timestamp of when service was updated | [optional]
|**signatureKey** | **String** | Service Descriptor Signature Key | [optional]
|**authoritative** | **String** | If the root domain of the service described by the entry is on the same DNS domain or on a DNS subdomain thereof. | [optional]
|**id** | **String** | Service descriptor identifier | [optional]
|===

## Enum: PlanConditionsEnum

* `free` (value: `"free"`)

* `paid` (value: `"paid"`)

## Enum: [LevelOfServiceEnum]

* `VIP` (value: `"VIP"`)

* `Economy` (value: `"Economy"`)

* `Regular` (value: `"Regular"`)

* `Luxury` (value: `"Luxury"`)

* `Executive` (value: `"Executive"`)

* `Exclusive` (value: `"Exclusive"`)

* `Deluxe` (value: `"Deluxe"`)

license: MIT

repository: MASAICommunity/ServiceDiscovery

branch_name: refs/heads/master

extension: md

license_type: permissive

repo_name: MASAICommunity/ServiceDiscovery


text:
# Browser Observer

Browser Observer is a configurable extension that enables easy viewing, editing of cookies, session data and more

## Usage
*Since the extension is a personal development tool that isn't uploaded to browser webstores, it is unfortunately not possible to use the packaged extension as browsers will block it. Instead, you must set your browser to development mode in order to load the extension. Once loaded, the extension should remain in the browser.*

### Chrome
- Go to [chrome://extensions/](chrome://extensions/)
- Enable `Developer mode` from the top right corner
- Click `Load unpacked` button on the top left corner
- Navigate to and select the `<Path to this directory>/release` directory

### Firefox
- Go to [about:debugging#/runtime/this-firefox](about:debugging#/runtime/this-firefox)
- Click `Load Temporary Add-on`
- Navigate to and select any file in the `<Path to this directory>/release` directory

### Edge
- Go to [edge://extensions/](edge://extensions/)
- Enable `Developer mode` from the bottom left corner
- Click `Load Unpacked` button
- Navigate to and select the `<Path to this directory>/release` directory

### Settings
``` ts
interface setting {
    cookieSetting: {
        name: string; // The name of the cookie to query
        appId: string; // An internal identifier of the cookie, it can be ANY value as long as it is UNIQUE. Ideally it should not be shown in this cookie
        url: string; // The URL for which the cookie is for. If it is an empty string, the cookie with the name will be retrieved for the current page
        options?: {
            editable?: boolean; // Specifies if the cookie is editable
            specialInstruction?: 'JWT'; // Allows ability to provide custom handling of the cookie. 'JWT' is the only supported value right now
            children?: {
                path: string[], // the path to the child
                name: string, // the display name of the child
            }[], // If the cookie can be parsed into an object, this specifies the details for the children of the cookie object. The children specified here will be shown on the CookieWidget
        },
    }[]
}
```

## Development

### Prerequisites

-   [node.js](https://nodejs.org/) (*v12+*)
-   [yarn](https://yarnpkg.com/getting-started/install) (*v1.22.0+*)

### Optional

-   [Visual Studio Code](https://code.visualstudio.com/)

### Project Structure

-   `dist`: Webpack emitted files **Use this directory for development!**
-   `release`: Production mode Webpack emitted files **Intended for general usage**
-   `public`: Source files that are not processed by Webpack.
    -   `public/manifest.json`: The config file that browsers use to recognize extensions
-   `src`: TypeScript source files
    -   `src/popup`: TypeScript source files for the popup
        -   `src/popup/components`: React components for popup
        -   `src/popup/helpers`: Helper functions
        -   `src/popup/redux`: Redux related files following the Duck structure (https://github.com/erikras/ducks-modular-redux)
        -   `src/popup/states`: Default states and some types
        -   `src/popup/styles`: Styles for React components written in Less
    -   `src/background`: A background script, (currently only used for debugging)
-   `webpack`: Webpack configurations

#### Setup: `yarn`

#### Build: `yarn build`

#### Build in watch mode: `yarn watch`
**You need to manually update by clicking the `Update` (Chrome) or `Reload` (Firefox, Edge) button for the changes to take place!**

#### Load `./dist` directory to browser

#### Build in `./release` directory: `yarn build:release`

#### Visual Studio Code
Type `Ctrl + Shift + B` to conveninetly find available commands

repository: eqfy/browser-observer

repo_name: eqfy/browser-observer


text:
# US House Committee to Hold First Open Hearings in Impeachment Inquiry Next Week - Schiff

Published at: **2019-11-06T20:59:56+00:00**

Author: ****

Original: [Sputniknews](https://sputniknews.com/us/201911061077239256-us-house-committee-to-hold-first-open-hearings-in-impeachment-inquiry-next-week-schiff/)

Schiff said more public hearings in the impeachment inquiry will be announced soon.

license: Unlicense

repository: dsadlollioygjmzvcxv/tdc-exported

repo_name: dsadlollioygjmzvcxv/tdc-exported


text:
---
layout: default
---

# 1993-04-16 - White House Encryption idea

## Header Data

From<EMAIL_ADDRESS>To<EMAIL_ADDRESS>Message Hash: 6b62e60f50596774866184c9f64ade5f8695ae08d1e523f5dd57253014d4962e

Message ID<EMAIL_ADDRESS>Reply To: _N/A_

UTC Datetime: 1993-04-16 20:14:50 UTC

Raw Date: Fri, 16 Apr 93 13:14:50 PDT

## Raw message

```
{% raw  %}From<EMAIL_ADDRESS>Date: Fri, 16 Apr 93 13:14:50 PDT
To<EMAIL_ADDRESS>Subject: White House Encryption idea
Message-ID<EMAIL_ADDRESS>MIME-Version: 1.0
Content-Type: text/plain

Well, this all sounds fine and dandy, but...

1)  They are not passing out the algorithym, and I dont trust ANYONE to tell
me its secure.  I am not a cryptographer, so it wouldn't help any if they gave
the code to me, but it just being out there for public perusal helps me to
think it IS secure.  I trust no payola.

2)  It is very possible that the 'criminal' effort may be able to modify
these devices so that there is no possiblility for the agencies to decrypt
their trasmissions (If it IS truly secure with no backdoors or decyphering
possibilities) in which case, it can only harm the law abiding.

3)  It allows the government the ability to determine WHAT encryption
method industry uses, and they should be able to have a choice.  Those who
understand this very misleading comment will understand, those who do not, will
prolly never be able to.

4) No explanation of what the 'key' contents are composed of (numbers, letters,
alphanum, characters, some odd cyphercode???) is even implied.

5)  No explanation of how the key is propegated or if it will even be needed
for the remote site is mentioned.  How are the remote sites going to
decypher your cyphersounds(text)?

There was no mention of further releases in information...is this all we get?

treason@gnu

{% endraw %}
```

## Thread

+ Return to [April 1993](/archive/1993/04)

+ Return to "[Peter Meyer <meyer@mcc.com>](/authors/peter_meyer_meyer_at_mcc_com_)"
+ Return to "[treason@gnu.ai.mit.edu](/authors/treason_at_gnu_ai_mit_edu)"

+ 1993-04-16 (Fri, 16 Apr 93 13:14:50 PDT) - White House Encryption idea -<EMAIL_ADDRESS>  + 1993-04-17 (Fri, 16 Apr 93 19:42:56 PDT) - [White House Encryption idea](/archive/1993/04/2f2a7e0b5c6e8ae6b97fdb9aa0555eb7e3f6ab22567362f2e254eab736e20559) - _Peter Meyer<EMAIL_ADDRESS>

gha_license_id: MIT


text:
---
draft: true
author:
  description: Researches geodesy at the University of Bonn
  email<EMAIL_ADDRESS>  github: https://github.com/strawpants
  image: /images/WBlogo_64x64.png
  name: Roelof Rietbroek
  twitter: https://twitter.com/
  website: http://wobbly.earth/about
cardheaderimage: /images/sun-pudding.jpg
cardthumbimage: /images/sun-pudding.jpg
images:
    - :/images/sun-pudding_og.jpg"
cardtitlecolor: white
date: 2016-10-07
description: A Wobbly Earth
categories:
    - "post"
tags:
    - "Wobbly Earth"
    - "Earth rotation"
    - "geocenter"
    - "surface loading"
    - "jelly"
levels:
    - "somewhat technical"
title: "A Wobbly Earth"
tweetshare:  "A wobbly Earth"
sitemap:
    changefreq: "monthly"
    priority: 0.6
---

#### The Jellypudding Analogy

Most people think the Earth is a sphere, while geodesists joke that [the Earth's is a potato](http://www.gfz-potsdam.de/en/media-communication/mediathek/image-galleries/geoid-the-potsdam-gravity-potato/). And you can even find some funny folks who believe the Earth is flat and only 6000 years old. If it was up to me, I would happily claim that the Earthe is a giant jellypudding. <!--more-->

The jellypudding analogy helps in explaining some important concepts I use regularly in my research, and it sheds some light on the reason why I chose the domain [wobbly.earth](/).
If you substitute the solid part of the Earth by jelly, it is not hard to understand that, when revolving around the sun, the Earth is going to wobble a fair bit along the way. In reality, these wobbles are much much smaller than when the Earth would be made of jelly, but they are nevertheless detectable by accurate geodetic measurements techniques.

#### The wobbly Earth's rotational axis
One thing that is moving is the orientation of the Earth's rotation axis.

#### mass movement causes the Earth to deform (elastic visco-elastic)

#### The center of mass and center of figure move with respect to each other


text:
# nationstates-grab-banner
Grabs the currently displayed banner from a nation's main page in NationStates (https://nationstates.net)

This script is designed for people who play the online nation simulator game, NationStates, by Max Barry.

Sometimes, you might find a banner you like on a nation's page, and you really want it. This script allows you to grab a new tab with the banner displayed in all its glory.

NOTE: It will ONLY work if the banner is currently displayed. You still gotta be fast enough that it didn't already change.

Instructions:
1) Find a nation's page, e.g.: https://www.nationstates.net/nation=polyspectra (the one I'm currently running at the time of making this script)
2) Does it have a really nice banner showing? Or does a banner pop up there frequently that you know of that you want?
3) Open the console window (F12 > Console tab)
4) Copy the script from the main file and paste it into the console
5) Hit ENTER
6) ???
7) PROFIT!!!

Alternative Instructions (for short one-line version):
1) Same
2) Same
3) Create a new bookmark with the script text after "javascript: "
4) Run the bookmark on that page
5) ???
6) PROFIT!!! This time with EVEN LESS effort!!

repository: gsfordham/nationstates-grab-banner

repo_name: gsfordham/nationstates-grab-banner


text:
# Table of Contents
1. [String](#string)
2. [Buffer](#buffer)
3. [qBuffer](#qbuffer)
4. [List](#list)
5. [Map](#map)
6. [PID](#pid)
7. [Result](#result)
8. [DateTime](#datetime)
9. [StationURL](#stationurl)
10. [Variant](#variant)
11. [Structure](#structure)
12. [Data](#data-structure)
13. [AnyDataHolder](#anydataholder)
14. [RVConnectionData](#rvconnectiondata-structure)
15. [ResultRange](#resultrange-structure)

# String
| Type | Description |
| --- | --- |
| Uint16 | Length (including null terminator) |
| Chars | Null terminated UTF-8 string |

# Buffer
| Type | Description |
| --- | --- |
| Uint32 | Length |
| Bytes | Data |

# qBuffer
| Type | Description |
| --- | --- |
| Uint16 | Length |
| Bytes | Data |

# List
| Type | Description |
| --- | --- |
| Uint32 | Number of entries |
| | Entries |

# Map
A map is a [list](#list) of (key, value) pairs.

# PID
Every user is given a unique id called principal id.

| Platform | Type |
| --- | --- |
| 3DS / Wii U | Uint32 |
| Switch | Uint64 |

# Result
| Type | Description |
| --- | --- |
| Uint32 | Result code |

If the most significant bit is set an error occurred. Otherwise, the result indicates success. A list of error codes can be found in [nintendo/nex/errors.py](https://github.com/Kinnay/NintendoClients/blob/master/nintendo/nex/errors.py).

# DateTime
| Type | Description |
| --- | --- |
| Uint64 | Value |

This is not a normal time stamp. Instead, it consists of a bunch of bit fields:

| Bits | Description |
| --- | --- |
| 63 - 26 | Year |
| 25 - 22 | Month |
| 21 - 17 | Day |
| 16 - 12 | Hour |
| 11 - 6 | Minute |
| 5 - 0 | Second |

# StationURL
| Type | Description |
| --- | --- |
| [String] | Station URL |

A station url contains the address and port of a server or client, along with a few parameters. The order of the fields is arbitrary. Here's an example station url: `prudps:/stream=10;sid=1;CID=1;type=2;address=<IP_ADDRESS>;port=60101;PID=2`

| Field | Description |
| --- | --- |
| <scheme> | udp, prudp or prudps |
| address | Address |
| port | Port |
| stream | Stream type |
| sid | Stream id |
| CID | Connection id |
| PID | Principal id |
| type | Type |
| RVCID | Rendez-vous connection id |
| natm | NAT mapping |
| natf | NAT filtering |
| upnp | UPnP support (0 or 1) |
| pmp | PMP support (0 or 1) |
| probeinit | Probe request initiation |
| PRID | Probe request id |
| fastproberesponse | Fast probe response |
| NodeID | Node id

The following fields were added on Nintendo Switch:

| Field | Description |
| --- | --- |
| Uri | Uri |
| R | Use relay server (0 or 1) |
| Rsa | Relay server address |
| Rsp | Relay server port |
| Ra | Relay address |
| Rp | Relay port |
| Tpt | Transport protocol type |
| Pl | Platform type |
| Ntrpa | NAT traversal requester private address |
| Ntrpp | NAT traversal requester private port |

# Variant
A variant consists of an uint8 indicating the type followed by its value.

| Type id | Type |
| --- | --- |
| 0 | None |
| 1 | Sint64 |
| 2 | Double |
| 3 | Bool |
| 4 | [String] |
| 5 | [DateTime] |
| 6 | Uint64 |

# Structure
NEX v3.5.0 introduced a versioning system to structures. Before v3.5.0 their contents were just normally stored into the stream. However, starting with v3.5.0, structures are stored like this:

| Type | Description |
| --- | --- |
| Uint8 | Version |
| Uint32 | Content length |
| | Content |

Nintendo often seems to be changing a structure without updating its version number though.

A structure may inherit another structure. The child is stored right after the parent, and gets its own version header.

# Data ([Structure])
This struct does not have any fields.

# AnyDataHolder
This class can hold any object derived from a given base class (usually [nn::nex::Data](#data-structure)). Some meta data is sent along with it, so the other side can properly identify and decode the object.

| Type | Description |
| --- | --- |
| [String] | Type name |
| Uint32 | Length of data, including the next length field |
| Uint32 | Length of data |
| | Object data |

# RVConnectionData ([Structure])
Nintendo does not use any special protocols.

| Type | Version | Name | Description |
| --- | --- | --- | --- |
| [StationURL](#station-url) | Any | m_urlRegularProtocols | Server address (regular protocols) |
| [List](#list)<byte> | Any | m_lstSpecialProtocols | Special protocols |
| [StationURL](#station-url) | Any | m_urlSpecialProtocols | Server address (special protocols) |
| [DateTime](#date-time) | V1 | m_currentUTCTime | Time |

Examples:

| Game | Secure server |
| --- | --- |
| Friends | `prudps:/stream=10;type=2;PID=2;port=60091;address=<IP_ADDRESS>;sid=1;CID=1` |
| DKC:TF | `prudps:/port=43221;CID=1;address=<IP_ADDRESS>;PID=2;stream=10;type=2;sid=1` |
| MK8 | `prudps:/sid=1;port=59201;address=<IP_ADDRESS>;PID=2;stream=10;type=2;CID=1` |

# ResultRange ([Structure])
Some methods query a large set of objects. These methods normally take a ResultRange parameter that limits the number of objects that are returned.

| Type | Name | Description |
| --- | --- | --- |
| Uint32 | m_uiOffset | Offset |
| Uint32 | m_uiSize | Length |

[String]: #string
[Structure]: #structure
[DateTime]: #date-time

repository: amicuchu/NintendoClientsWiki

repo_name: amicuchu/NintendoClientsWiki


text:
# big\_g

## Installing the PyPI package

The ``big-g`` package is available on PyPI.

    pip install big-g

Installing via ``pip`` should get most of the Python dependencies you need.
OpenCV installation can sometimes be tricky, so this may need to be installed
manually before big\_g will operate correctly.

## Object Tracking

To run the big\_g program, simply run:

    big-g-tracking

Help can be found by running `big-g-tracking --help`.


text:
---
layout: post
title: "HTML5.tx 2013"
date: 2013-02-03 23:09
comments: true
categories: ["JavaScript","IndexedDB","Web Storage"]
author: Jesse Cravens
---

### Embedded JavaScript, HTML5 and the Internet of Things

I had a great time presenting at HTML5.tx 2013; here is an embed above of the slide deck. I should have the trailr node module in a presentable format soon and I'll tweet its inclusion in NPM. I have a placeholder here: [trailr at npm](https://npmjs.org/package/trailr)

I also pushed out the ver.1 trailr-admin UI here: [trailr-admin.herokuapp.com](http://trailr-admin.herokuapp.com/dashboard)

Most of the demos are included in the nodejshacks-emedded repo here: [https://github.com/nodejshacks](https://github.com/nodejshacks/nodejshacks-embedded)

Very soon, initial documentation will be available at: [trailr.io](http://trailr.io)

Photo credit: Mitch Fincher: [mitchfincher.blogspot.com](http://mitchfincher.blogspot.com/2013/02/pictures-from-html5tx-2013-in-austin-tx.html)

### HTML5 Canvas View

### Node.js trailr module - Web Based Edit (Ace Editor) and WebSocket Deploy to Arduino

Photo credit: Mitch Fincher: [mitchfincher.blogspot.com](http://mitchfincher.blogspot.com/2013/02/pictures-from-html5tx-2013-in-austin-tx.html)

extension: markdown


text:
  whats.the.user.doing •
  detect.location •
  watch.user •
  steal.password

-------

# `steal.password`

[![Twitter: @KrauseFx](https://img.shields.io/badge/contact-@KrauseFx-blue.svg?style=flat)](https://twitter.com/KrauseFx)
[![License](https://img.shields.io/badge/license-MIT-green.svg?style=flat)](https://github.com/KrauseFx/steal.password/blob/master/LICENSE)

Do you want the user's Apple ID password, to get access to their Apple account, or to try the same email/password combination on different web services? Just ask your users politely, they'll probably just hand over their credentials, as they're trained to do so 👌

Official popup | Phishing popup
----|-----
 |

Random system popup | Phishing popup in app/game
----|-----
 |

## Disclaimer

This is just a proof of concept, phishing attacks are illegal! Don't use this in any of your apps. The goal of this blog post is to close the loophole that has been there for many years, and hasn't been addressed yet. For moral reasons, I decided not to include the actual source code of the popup, however it was shockingly easy to replicate the system dialog.

## Why does this work?

iOS asks the user for their iTunes password for many reasons, the most common ones are recently installed iOS operating system updates, or iOS apps that are stuck during installation.

As a result, users are trained to just enter their Apple ID password whenever iOS prompts you to do so. However, those popups are not only shown on the lock screen, and the home screen, but also inside random apps, e.g. when they want to access iCloud, GameCenter or In-App-Purchases.

This could easily be abused by any app, just by showing an `UIAlertController`, that looks exactly like the system dialog.

Even users who know a lot about technology have a hard time detecting that those alerts are phishing attacks.

## How can you protect yourself

- Hit the home button, and see if the app quits:
  - If it closes the app, and with it the dialog, then this was a phishing attack
  - If the dialog and the app are still visible, then it's a system dialog. The reason for that is that the system dialogs run on a different process, and not as part of any iOS app.
- Don't enter your credentials into a popup, instead, dismiss it, and open the Settings app manually. This is the same concept, like you should never click on links on emails, but instead open the website manually
- If you hit the `Cancel` button on a dialog, the app still gets access to the content of the password field, so be careful to clear the text before dismissing a popup.

Initially I thought, faking those alerts requires the app developer to know your email. Turns out, some of those auth popups don't include the email address, making it even easier for phishing apps to ask for the password.

Official popup without email | Phishing popup without email
----|-----
 |

## Proposal

Modern web browsers already do an excellent job protecting users from phishing attacks. Phishing within mobile apps is a rather new concept, and therefore still pretty unexplored.

- When asking for the Apple ID from the user, instead of asking for the password directly, ask them to open the settings app
- Fix the root of the problem, users shouldn't constantly be asked for their credentials. It doesn't affect all users, but I myself had this issue for many months, until it randomly disappeared.
- Dialogs from apps could contain the app icon on the top right of the dialog, to indicate an app is asking you, and not the system. This approach is used by push notifications also, this way, an app can't just send push notifications as the iTunes app.

I've reported this as a radar, which you can dupe: [rdar://34885659](https://openradar.appspot.com/radar?id=4952345645416448) 👍

Sometimes iOS shows the following notification on the lock screen, which opens up the iCloud Settings screen, this is a much better approach than to ask for the password directly:

## Complexity

Showing a dialog that looks just like a system popup is super easy, there is no magic or secret code involved, it's literally the examples provided in the Apple docs, with a custom text.

I decided not to open source the actual popup code, however, note that it's less than 30 lines of code and every iOS engineer will be able to quickly build their own phishing code.

## Q&A

Imagine if everybody read this before posting a comment on HackerNews/Reddit #oneCanDream :)

### But, I have 2-factor enabled, I'm safe, right?

Good for you, everybody should use 2-step verification obviously, however many people don't. At the same time, even if your Apple account is 2FA protected, many users still use the same username/password combination on most web services, meaning if hackers know your Apple ID password, chances are high, they're gonna try the same combination on other common services.

Also, even with 2FA enabled accounts, what if the app asked you for your 2 step code? Most users would gladly request a 2FA-token and ask for it, and directly pipe it over to a remote server.

### Apple would never accept such an app, right?

Apple is doing a great job protecting users from dangerous third party apps, that's why the App Store is built and provided like it is, that's why we code sign our application ([not really, but kind of](https://krausefx.com/blog/the-developer-part-of-ios-code-signing-doesnt-add-any-security-to-anything)).

However, it's rather easy to run certain code only after the app is approved, those are not new ideas, but just to give you some ideas:

- Use remote code (which is not allowed by itself, except for JavaScript), React Native or a custom JS bridge is your friend
- Use the iTunes search API to compare the current version number with the App Store version number ([example request](https://itunes.apple.com/lookup?bundleId=com.Facebook.Facebook)), this way the app can automatically enable malicious code after it got approved.
- Use a remote configuration tool to enable a feature only after an app is approved by Apple
- Use a time-based trigger: just skip running certain code for the first week after submitting the binary, meaning the code will only run once the app is either approved or rejected.
- [Pull an Uber and don't run certain code when the location is near Cupertino](https://www.theverge.com/2017/4/23/15399438/apple-uber-app-store-fingerprint-program-tim-cook-travis-kalanick) (it's probably fixed by Apple by now)

The things above is public knowledge, most iOS developers are aware, and I strongly advise against using any of this, Apple will eventually catch you and block your account.

The point of this list is: While the review process provides a basic safety filter, organisations with bad intent will always find a way to somehow work around the limitations of a platform.

### Phishing on mobile? Is that a thing now?

This area will become more and more relevant, with users being uninformed, and the mobile operating systems not yet clearly separating system UI and app UI. This is kind of related to [detect.location](https://github.com/KrauseFx/detect.location), where apps would write their own, custom image picker to provide a better "experience", but in reality, with that, they also get full access to your image library, and optionally also your camera (related to [watch.user](https://github.com/KrauseFx/watch.user)).

iOS should very clearly distinguish between system UI and app UI elements, so that ideally it's even obvious for the average smartphone user that something seems off. This is a tricky problem to solve, and web browser are still tackling it, you still have websites that make popups look like macOS / iOS popups, so that many users think it's a system message.

### But, but, but, why is the `.` symbol within the `"`, is this all fake?

Nope, actually, that's how the system dialog looks like, the `.` is within the `"` string notation, so I designed the phishing dialog to also include this little, but very important design detail

## License

This project is licensed under the terms of the MIT license. See the [LICENSE](LICENSE) file.

Idea from [@tapbot_paul](https://twitter.com/tapbot_paul) via [this tweet](https://twitter.com/tapbot_paul/status/908067480568045568).

[@tapbot_paul](https://twitter.com/tapbot_paul) and I [tweeted about this issue multiple times](https://twitter.com/KrauseFx/status/908204812122165248) a while ago.


text:
---
layout: post
title: context2vec- Learning Generic Context Embedding with Bidirectional LSTM
subtitle: Title of paper - context2vec- Learning Generic Context Embedding with Bidirectional LSTM
category: NLP papers - Contextual Embedding
tags: [neural network, contextual embedding]
permalink: /2019/11/25/Context2Vec_Learning_Learning_Generic_Context_Embedding_with_Bidirectional_LSTM/
css : /css/ForYouTubeByHyun.css
bigimg:
  - "/img/Image/BigImages/carmel.jpg" : "Carmel-by-the-Sea, CA (2016)"
  - "/img/Image/BigImages/monterey.jpg" : "Monterey, CA (2016)"
  - "/img/Image/BigImages/stanford_dish.jpg" : "Stanford Dish, CA (2016)"
  - "/img/Image/BigImages/marian_beach_in_sanfran.jpg" : "MRINA of San Francisco, CA (2016)"
  - "/img/Image/BigImages/carmel2.jpg" : "Carmel-by-the-Sea, CA (2016)"
  - "/img/Image/BigImages/marina.jpg" : "MRINA of San Francisco, CA (2016)"
  - "/img/Image/BigImages/sanfrancisco.jpg" : "San Francisco, CA (2016)"

---

This is a brief summary of paper for me to study and organize it, [context2vec: Learning Generic Context Embedding with Bidirectional LSTM (Melamud et al., CoNLL 2016)](https://www.aclweb.org/anthology/K16-1006/) I read and studied.
{% include MathJax.html %}

This paper shows how to embed sentential context into a fixed-length vector with Bidirectional LSTM.

As you can see the figure below, They used a Bidirectional LSTM, feeding one LSTM network with the sentence from left to right, and aother from right to left. The parameter of these two networks are completlely separate, including two separate sets fo left-to-right and right-to-left context word embedding.

So as to represent sentential context to a embedding, they concatenate each context vectors from left to right ant from right to left as shown in figure1 b.

Objective function is how likely the target word vector and sentential context vector is to a pair based on the CBOW method. They used negative sampling technique.

In their embedding, they used two special tokens, BOS and EOS signified as the end and beginning of a sentence.

![Melamud et al., CoNLL 2016](/img/Image/NaturalLanguageProcessing/NLPLabs/Paper_Investigation/Contextual_Embedding/2019-11-25-Context2Vec_Learning_Learning_Generic_Context_Embedding_with_Bidirectional_LSTM/context2_vec.PNG)

 Note(Abstract):
Context representations are central to various NLP tasks, such as word sense disambiguation, named entity recognition, coreference resolution, and many more. In this work they present a neural model for efficiently learning a generic context embedding function from large corpora, using bidirectional LSTM. With a very simple application of their context representations, they manage to surpass or nearly reach state-of-the-art results on sentence completion, lexical substitution and word
sense disambiguation tasks. They release their [code and pretrained models](http://u.cs.biu.ac.il/~nlp/resources/downloads/context2vec/), suggesting their method could be useful in a wide variety of NLP tasks.

 Download URL:

  The paper: context2vec- Learning Generic Context Embedding with Bidirectional LSTM (Melamud et al., CoNLL 2016)

# Reference

- Paper
  - [ACL Version: context2vec- Learning Generic Context Embedding with Bidirectional LSTM (Melamud et al., CoNLL 2016)](https://www.aclweb.org/anthology/K16-1006/)

- How to use html for alert
  - [how to use icon](http://idratherbewriting.com/documentation-theme-jekyll/mydoc_icons.html)

gha_language: Jupyter Notebook