text:
---

title : Threat Analysis & Coverage
date  : 2017-07-07
categories: architecture, automotive
tags: architecture, automotive, linux
layout: techdoc

---

**Table of Content**

1. TOC
{:toc}

# Introduction

The Automotive Grade Linux (AGL) platform has set out to be an open source solution for automotive applications. With an open system come many avenues of attack by the spectrum of attackers, from hobbyists to university students to well-funded hacking organizations. AGL introduces an application framework and has adopted the Cynara system from Tizen, which uses SMACK as its kernel-level underpinnings.

This document first looks at attack goals and how the intruder may get to these goals. Then attacks on specific assets of the system are considered. Further, the analysis looks at the attack surface and possible branches into these assets. As these avenues are analyzed, we discuss mitigations individually and broader approaches, such as defense-in-depth which resists an attacker's ability to attain their goals by deploying *overlapping* defenses.

This threat analysis was written from an investigation of the following sources of information:

* AGL on-line documentation.
* The AGL source code-base, Charming Chinook Release, made available on Jan 6, 2017.
* Tizen documentation, on-which the security features of AGL have been based.

## Attack Goals

In today's connected vehicle, more and more functionality is moving to software control, meaning that the threat of attack becomes greater and greater. We see car features like navigation and summoning, car access/engine start, and motor/ECU upgrades all controlled through software and connections to the cloud. The risk of attack is high because there are high value targets in play.

Here, we outline some of the major threats categories along with some sample attackers, example attacks, and a relative importance. These threat categories are intended to be general examples. There can be many nuances to threat types. Additionally, there can be many *sub*-attacks that eventually lead to these higher level attack goals.

| Threat Category | Sample Attacker | Example Attacks | Relative Importance |
| --------------- | --------------- | -------- | ---------- |
| Vehicle theft | Individual, organized criminals | Send the car to an unplanned destination, get a key for the car, gain control of the unlock mechanism | Reduced likelihood of future vehicle purchases (Profit Later), bad press (Brand Integrity) |
| Reduced vehicle functionality | Terrorist groups, disgruntled employees | Lock the driver out of the car, cause the car to crash, block access to infotainment system | Inability sell paid-for apps and content (Profit Now), bad press (Brand Integrity), possible loss of life (Physical Injury) |
| Vehicle hacking | Vehicle owner, competitor | Get content without paying, modify DRM licenses, unlock of after-market features, theft of IP | Loss of sales for content and features (Profit Now), lawsuits from content owners (Profit Later), loss of competitive advantage (Profit Later) |
| Sensitive asset theft | Organized criminals, blackmailers | Steal credit card numbers, health information, camera data, steal bandwidth | Bad press (Brand Integrity), lawsuits from vehicle owners (Profit Later) |

## Assets and Security Categorization

This section outlines some of the assets that are likely to be found in the vehicle and their relative sensitivity from an attack point of view. Additionally, the final column on the right lists some of the recommended protection types that can be applied to these types of assets (Note that the empty cells refer to the cells above them). A good protection approach will give priority to the most sensitive assets, using a defense-in-depth approach to cover these assets. Less sensitive assets are treated at a lower priority, typically protected with fewer protection techniques. A more fine-grained prioritziation of the the assets in a concrete vehicle network can be achived with detailed threat analysis which considers the topology of the vehicle network and access-controls that are in-place. e.g. the EVITA framework for attack trees.

| Asset Category | Examples | Sensitivity | Recommended Protection Types |
| -------------- | -------- | ----------- | ---------------------------- |
| Software | ECU software, infotainment software, OS images | Critical | Key Management, Mutual Asymmetric Authentication, HSM and WhiteBox Encryption, Message Integrity Checks, Hardening/SW Protection, Program Transforms/ Obfuscation, Integrity Verification, Secure OS |
| Car Access | Biometric data, car keys | | |
| Payment Data | Credit cards, User profile critical data | | |
| Recordings | Internal camera recording, internal audio recording, external camera recording | High | Encryption, Message Integrity Checks, Hardening/SW Protection, Program Transforms / Obfuscation |
| User Profile | Usernames and passwords, customization, calendar, contacts | | |
| Location | GPS coordinates, vehicle usage data | | |
| Purchased Content | Video, audio, licenses | | |
| Teleconference | Chat, audio, video | Medium | SW Protection, Program Transforms / Obfuscation, Authenticated encryption for transmission
| Vehicle data | Vehicle info, sensor data | | |
| Navigation data | Static and dynamic maps | | |
| 3rd party data | Home automation commands, cloud game data | | |

# Execution Environment

The execution environment used for AGL leverages a Linux kernel combined with an application framework. The foundation of the environment is a pre-configured Linux kernel which will inherit any existing vulnerabilities associated with the kernel. The following are, therefore, important to the system:

## Kernel Version

The choice of kernel version for the AGL system is essential to its security. Depending on the type of board and eventual production system, different kernel versions are used. For example, one of the systems under study uses the Linux kernel version 3.10, while another uses the Linux kernel version 4.4. For the Linux kernel version 3.10.31, there are [25 known vulnerabilities](https://www.cvedetails.com/version/194332/Linux-Linux-Kernel-3.10.31.html). These vulnerabilities would allow an attacker to gain privileges, bypass access restrictions, allow memory to be corrupted, or cause denial of service. In contrast, the Linux kernel version of 4.4 has [many fewer known vulnerabilities](https://www.cvedetails.com/version/190796/Linux-Linux-Kernel-4.4.html). For this reason, we would in general recommend the later kernel version as a basis for the platform.

Note that, although there are fewer *known* vulnerabilities in the most recent kernel versions there may be many unknown vulnerabilities underlying. A rule of thumb is to update the kernel as much as possible to avoid the problems you do know, but you should not be complacent in the trust that you place in it. A defense-in-depth approach would then apply.

If there are constraints and dependencies in upgrading to a newer kernel version (e.g. device drivers, board support providers) and you are forced to an older Linux kernel version, there need to be additional provisions made to reduce the risk of kernel exploits, which can include memory monitoring, watch-dog services, and system call hooking. In this case, further defense-in-depth techniques may be required to mitigate the risk of attacks to known vulnerabilities, which can also include runtime integrity verfication of components that are vulnerable to tampering.

## Kernel Build Configuration

The kernel build configuration is extremely important for determining the level of access to services and to reduce the breadth of the attack surface. Linux contains a great and flexible number of capabilities and this is only controlled through the build configuration. For example, the *CONFIG_MODULES* parameter allows kernel modules to be loaded at runtime extending the capabilities of the kernel. This capability needs to be either inhibited or controlled at runtime through other configuration parameters. For example, *CONFIG_MODULE_SIG_FORCE=y* ensures that only signed modules are loaded. There is a very large number of kernel configuration parameters, and these are discussed in detail in [the hardening guide of the AGL security blueprint](http://docs.automotivelinux.org/docs/architecture/en/dev/reference/security/08-Hardening.html)

## Discretionary Access Control

Discretionary Access Control (DAC) is the traditional Linux method of separating users and groups from one another. In a shared environment where multiple users have access to a computer or network, Unix IDs have offered a way to contain access within privilege areas for individuals, or shared among the group or system. The Android system took this one step further, assigning new user IDs for each App. This was never the original intention of Linux UIDs, but was able to provide Android's initial security element - the ability to *sandbox* applications.

Although AGL mentions use of DAC for security isolation, the weight of the security responsibility lies in the Mandatory Access Control (MAC) and Cynara. Furthermore, there are system services with unique UIDs; however, the system does not go to the extreme of Android, where every application has its own UID. All sandboxing (app isolation) in AGL is handled in the MAC contexts.

## Mandatory Access Control

Mandatory Access Control (MAC) is an extension to DAC, whereby extended attributes (xattr) are associated with the filesystem. In the case of AGL, the `smackfs` filesystem allows files and directories to be associated with a SMACK label, providing the ability of further discrimination on access control. A SMACK label is a simple null terminated character string with a maximum of 255 bytes. While it doesn't offer the richness of an SELinux label, which provides a user, role, type, and level, the simplicity of a single value makes the overall design far less complex. There is arguably less chance of the security author making mistakes in the policies set forth.

## Application Types

AGL provides a framework for applications to be written in different forms:

* Web application: HTML5 + JavaScript
* Qt application: in a QML file
* Native application: in C

While there is no harm in providing multiple types of applications, from a security perspective this does increase the attack surface for an intruder. The application framework consists of a number of utilities and daemons which provide context for the applications. Isolation is provided through SMACK labels.

# Application Security Model

The AGL application framework consists of several interworking parts:

* SMACK - Simplified Mandatory Access Control Kernel, the kernel level LSM (Linux Security Module) that performs extended access control of the system
* Cynara - the native gatekeeper daemon used for policy handling, updating to the database and policy checking.
* Security Manager - a master service, through which all security events are intended to take place.
* Several native application framework utilities: afm-main-binding, afm-user-daemon, afm-system-daemon

## Application Framework

The [AGL app framework](http://iot.bzh/download/public/2016/appfw/02_Documentation-AppFW-Core-2.0.pdf), provides the management around installation, starting/stopping, bindings to D-Bus, and communications to Cynara and the Security Manager. Installation of applications flows through the `afm_system_daemon` and the `security_manager`. The Security Manager retains information in an SQLite database and also sets SMACK policies. The Security Manager also has the definition of an API for external entities.

The Security Manager communicates policy information to cynara, which retains information in its own database in the format of a text file with comma-separated values (CSV). There are provisions to retain a copy of the CSV text file when the file is being updated.

Runtime checking occurs through Cynara. Each application that is added to the framework has its own instantiation of a SMACK context and D-bus bindings. The `afb_daemon` and Binder form a web-service that is communicated to through http or a websocket from the application-proper. This http or websocket interface uses a standard unique web token for API communication.

![App Framework Flow](App-flow.png)

### Attack Vectors

The following attack vectors are not completely independent. While attackers may have varying levels of access to an AGL system, experience has shown that a typical attack can start with direct access to a system, find the vulnerabilities, then proceed to automate the attack such that it can be invoked from less accessible standpoint (e.g. remotely). Therefore, it is important to assess all threat levels, and protect the system appropriately understanding that direct access attacks are the door-way into remote attacks.

#### Remote Attacks

The local web server interface used for applications is the first point of attack, as web service APIs are well understood and easily intercepted. The local web server could potentially be exploited by redirecting web requests through the local service and exploiting the APIs. While there is the use of a security token on the web service API, this is weak textual matching at best. This will not be difficult to spoof. It is well known that [API Keys do not provide any real security](http://nordicapis.com/why-api-keys-are-not-enough/).

It is likely that the architectural inclusion of an http / web-service interface provided the most flexibility for applications to be written natively or in HTML5; however, this flexibility may trade-off with security concerns. For example, if a native application were linked directly to the underlying framework services, there would be fewer concerns over remote attacks coming through the web-service interface.

Leaving the interface as designed, mitigations to attacks could include further securing the interface layer with cryptographic protocols: e.g. encrypted information passing, key exchange (e.g. Elliptic-Curve Diffie-Hellman).

#### User-level Native Attacks

* Modifying the CSV data-base
* Modifying the SQLite DB
* Tampering with the user-level binaries
* Tampering with the user daemons
* Spoofing the D-bus Interface
* Adding executables/libraries

With direct access to the device, there are many security concerns on the native level. For example, as Cynara uses a text file data-base with comma-separated values (CSV), an attacker could simply modify the data-base to escalate privileges of an application. Once a single application has all the privileges possible on the system, exploits can come through in this manner. Similarly the SQLite database used by the Security Manager is not much different than a simple text file. There are many tools available to add, remove, modify entries in an SQLite data-base.

On the next level, a common point of attack is to modify binaries or daemons for exploiting functionality. There are many Linux tools available to aid in this regard, including: [IDA Pro](https://www.hex-rays.com/products/ida/index.shtml), and [radare2](https://rada.re/r/). With the ability to modify binaries, an attacker can do any number of activities including: removing calls to security checks, redirecting control to bypass verification functionality, ignoring security policy handling, escalating privileges, etc.

Additionally, another attack vector would be to spoof the D-bus interface. D-bus is a message passing system built upon Inter-Process Communication (IPC), where structured messages are passed based upon a protocol. The interface is generic and well documented; and therefore, modifying or adding binaries/libraries to spoof this interface is a relatively straight-forward process. Once the interface has been spoofed, the attacker can issue any number of commands that lead into control of low-level functionality.

Protecting a system from native attacks requires a methodical approach. First, the system should reject processes that are not sanctioned to run. Signature-level verification at installation time will help in this regard, but run-time integrity verification is much better. Signatures need to originate from authorized parties, which is discussed further in a later section on the Application Store.

On the next level, executables should not be allowed to do things where they have not been granted permission. DAC and SMACK policies can help in this regard. On the other hand, there remain concerns with memory accesses, system calls, and other process activity that may go undetected. For this reason, a secure environment which monitors all activity can give indication of all unauthorized activity on the system.

Finally, it is very difficult to catch attacks of direct tampering in a system. These types of attacks require a defense-in-depth approach, where complementary software protection and hardening techniques are needed. Tamper-resistance and anti-reverse-engineering technologies include program transformations/obfuscation, integrity verification, and white-box cryptography. If applied in a mutually-dependent fashion and considering performance/security tradeoffs, the approach can provide an effective barrier to direct attacks to the system. Furthermore, the use of threat monitoring provides a valuable telemetry/analytics capability and the ability to react and renew a system under attack.

#### Root-level Native Attacks

* Tampering the system daemon
* Tampering Cynara
* Tampering the security manager
* Disabling SMACK
* Tampering the kernel

Once root-level access (i.e. su) has been achieved on the device, there are many ways to compromise the system. The system daemon, Cynara, and the security manager are vulnerable to tampering attacks. For example, an executable can be modified in memory to jam a branch, jump to an address, or disregard a check. This can be as simple as replacing a branch instruction with a NOP, changing a memory value, or using a debugger (e.g. gdb, IDA) to change an instruction. Tampering these executables would mean that policies can be ignored and verification checks can be bypassed.

Without going so far as to tamper an executable, the SMACK system is also vulnerable to attack. For example, if the kernel is stopped and restarted with the *security=none* flag, then SMACK is not enabled. Furthermore, systemd starts the loading of SMACK rules during start-up. If this start-up process is interfered with, then SMACK will not run. Alternatively, new policies can be added with smackload allowing unforseen privileges to alternative applications/executables.

Another intrusion on the kernel level is to rebuild the kernel (as it is open-source) and replace it with a copy that has SMACK disabled, or even just the SMACK filesystem (smackfs) disabled. Without the extended label attributes, the SMACK system is disabled.

Root-level access to the device has ultimate power, where the entire system can be compromised. More so, a system with this level access allows an attacker to craft a simpler *point-attack* which can operate on a level requiring fewer privileges (e.g. remote access, user-level access).

### Vulnerable Resources

#### Resource: `afm-user-daemon`

The `afm-user-daemon` is in charge of handling applications on behalf of a user. Its main tasks are:

* Enumerate applications that the end user can run and keep this list available on demand
* Start applications on behalf of the end user, set user running environment, set user security context
* List current runnable or running applications
* Stop (aka pause), continue (aka resume), terminate a running instance of a given application
* Transfer requests for installation/uninstallation of applications to the corresponding system daemon afm-system-daemon

The afm-user-daemon launches applications. It builds a secure environment for the application before starting it within that environment. Different kinds of applications can be launched, based on a configuration file that describes how to launch an application of a given kind within a given launching mode: local or remote. Launching an application locally means that the application and its binder are launched together. Launching an application remotely translates in only launching the application binder.

The UI by itself has to be activated remotely by a request (i.e. HTML5 homescreen in a browser). Once launched, running instances of the application receive a runid that identifies them. afm-user-daemon manages the list of applications that it has launched. When owning the right permissions, a client can get the list of running instances and details about a specific running instance. It can also terminate, stop or continue a given application. If the client owns the right permissions, afm-user-daemon delegates the task of installing and uninstalling applications to afm-system-daemon.

afm-user-daemon is launched as a systemd service attached to a user session. Normally, the service file is located at /usr/lib/systemd/user/afm-user-daemon.service.

Attacker goals:

* Disable `afm-user-daemon`
* Tamper with the afm-user-daemon configuration
	* /usr/lib/systemd/user/afm-user-daemon.service
	* Application(widget) config.xml file
	* /etc/afm/afm-launch.conf (launcher configuration)

* Escalate user privileges to gain more access with  afm-user-daemon
* Install malicious application (widget)
* Tamper with afm-user-daemon on disk or in memory

#### Resource: `afm-system-daemon`

The `afm-system-daemon` is in charge of installing applications on the AGL system. Its main tasks are:

* Install applications and setup security framework for newly installed applications
* Uninstall applications

`afm-system-daemon` is launched as a systemd service attached to system. Normally, the service file is located at /lib/systemd/system/afm-systemdaemon.service.

Attacker goals:

* Disable afm-system-daemon
* Tamper with the afm-system-daemon configuration
* Tamper afm-system-daemon on disk or in memory

#### Resource `afb-daemon`

`afb-binder` is in charge of serving resources and features through an HTTP interface. `afb-daemon` is in charge of binding one instance of an application to the AGL framework and AGL system. The application and its companion binder run in a secured and isolated environment set for them. Applications are intended to access to AGL system through the binder. afb-daemon binders serve files through HTTP protocol and offers developers the capability to expose application API methods through HTTP or WebSocket protocol.

Binder bindings are used to add APIs to afb-daemon. The user can write a binding for afb-daemon. The binder afb-daemon serves multiple purposes:

1. It acts as a gateway for the application to access the system;
2. It acts as an HTTP server for serving files to HTML5 applications;
3. It allows HTML5 applications to have native extensions subject to security enforcement for accessing hardware resources or for speeding up parts of algorithm.

Attacker goals:

* Break from isolation
* Disable afb-daemon
* Tamper afb-demon on disk or in memory
* Tamper capabilities by creating/installing  custom bindings for afb-daemon

## Cynara

[Cynara](https://wiki.tizen.org/Security:Cynara) was adopted from the Tizen security framework and consists of several parts:

* Cynara - a daemon for controlling policies and responding to access control requests
* Database - a spot to hold policies
* Libraries - several static and dynamic libraries for communicating with Cynara

The daemon communicates to the libraries over Unix domain sockets. The database storage format is a [series of CSV-like files with an index file](https://wiki.tizen.org/Security:Cynara:Storage).

There are several ways that an attacker can manipulate policies of the Cynara system:

* Disable Cynara by killing the process
* Tamper with the Cynara binary on-disk or in-memory
* Corrupt the database controlled by Cynara
* Tamper with the database controlled by Cynara
* Highjack the communication between Cynara and the database

The text-based database is the weakest part of the system and although there are some consistency mechanisms in place (i.e. the backup guard), these mechanisms are weak at best and can be countered by an attacker very easily.

## SMACK

Linux Security Modules (LSM) is a framework in the linux kernel which provides the ability to implement Mandatory Access Control (MAC) with different models. The SMACK model is a simplified mandatory access control, starting with character-based labels on files and directories. There are 4 major components to the system:

1. The LSM kernel module.
2. The `smackfs` filesystem.
3. Basic utilites for policy management and checking
4. The policy/configuration data

As with any mandatory access system, the policy management needs to be carefully separated from the checking, as the management utilities can become a convenient point of attack. Dynamic additions to the policy system need to be carefully verified, as the ability to update the policies is often needed, but introduces a possible threat. Finally, even if the policy management is well secured, the policy checking and failure response to that checking is also of vital importance to the smooth operation of the system.

While MAC is a certainly a step up in security when compared to DAC, there are still many ways to compromise a SMACK-enabled Linux system. Some of these ways are as follows:

* Disabling SMACK at invocation of the kernel (with command-line: security=none).
* Disabling SMACK in the kernel build and redeploying the kernel.
* Changing a SMACK attribute of a file or directory at install time.
* Tamperig with a process with the `CAP_MAC_ADMIN` privilege.
* Setting/Re-setting the SMACK label of a file.
* Tampering with the default domains (i.e. /etc/smack/accesses.d/default-access-domains).
* Disabling or tampering with the SMACK filesystem (i.e. /smackfs).
* Adding policies with smackload (adding the utility if not present).
* Changing labels with chsmack (adding the utility if not present).

# Application Store

Although the Tizen system has defined a [system of App signing and signing flow](https://wiki.tizen.org/Security/Tizen_3.X_Overview#Application_Singing_and_Certificates) to avoid the spread of unauthorized Apps that might contain malware. At this point, it is unclear how much of this flow AGL will adopt; however, judging from the experience, it is an essential topic. For example, the Google Play Store controls the authorization of Apps through signing, and still, there are [many accounts of Apps containing malware on the store](http://www.eweek.com/mobile/researchers-find-132-malware-infected-android-apps-on-google-play).

Tizen defines 5 levels of certificates and signing at each level, including an author, testing distributor, public level store distributor, partner level store distributor, and platform level store distributor. AGL may define a different number of third parties, but at a minimum an author and store distributor should be defined.

![App Signing Flow](App_signing_flow.png)

Once the number of signatures has been established, verification of those signatures needs to be done at a minimum at installation time on the AGL device. It is important to ensure the robustness/integrity of the public key used for signature verification. If the public key is modified, then this compromised key can be used to verify an attacker's private key signature.

Further to this, installation-time verification is limited. Attacks can happen to apps in-memory at runtime. Any modifications made after installation will be missed by installation-time verification. Integrity verification that runs during execution makes for a more complete security story.

# External Threats

## Attacks from the Cloud

### OTA Updates

Updates of software over-the-air are one of the most common points where an attacker will penetrate. An OTA update mechanism is one of the highest threats in the system. If an attacker is able to install his own application or firmware on the system, he can get the same level of access that the original application or firmware had. From that point, the intruder can get unfettered access to the rest of the system, which might include making modifications, downloading other pieces of software, and stealing assets.

#### Man-in-the-middle (MITM)

The man-in-the-middle attack is the most classic example of an attack, where an adversary inserts himself between two communicating entities and grabs whatever is being communicated. In the case of OTA attacks, the connection in the network may be intercepted:

* On the internet, before the cloud backend.
* At the base station, 3G,4G,5G connection to the internet.
* At the receiving antenna, connection to the car.
* Between the receiving antenna and the gateway router (if present), connection within the car.
* Between the gateway router and the target component (IVI, In-Vehicle Infotainment unit).

There are many ways to mount a MITM attack. For example, proxy tools like Burp Proxy can be used to intercept web traffic as a man-in-the-middle. Under the guise of being a testing tool, the proxy server is often used in attack scenarios. It runs on a variety of platforms.

As another example, false base station attacks are known to be fairly easy to set-up. The problem is apparently fairly prevalent in countries like China and in the UK. These fake base stations are sometimes just eavesdropping on the communication, but others have the potential to do serious harm.

Defenses against MITM attacks include encrypted and signed data pipes. Furthermore, architects and developers are also recommended to encrypt and sign the payloads that are being passed over these pipes, to defend against perusal of the data.

### Man-at-the-end (MATE) Attacks

The man-at-the-end attack is when an intruder analyzes the end-point of the communication when software is accessing the data communication. This is a more severe attack type where the attacker can:

* Steal keys.

	For example, a simple debugging session in running software could reveal a key used in memory.

* Tamper software.

	For example, replacing just one function call in software with a NOP (i.e. no operation) can drastically change the behavior of the program.

* Jam branches of control.

	For example, making a program take one branch of control rather than the intended branch can mean the difference between an authorized and a non-authorized installation.

* Modify important data.

	For example, if the data changed is a key or data leading to a control path, then this attack can be severe.

	In the case of OTA updates, MATE attacks are particularly problematic for the system. One of the consequences of MATE attacks can be installed software that allows installation of any other software. For example, an attacker might install remote access software to control any part of the system.

## Malicious Physical Attacks

### CAN & USB devices

On just about every vehicle, ECUs (Electronic Control Units) communicate over a CAN (Controller Area Network) bus, which is a two-wire bus using hardware arbitration for messages sent on the shared medium. This is essentially a *trusted* network where all traffic is visible to all controllers and any controller can send any message.

A malicious ECU on the CAN bus can easily inject messages destined for any other device, including things like the instrument cluster and the head unit. There are common ways for hardware to do USB to CAN and open source software to send and receive messages. For example, there is a driver included in the Linux kernel that can be used to send/receive CAN signals. A malicious device on the CAN bus can cause a great number of harmful things to happen to the system, including: sending bogus information to other devices, sending unintended commands to ECUs, causing DOS (Denial Of Service) on the CAN bus, etc.

# Conclusion

The Automotive Grade Linux (AGL) initiative builds upon open-source software including Linux and Tizen to offer a flexible application framework. However, the security provisions of the app framework, Cynara, and the security manager only go so far in keeping the biggest threats at bay. As experience has shown, providing a constrained app (like that in the Android Open Source Platform) and store development flow, signature verification, DAC sandboxing, and MAC (SMACK) controls over the platform can have a certain amount of success with the security of the system. However, the openness of the system invites many researchers, hobbyists and hackers and financially motivated attackers to compromise the system for their own gains.

As AGL arrives on modern automobiles, this is inevitably inviting many capable actors to modify, attack, and compromise these well thought-out systems and their applications. With concerns like safety and security, the auto industry cannot afford to go the way of consumer devices like phones and tablets where security problems are encountered on a frequent basis. It is imperative to use a layered approach and defense-in-depth to protect the system from inevitable attack.

This document has described both general attack goals and specific threats to the AGL system. While those may think that a remote attack is the biggest concern, the reader should be aware that an open-source software system invites people to first research direct attacks before crafting remote attacks. Don't underestimate the creative ability for hackers to find the weakest link in a product. This has been shown time and time again in open products.

repository: mudcam/docs-agl

repo_name: mudcam/docs-agl


text:
---
layout: default
---

# 1997-04-08 - Re: Cypherpunks FAQ

## Header Data

From<EMAIL_ADDRESS>(Dr.Dimitri Vulis KOTM)

To<EMAIL_ADDRESS>Message Hash: 78d169d5bfb74188c61440b1738287b6ee0d65c61d12980c3ec797d59a221f17

Message ID<EMAIL_ADDRESS>Reply To<EMAIL_ADDRESS>UTC Datetime: 1997-04-08 00:31:43 UTC

Raw Date: Mon, 7 Apr 1997 17:31:43 -0700 (PDT)

## Raw message

```
{% raw  %}From<EMAIL_ADDRESS>(Dr.Dimitri Vulis KOTM)
Date: Mon, 7 Apr 1997 17:31:43 -0700 (PDT)
To<EMAIL_ADDRESS>Subject: Re: Cypherpunks FAQ
In-Reply-To<EMAIL_ADDRESS>Message-ID<EMAIL_ADDRESS>MIME-Version: 1.0
Content-Type: text/plain

"Timothy C. May"<EMAIL_ADDRESS>writes:
> * First, calling for _others_ to write a FAQ, or to "collectively" write a
> FAQ, rarely works. (I'm not criticizing Paul, just noting historical truth.)
>
> * Second, many FAQs have been started, few have been finished.

An excellent FAQ from L.Deitweller was shot down by Timmy May and his
cronies precisely because Timmy was envious of LD's ability to do what
Timmy couldn't do.

<blah, blah, blah>

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

{% endraw %}
```

## Thread

+ Return to [April 1997](/archive/1997/04)

+ Return to<EMAIL_ADDRESS>(Dr.Dimitri Vulis KOTM)](/authors/dlv_at_bwalk_dm_com_dr_dimitri_vulis_kotm_)"

+ _Unknown thread root_
  + 1997-04-08 (Mon, 7 Apr 1997 17:31:43 -0700 (PDT)) - Re: Cypherpunks FAQ -<EMAIL_ADDRESS>(Dr.Dimitri Vulis KOTM)_

license: MIT

branch_name: refs/heads/master

extension: md

gha_license_id: MIT

license_type: permissive


text:
## 54. [Spiral Matrix](https://leetcode.com/problems/spiral-matrix/)

> Medium

Given a matrix of *m* x *n* elements (*m* rows, *n* columns), return all elements of the matrix in spiral order.

**Example 1:**

```
Input:
[
 [ 1, 2, 3 ],
 [ 4, 5, 6 ],
 [ 7, 8, 9 ]
]
Output: [1,2,3,6,9,8,7,4,5]
```

**Example 2:**

```
Input:
[
  [1, 2, 3, 4],
  [5, 6, 7, 8],
  [9,10,11,12]
]
Output: [1,2,3,4,8,12,11,10,9,5,6,7]
```

**Solutions:**

Different `matrix` has different `results`. There are at four kinds of situation to spiral a layer of matrix:

- Only have to move from left to right. This always happens;
- Move from left to right, then move from top to bottom. This requires `layer < endX` which means matrix has at least "two" rows;
- Move from left to right, then top to bottom, then right to left. This requires `layer < endX && layer < endY` which means matrix has at least "two" rows and "two" columns;
- Move a complete four edges. This requires `layer < endX - 1 && layer < endY` which means matrix has at least "three" rows and "two" columns.

Here is my solution class:

```c++
class Solution {
public:
	vector<int> spiralOrder(vector<vector<int>>& matrix) {
		vector<int> results;
		int row = matrix.size();
		if (row == 0)
			return results;
		int col = matrix[0].size();
		if (col == 0)
			return results;

		int layer = 0;
		while (layer * 2 < col && layer * 2 < row) {
			int endX = row - 1 - layer;
			int endY = col - 1 - layer;
			for (int j = layer; j <= endY; ++j) {
				results.push_back(matrix[layer][j]);
			}
			if (layer < endX) {
				for (int i = layer + 1; i <= endX; ++i) {
					results.push_back(matrix[i][col - 1 - layer]);
				}
			}
			if (layer < endX && layer < endY) {
				for (int j = endY - 1; j >= layer; --j) {
					results.push_back(matrix[row - 1 - layer][j]);
				}
			}
			if (layer < endY && layer < endX - 1) {
				for (int i = endX - 1; i >= layer + 1; --i) {
					results.push_back(matrix[i][layer]);
				}
			}
			layer++;
		}
		return results;
	}
};
```

repository: YuanweiZHANG/Leetcode

repo_name: YuanweiZHANG/Leetcode


text:
[![Build Status](https://travis-ci.org/blockchain-certificates/cert-issuer.svg?branch=master)](https://travis-ci.org/blockchain-certificates/cert-issuer)
[![PyPI version](https://badge.fury.io/py/cert-issuer.svg)](https://badge.fury.io/py/cert-issuer)

# cert-issuer

The cert-issuer project issues blockchain certificates by creating a transaction from the issuing institution to the
recipient on the Bitcoin blockchain that includes the hash of the certificate itself.

## Web resources
For development or testing using web requests, check out the documentation at [docs/web_resources.md](./docs/web_resources.md).

# Quick start using Docker

## Getting the Docker image
This uses bitcoind in regtest mode. This route makes many simplifications to allow a quick start, and is intended for
experimenting only.

1. First ensure you have Docker installed. [See our Docker installation help](docs/docker_install.md).

2. Clone the repo and change to the directory

    ```
    git clone https://github.com/blockchain-certificates/cert-issuer.git && cd cert-issuer
    ```

3. From a command line in cert-issuer dir, build your docker container:

    ```
    docker build -t bc/cert-issuer:1.0 .
    ```

4. Read before running!

    - Once you launch the docker container, you will make some changes using your personal issuing information. This flow mirrors what you would if you were issuing real certificates.
    - To avoid losing your work, you should create snapshots of your docker container. You can do this by running:

        ```
        docker ps -l
        docker commit <container for your bc/cert-issuer> my_cert_issuer
        ```

5. When you're ready to run:

    ```
    docker run -it bc/cert-issuer:1.0 bash
    ```

## Create issuing address

__Important__: this is a simplification to avoid using a USB, which needs to be inserted and removed during the
standard certficate issuing process. Do not use these addresses or private keys for anything other than experimenting.

Ensure your docker image is running and bitcoind process is started

1. Create an 'issuing address' and save the output as follows:

    ```
    issuer=`bitcoin-cli getnewaddress`
    sed -i.bak "s/<issuing-address>/$issuer/g" /etc/cert-issuer/conf.ini
    bitcoin-cli dumpprivkey $issuer > /etc/cert-issuer/pk_issuer.txt
    ```

2. Don't forget to save snapshots so you don't lose your work (see step 3 of client setup)

## Issuing certificates

1. Add your certificate to /etc/cert-issuer/data/unsigned_certificates/.

    ```
    # To use a sample unsigned certificate as follows:
    cp /cert-issuer/examples/data-testnet/unsigned_certificates/3bc1a96a-3501-46ed-8f75-49612bbac257.json /etc/cert-issuer/data/unsigned_certificates/

    # If you created your own unsigned certificate using cert-tools (assuming you placed it under data/unsigned_certificates):
    cp <cert-issuer-home>/data/unsigned_certificates/<your-cert-guid>.json /etc/cert-issuer/data/unsigned_certificates/

    or

    docker cp <cert-issuer-home>/data/unsigned_certificates/<your-cert-guid>.json <containerId>:/etc/cert-issuer/data/unsigned_certificates/
    ```

2. Make sure you have enough BTC in your issuing address.

    a. You're using bitcoind in regtest mode, so you can print money. This should give you 50 (fake) BTC:

    ```
    bitcoin-cli generate 101
    bitcoin-cli getbalance
    ```

    b. Send the money to your issuing address -- note that bitcoin-cli's standard denomination is bitcoins not satoshis! (In our
    app, the standard unit is satoshis.) This command sends 5 bitcoins to the address

    ```
    bitcoin-cli sendtoaddress $issuer 5
    ```

3. Issue the certificates on the blockchain

    ```
    cert-issuer -c /etc/cert-issuer/conf.ini
    ```

4. Your Blockchain certificates are located in `/etc/cert-issuer/data/blockchain_certificates`. Copy these to your local machine, and add them to cert-viewer's `cert_data` folder to see your certificates in the Certificate Viewer.

```
docker ps  // shows the docker containerId
docker cp <containerId>:/etc/cert-issuer/data/blockchain_certificates <localPath>/cert-viewer/cert_data
```

## Mac scrypt problems

If your install on Mac is failing with a message like the following, try the [workaround described in this thread](https://github.com/ethereum/pyethereum/issues/292) or the [workaround described here](https://github.com/pyca/cryptography/issues/2692#issuecomment-272773481).

```
fatal error: 'openssl/aes.h'
      file not found
#include <openssl/aes.h>
```

# Contact

Contact us at [the Blockcerts community forum](http://community.blockcerts.org/).


text:
[`🏠`](/) / [`Microprocessors`](/s/mp/) / [`Previous Years`](/s/mp/previous-years/) / [`May 19`](/s/mp/previous-years/may-19/) / `Q2`

### Q2a. Explain minimum mode configuration of 8086 microprocessor.

* 8086 works in Minimum Mode, when MN/ ¯MX = 1.
* Minimum Mode, 8086 is the only processor in the system.
* Clock is provided by the 8284 clock generator, it provides CLK, RESET and READY input to 8086.
* Address from the address bus is latched into 8282 8-bit latch.
Three such latches are needed, as address bus is 20-bit.
The ALE of 8086 is connected to STB of the latch.
The ALE for this latch is given by 8086 itself.
* The data bus is driven through 8286 8-bit trans-receiver.
Two such trans-receivers are needed, as the data bus is 16-bit.
The trans-receivers are enabled through the DEN signal, while the direction of data
is controlled by the DT/ ¯R signal.
¯DEN is connected to ¯OE and DT/ ¯R is connected to T.
Both ¯DEN and DT/ ¯R are given by 8086 itself.

![](https://i.imgur.com/oBqGrRt.png)

* Control signals for all operations are generated by decoding M/¯IO , ¯RD and ¯WR signals.

![](https://i.imgur.com/ySqyyQa.png)

* M/¯IO , ¯RD and ¯WR are decoded by a 3:8 decoder like IC 74138.
Bus Request (DMA) is done using the HOLD and HLDA signals.
* ¯INTA is given by 8086, in response to an interrupt on INTR line.

![](https://i.imgur.com/gvX2tzy.png)

### Q2b. Explain the cache organization of Pentium processor.

* Despite the potential advantages of a unified cache which is used in the 80486 processor, the Pentium microprocessor uses separate code and data caches.
* The reason is that the superscalar design and branch prediction demand more bandwidth than a unified cache.
* First, efficient branch prediction requires that the destination of a branch be accessed simultaneously with data references of previous instructions executing in the pipeline.
* Second, the parallel execution of data memory references requires simultaneous accesses for loads and stores.
* Third, in the context of the overall Pentium microprocessor design, handling self-modifying code for separate code and data caches is only marginally more complex than for a unified cache.
* The data and instruction caches on the Pentium processor are each 8 KB, two-way associative designs with 32 byte lines. Each cache has a dedicated translation lookaside Buffer (TLB) to translate linear addresses to physical addresses.
* The caches can be enabled or disabled by software or hardware. The Pentium microprocessor implements the data cache to supports dual accesses by the U-pipe and V-pipe to provide additional bandwidth and simplify compiler instruction scheduling algorithms.
* The data cache is write back or write through configured on a line-by-line basis and follows the MESI protocol. The data cache tags arc triple ported to support two data transfers and an inquire cycle in the same clock.
* The code cache is an inherent write protected cache. The code cache tags of the Pentium processor are also triple ported to support snooping and split-line accesses.
* The data path, however, is single ported with eight way interleaving of 32-bit-wide banks. When a bank conflict occurs, the U-pipe assumes software or hardware.

Sources

* https://www.ques10.com/p/13570/code-cache-organization-of-pentium-1/

license: Unlicense

branch_name: refs/heads/main

gha_language: HTML

gha_license_id: Unlicense


text:
---
published: true
tags: mechanical calculator 3dmodel
---
> Curt Herzstark had been working on the calculator in the 1930s until the Nazis forced him to focus on building other tools for the German army. He was taken by the Nazis in 1943 and ended up in Buchenwald concentration camp. There, he told the officers about his plans for the CURTA. They were impressed and interested enough to let him continue work on it so they could present it as a gift to the Führer. [The CURTA mechanical calculator](http://hackaday.com/2014/09/16/retrotechtacular-the-curta-mechanical-calculator/) literally saved its inventor’s life. / [The CURTA Calculator Page](https://www.vcalc.net/cu.htm)

[![caption](https://www.vcalc.net/images2/Posters/Curta-German-Poster-Master21G-860x560.jpg)](https://www.vcalc.net/cu.htm)

- [onshape 3D](https://cad.onshape.com/documents/56ab5570e4b0d9659037a1cf/w/9f078541afd347bb397e344f/e/2b386be0c67cfb2a94581ba7)

## [3D printed version](http://hackaday.com/2017/07/17/3d-printed-math-grenade/)

- [Photos of making of](http://imgur.com/a/ZAx7R#QpoZQao)
- Curta Calculator Type I scaled at 3:1 [thingiverse](https://www.thingiverse.com/thing:1943171)

 Some facts: Printed at 3:1 scale There are around 240 printed parts -- around 100 unique parts. There are about 100 non-printed parts (ball bearings, springs, screws, nuts, etc) The original Curta had over 600 parts. I combined many of them for simplicity when 3D printing. It weighed 1357g (just about 3 lbs) before painting. I used around 2 spools on the successful prints, but it was 3 spools counting failures. I first started researching for this project in April 2015. I had my first functional Curta in the Fall of 2016. This is the second Curta I've built and the first one I've painted. CAD work was done from the original engineering drawings in OnShape.

## Functionning

[![caption](https://img.youtube.com/vi/ShFkJgck6Pw/0.jpg)](https://www.youtube.com/watch?v=ShFkJgck6Pw)

## Assembly

[![caption](https://img.youtube.com/vi/zh2Z11miQ0w/0.jpg)](https://www.youtube.com/watch?v=zh2Z11miQ0w)


text:
# Mentorship Slackbot
<!-- START doctoc generated TOC please keep comment here to allow auto update -->
<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
**Table of Contents**  *generated with [DocToc](https://github.com/thlorenz/doctoc)*

- [Mentorship Slackbot](#mentorship-slackbot)
  - [General overview](#general-overview)
    - [Workflow](#workflow)
    - [Mentors](#mentors)
    - [Errors](#errors)
  - [Tech Setup](#tech-setup)
    - [Data Store](#data-store)
    - [Slack API](#slack-api)
    - [Configuration](#configuration)
      - [Access Token](#access-token)
        - [Bot/App Permissions](#botapp-permissions)
      - [Finding IDs](#finding-ids)
    - [Deployment](#deployment)
  - [Technologies/Acknowledgements](#technologiesacknowledgements)

<!-- END doctoc generated TOC please keep comment here to allow auto update -->

## General overview

### Workflow
Slackbot appears for all hackers, click button to ask for help. Bot asks for question.

1. Mentees interact with the BOT through DM.

Welcome Message | Request Popup
:-:|:--:
![Welcome Message](docs/welcome.png) | ![Request Popup](docs/dialog.png)

2. The bot posts the request into the private channel of mentors. It will tag mentors with the relevant skill.
![Mentor Request](docs/request.png)

4. Mentor can claim the request, at which point a DM is created between the mentor, the requester, and the bot
![New Session](docs/session.png)
5. The Mentor will receive controls via DM to close the request if it’s done, or surrender it back into the queue if they cannot do it
![Controls](docs/controls.png)
6. Bot pings a stats channel (e.g. #general) every 3 hours with updates and how to get in touch for help
![Stats](docs/stats.png)
7. Old, unclaimed requests are automatically bumped every 10 min if nobody has responded to it
![Bump](docs/bump.png)

### Mentors
1. Mentors can set their skills with the bot through the `!skills` command in DM
![Skills](docs/skills.png)
2. The bot automatically rescans the slack users list every 15 minutes. To have someone be a mentor, simply add them to the private mentors channel.
3. All mentors have access to an additional `!stats` command to manually trigger a stats post.

### Errors
The bot will automatically report any runtime errors to the private mentors channel (tagging the mentor lead in the process!).
![Errors](docs/errors.png)

## Tech Setup

### Data Store
This app is written in TypeScript and uses a local `lowdb` json database to store sessions. This json database file is automatically generated at runtime as [src/storage/db.json](src/storage/db.json).

### Slack API
This bot requires a custom slack app to work. In particular, it requires the following Slack API components:
- Interactive Components
    - Request url:
        - https://your-bot-url.com/slack/actions
- Event Subscriptions
    - Request url:
        - https://your-bot-url.com/slack/events
    - Bot events:
        - app_mention
        - im_created
        - message.groups
        - message.im
    - Workspace events:
        - team_join
- Bots
    - Set up the display name and default username as you wish
- Permissions
    - Redirect url:
        - https://your-bot-url.com/auth
    - Required scopes:
        - chat:write:bot
        - groups:write
        - bot (Add Bot User)
        - users:read

### Configuration
Configuration parameters are stored in [src/config/index.ts](src/config/index.ts). A sample configuration file is provided in this repo.

#### Access Token
If you're installing the bot onto your Slack through "distribution", you can get the relevant bot access token by simply installing it through the "manage distribution" page of your Slack app.
    1. Click the "Add to Slack" button ![Add to Slack](docs/add.png)
    2. Click "Allow"
    3. Find your bot access token! (starts with xoxb) ![Token](docs/token.png)

##### Bot/App Permissions
Remember to add your app to the channels your bot will post in, in particular the private mentors channel and the stats channel. ![About channel](docs/about_channel.png)

#### Finding IDs
You can find User IDs, Channel IDs, and Group IDs in the URL on Slack.
![Group ID](docs/url.png)

### Deployment
We use Kubernetes and [Skaffold](skaffold.dev). You will find the Kubernetes configuration file that we use in [kubernetes/deployment.yaml](kubernetes/deployment.yaml). Please feel free to use it as a template for your deployments.

## Technologies/Acknowledgements

- [lowdb](https://github.com/typicode/lowdb) for local document storage
- [TypeScript](http://www.typescriptlang.org/)
- [Node Slack SDK](https://slack.dev/node-slack-sdk/)

repository: VandyHacks/mentorship-slackbot

gha_language: TypeScript

repo_name: VandyHacks/mentorship-slackbot


text:
## [轉載] Facial Landmark Detection [Back](./../post.md)

> - Author: [Satya Mallick](http://www.learnopencv.com/about/)
> - Origin: http://www.learnopencv.com/facial-landmark-detection/
> - Time: Oct, 18th, 2015

    Facial landmark detection using Dlib (left) and CLM-framework (right).

> Who sees the human face correctly: the photographer, the mirror, or the painter? — Pablo Picasso

If Picasso was alive today, he would have definitely added one more professional to that list — a computer vision engineer!

As computer vision engineers and researchers we have been trying to understand the human face since the very early days. The most obvious application of facial analysis is Face Recognition. But to be able to identify a person in an image we first need to find where in the image a face is located. Therefore, face detection — locating a face in an image and returning a bounding rectangle / square that contains the face — was a hot research area. In 2001, Paul Viola and Michael Jones pretty much nailed the problem with their seminal paper titled "[Rapid Object Detection using a Boosted Cascade of Simple Features.](https://www.cs.cmu.edu/~efros/courses/LBMV07/Papers/viola-cvpr-01.pdf)" In the early days of OpenCV and to some extent even now, the killer application of OpenCV was a good implementation of the Viola and Jones face detector.

Once you have a bounding box around the face, the obvious research problem is to see if you can find the location of different facial features ( e.g. corners of the eyes, eyebrows, and the mouth, the tip of the nose etc ) accurately. Facial feature detection is also referred to as "facial landmark detection", "facial keypoint detection" and "face alignment" in the literature, and you can use those keywords in Google for finding additional material on the topic.

### Applications of Facial Keypoint Detection

There are several interesting applications of keypoint detection in human faces. A few of them are listed below.

#### Facial feature detection improves face recognition

Facial landmarks can be used to align facial images to a mean face shape, so that after alignment the location of facial landmarks in all images is approximately the same. Intuitively it makes sense that facial recognition algorithms trained with aligned images would perform much better, and this intuition has been confirmed by many research papers.

#### Head pose estimation

Once you know a few landmark points, you can also estimate the pose of the head. In other words you can figure out how the head is oriented in space, or where the person is looking. E.g. CLM-Framework described in this post also returns the head pose.

#### Face Morphing

Facial landmarks can be used to align faces that can then be morphed to produce in-between images. An example is shown in Figure 1.

    Figure 1. A morph between President Bush and the The Governator!

> Click [here](http://www.learnopencv.com/face-morph-using-opencv-cpp-python/) for my followup post on [Face Morphing](http://www.learnopencv.com/face-morph-using-opencv-cpp-python/).

#### Virtual Makeover

At my company ( [TAAZ.com](http://www.taaz.com/) ) we had written our own facial landmark detector. The detected landmarks were used to the calculate contours of the mouth, eyes etc. to render makeup virtually. An example is shown in Figure 2.

    Figure 2. Landmark detection for virtual makeover.

#### Face Replacement

If you have facial feature points estimated on two faces, you can align one face to the other, and then seamlessly clone one face onto the other. You can also do something goofy like this

https://auduno.github.io/clmtrackr/examples/facesubstitution.html

> Click [here](http://www.learnopencv.com/face-swap-using-opencv-c-python/) to read my followup post on [Face Swap](http://www.learnopencv.com/face-swap-using-opencv-c-python/)

In a previous post, we showed how to use facial features to predict [facial attractiveness](http://www.learnopencv.com/computer-vision-for-predicting-facial-attractiveness/).

Clearly, the ability to detect facial features in images and videos open up possibilities of a ton of interesting applications.

### Facial Feature Detection & Tracking Libraries

There has been a flurry of activity in this area in the last 5 years. Part of the reason for this activity is the availability of large annotated datasets like LFPW and Helen. I have listed a bunch of papers in the next section. However, I do not recommend implementing these papers from scratch because now we have access to high quality open source implementations of some of these papers.

In the video below, you can see two of the libraries, **Dlib** and **CLM-framework** in action.

#### Dlib ( C++ / Python )

[Dlib](http://dlib.net/) is a collection of miscellaneous algorithms in Machine Learning, Computer Vision, Image Processing, and Linear Algebra. Most of the library is just header files that you can include in your C++ application. **Oh you prefer python ? No problem, it has a python API as well**.

I personally like Dlib more than any other facial feature detection & tracking library because the code is very clean, well documented, the license permits use in commercial applications, the algorithm they have chosen to implement is very fast and accurate, and you can easily integrate the library in your C++ project by just including the header files.

##### How to compile Dlib ?

i. Download a copy from github
```bash
git clone https://github.com/davisking/dlib.git
```
ii. Build examples ( OSX / Linux )
```bash
cd dlib/examples
mkdir build
cd build
cmake ..
cmake --build . --config Release
```
These examples are a great way to start using dlib. Make a copy of an example cpp file, modify it, modify examples/CMakeLists.txt and compile again using the instructions above. Easy!
iii. Compile dlib python module
```bash
cd dlib/python_examples
./compile_dlib_python_module.bat
```
iv. Set PYTHONPATH environment variable
```bash
# Put the following line in .bashrc or .profile
export PYTHONPATH=/path/to/dlib/python_examples:$PYTHONPATH
```
v. Test python module
```bash
python -c "import dlib"
```

If the above line does not give an error, you are all set.

In case you run into any compilation issues, there are [additional instructions at Dlib.net](http://dlib.net/compile.html)

##### How to run Dlib's facial landmark detector ?

After you have built the examples, to run the facial landmark detector using a webcam, do the following.

```bash
cd examples/build/
#Download the face landmark model
wget http://dlib.net/files/shape_predictor_68_face_landmarks.dat.bz2
tar xvjf shape_predictor_68_face_landmarks.dat.bz2
./webcam_face_pose_ex
```

If you want to run it on a single image, you can try

```bash
./face_landmark_detection_ex shape_predictor_68_face_landmarks.dat faces/*.jpg
```

#### CLM-Framework (C++)

[CLM-framework](https://github.com/TadasBaltrusaitis/CLM-framework), also known as the Cambridge Face Tracker, is a C++ library for facial keypoint detection and head pose estimation. You can see how well it works in the included video. Compiling this library on OSX was bit of a challenge but it was not too bad. The library depends on OpenCV 3 and requires X11.

There are two important ways in which Dlib beats CLM-Framework. First, DLib is much faster than CLM-Framework. Second, Dlib's license allows you to use it in commercial applications. If I had to pick, I would use Dlib. Interestingly, CLM-Framework depends on Dlib!

##### How to compile CLM-Framework ?

Compiling CLM-Framework was a bit involved for OSX. For windows and linux there are detailed instructions here. For compiling version 1.3.0 on OSX, I used the instructions for linux but made the following changes.

Most of the dependencies were installed using brew.

In file **CMakeLists.txt** ( red text was replaced with green text ).

> <s>find_package( OpenCV 3.0 REQUIRED )</s>

> find_package( OpenCV 3.0 REQUIRED HINTS /path/to/opencv )

> INCLUDE_DIRECTORIES(${OpenCV_INCLUDE_DIRS})

> INCLUDE_DIRECTORIES(/opt/X11/include)

In file **exe/SimpleCLM/SimpleCLM.cpp**

> <s>writerFace = VideoWriter(tracked_videos_output[f_n], CV_FOURCC('D','I','V','X'), 30, captured_image.size(), true);</s>

> writerFace = VideoWriter(tracked_videos_output[f_n], CV_FOURCC('M','P','4′,'V'), 15, captured_image.size(), true);

##### How to run CLM-Framework's Facial Feature Detector ?

After compiling CLM-Framework, the executables are in the **bin** directory. For the webcam demo shown in this post, you can use

```bash
bin/SimpleCLM
```

#### Face++ ( FacePlusPlus ) : Web API

One of the best implementations of facial landmark detection is by FacePlusPlus. They won the [300 Faces In-the-Wild Landmark Detection Challenge](http://ibug.doc.ic.ac.uk/resources/300-W/), 2013. They provide an easy to use API. The problem is that you need to upload an image to their servers and that raises a lot of privacy concerns. But if privacy is not an issue, Face++ is very good option. You can see a demo at

http://www.faceplusplus.com/demo-landmark/

### Facial Feature Detection Research

Many different approaches have been used to solve this problem and it is difficult to summarize them in a blog post. I am simply linking to some important papers ( with major bias toward recent work ) for people who want to investigate more.

1. [Active Appearance Model (AAM)](https://www.cs.cmu.edu/~efros/courses/LBMV07/Papers/cootes-eccv-98.pdf) by T. Cootes, G. Edwards and C. J. Taylor. [1998]
2. [Face Alignment through Subspace Constrained Mean-Shifts](http://www.ri.cmu.edu/pub_files/2009/9/CameraReady-6.pdf) by Jason M. Saragih, Simon Lucey and Jeffrey F. Cohn. [2009]
3. [Localizing Parts of Faces Using a Consensus of Exemplars](http://neerajkumar.org/projects/face-parts/base/papers/nk_cvpr2011_faceparts.pdf) by Peter N. Belhumeur, David W. Jacobs, David J. Kriegman, Neeraj Kumar [ 2011 ]
4. [Face Alignment by Explicit Shape Regression](http://research.microsoft.com/pubs/192097/cvpr12_facealignment.pdf) by Xudong Cao Yichen Wei Fang Wen Jian Sun [2012]
5. [Supervised Descent Method and Its Applications to Face Alignment](https://courses.cs.washington.edu/courses/cse590v/13au/intraface.pdf) by Xuehan Xiong and Fernando De la Torre [2013]
6. [Constrained Local Neural Fields for robust facial landmark detection in the wild](https://www.cl.cam.ac.uk/~tb346/pub/papers/iccv2013.pdf) by Tadas Baltrusaitis, Peter Robinson, and Louis-Philippe Morency. [2013]
7. [Extensive Facial Landmark Localization with Coarse-to-fine Convolutional Network Cascade](http://www.faceplusplus.com/wp-content/uploads/FacialLandmarkpaper.pdf) by Erjin Zhou, Haoqiang Fan, Zhimin Cao, Yuning Jiang and Qi Yin. [2013]
8. [Face alignment at 3000 fps via regressing local binary features](http://research.microsoft.com/en-US/people/yichenw/cvpr14_facealignment.pdf) by S Ren, X Cao, Y Wei, J Sun. [2014]
9. [Facial Landmark Detection by Deep Multi-task Learning](http://personal.ie.cuhk.edu.hk/~ccloy/files/eccv_2014_deepfacealign.pdf) by Zhanpeng Zhang, Ping Luo, Chen Change Loy, and Xiaoou Tang. [2014]
10. [One Millisecond Face Alignment with an Ensemble of Regression Trees](http://www.cv-foundation.org/openaccess/content_cvpr_2014/papers/Kazemi_One_Millisecond_Face_2014_CVPR_paper.pdf) by Vahid Kazemi and Josephine Sullivan. [2014]

repository: YYY-TEAM/PersonalWiki

repo_name: YYY-TEAM/PersonalWiki


text:
# Transforming the content type
## Example use case
This section describes how you can transform the content type of a message using an API. In this scenario, the API exposes a REST back-end service that accepts and returns XML and JSON messages for HTTP methods as follows:

-   GET - response is in JSON format
-   POST - accepts XML request and returns response in JSON format
-   PUT - accepts JSON request and returns response in JSON format
-   DELETE - empty request body should be sent

## Synapse configuration

Create an API using the following configuration:

```xml
<api xmlns="http://ws.apache.org/ns/synapse" name="StarbucksService" context="/Starbucks_Service">
    <resource methods="POST" url-mapping="/orders/add">
        <inSequence>
            <property name="REST_URL_POSTFIX" scope="axis2" action="remove"/>
            <send>
                <endpoint>
                    <address uri="http://localhost:8280/StarbucksService/services/Starbucks_Outlet_Service/orders/"/>
                </endpoint>
            </send>
        </inSequence>
        <outSequence>
            <log level="full"/>
            <property name="messageType" value="application/xml" scope="axis2"/>
            <send/>
        </outSequence>
    </resource>
    <resource methods="PUT" url-mapping="/orders/edit">
        <inSequence>
            <log level="full"/>
            <property name="REST_URL_POSTFIX" scope="axis2" action="remove"/>
            <property name="messageType" value="application/json" scope="axis2"/>
            <property name="ContentType" value="application/json" scope="axis2"/>
            <send>
                <endpoint>
                    <address uri="http://localhost:8280/StarbucksService/services/Starbucks_Outlet_Service/orders/" format="rest"/>
                </endpoint>
            </send>
        </inSequence>
        <outSequence>
            <log level="full"/>
            <property name="messageType" value="application/xml" scope="axis2"/>
            <send/>
        </outSequence>
    </resource>
    <resource methods="DELETE GET" uri-template="/orders/{id}">
        <inSequence>
            <send>
                <endpoint>
                    <address uri="http://localhost:8280/StarbucksService/services/Starbucks_Outlet_Service/"/>
                </endpoint>
            </send>
        </inSequence>
        <outSequence>
            <log level="full"/>
            <property name="messageType" value="application/xml" scope="axis2"/>
            <send/>
        </outSequence>
    </resource>
</api>
```

## Build and run

The context of the API is ‘/Starbucks_Service’. For every HTTP method, a url-mapping or uri-template is defined, and the URL to call the methods differ with the defined mapping or template.

Following is the CURL command to send a GET request to the API:

` curl -v -X GET http://localhost:8280/Starbucks_Service/orders/123                           `

The response from the back end to the ESB profile will be:

`         {"Order":{"additions":"Milk","drinkName":"Vanilla Flavored Coffee","locked":false,"orderId":123}}        `

The ESB profile transforms this response to XML and send it back as:

```
<Order>
    <additions>Milk</additions>
    <drinkName>Vanilla Flavored Coffee</drinkName>
    <locked>false</locked>
    <orderId>123</orderId>
</Order>
```

Following is the cURL command to send an HTTP POST request to the API:

`         curl -v -H "Content-Type: application/xml" -X POST -d @placeOrder.xml                              http://localhost:8280/Starbucks_Service/orders/add                           `

where `         placeOrder.xml        ` has the following content on the order:

```
<Order>
    <drinkName>Mocha Flavored Coffee</drinkName>
    <additions>Caramel</additions>
</Order>
```

This XML request will be sent to the back end, which will send back a JSON response to the ESB profile:

`         {"Order":{"additions":"Caramel","drinkName":"Mocha Flavored Coffee","locked":false,"orderId":"d088a289-1be3-453b-ab37-7609828d2197"}}        `

The ESB profile converts this response to XML and sends it back to the client:

```
<Order>
    <additions>Caramel</additions>
    <drinkName>Mocha Flavored Coffee</drinkName>
    <locked>false</locked>
    <orderId>d088a289-1be3-453b-ab37-7609828d2197</orderId>
</Order>
```

Following is the cURL command for sending an HTTP PUT request:

`         curl -v -H "Content-Type: application/xml" -X PUT -d @editOrder.xml                              http://localhost:8280/Starbucks_Service/orders/edit                           ` where `         editOrder.xml        ` has the following syntax:

```
<Order>
    <orderId>d088a289-1be3-453b-ab37-7609828d2197</orderId>
    <additions>Chocolate Chip Cookies</additions>
</Order>
```

The ESB profile will convert this request to JSON and send it to the back end. The response will be in JSON format:

`         {"Order":{"additions":"Chocolate Chip Cookies","drinkName":"Mocha Flavored Coffee","locked":false,"orderId":"d088a289-1be3-453b-ab37-7609828d2197"}}`

The ESB profile converts this response to XML and sends it back to the client:

```
<Order>
    <additions>Chocolate Chip Cookies</additions>
    <drinkName>Mocha Flavored Coffee</drinkName>
    <locked>false</locked>
    <orderId>d088a289-1be3-453b-ab37-7609828d2197</orderId>
</Order>
```

Following is the cURL command for sending an HTTP DELETE request:

`         curl -v -X DELETE                              http://localhost:8280/Starbucks_Service/orders/d088a289-1be3-453b-ab37-7609828d2197                           `

This request will be sent to the back end, and the order with the specified ID will be deleted.


text:
**Fake Plastic Trees**
是来自英国牛津的摇滚乐队Radiohead所演唱的一首歌曲。该乐队被誉为当代最伟大的摇滚乐队之一。成员有主唱汤姆•约克（Thomas Edward
Yorke）、吉他埃德•奥布赖恩（Ed O'Brien）、键盘强尼•格林伍德（Jonny Greenwood）、贝斯科林•格林伍德（Colin
Greenwood）和鼓手菲尔•塞尔韦。乐队风格为另类摇滚（alternative
rock），英伦摇滚(Britpop)，试验摇滚(Experimental rock)，电子摇滚(Electrical)。

另外， _Fake Plastic Trees_ 此曲收录在其第二张正式专辑The
Bends中。此专辑得到了普遍喝彩，使他们赢得一项BRIT大奖，成为1995年度最受欢迎乐队。两年后，他们推出了又一张专辑《OK
Computer》，获得了摇滚乐队的最热烈评论，并1998年赢得了一项格莱美“最受欢迎的摇滚音乐”大奖。

歌词下方是 _Fake Plastic Trees钢琴谱_ ，希望大家喜欢。

### Fake Plastic Trees歌词：

Her Green plastic watering can
For her fake chinese rubber plant
In fake plastic earth.

That she bought from a rubber man
In a town full of rubber plants
Just to get rid of itself.
And It Wears Her Out, it wears her out
It wears her out, it wears her out.

She lives with a broken man
A cracked polystyrene man
Who just crumbles and burns.

He used to do surgery
For girls in the eighties
But gravity always wins.

But I can't help the feeling
I could blow through the ceiling
If I just turn and run
And It Wears Me Out, it wears me out
It wears me out, it wears me out.
And if I could BE who you wanted
If I could BE who you wanted,
All the time, all the time, oh


text:
# javascript_algorithms

Implementations of Various Algorithms in Javascript.
All problems have unit test coverage.

## Why Javascript?

Its my strongest language at the moment, and given the impressive progress that V8 is making I think that Javascript has a great future.
Plus I'm sometimes a little lazy and just want some loose typing 😂
I've tended to focus on CS concepts and data structures, I also spent time here learning Regex etc.

## Challenges Done So Far:

1. Word Abbreviation - Test of Text Manupulation (_From CodeWars_)
2. Square Into Squares - A Tricky bit of Mathsy stuff, I solved using Recursion (_From CodeWars_)
3. FizzBuzz - Done using a string and ternary operators.
4. Add Two Numbers - Sums Involving Linked Lists, Solved Using Recursion (_From LeetCode_)
5. Group Anagrams - Identifying and Grouping Anagrams, Solves Using Regex and Loops (_From LeetCode_)
6. Unique Paths - Dynamic Programming Problem, Solved Using Brute Force then Sped up Using Top Down Approach (_From LeetCode_)
7. Sort Colors - Sort Challenge, First Solved with Count Sort then Applied a Context Specific Sort (_From LeetCode_)
8. Letter Combinations Phone Number - Backtracking Problem, Solved using Recursion and a Lookup Table (_From LeetCode_)
9. Flatten Array with Stack - Basic Challenge, but had to solve using a Stack instead of Recursion (_From a Coding Interview_)
10. Histogram - Convert an Array into a Histogram, Solved with a Half Count Sort and Early Escape Loop (_From an Interview_)
11. Regex Examples - Learning Regex for Efficient Searches etc. (_From Tutorial on HackerRank_)
12. Odd Even Linked List - Reordering a Linked List, done using brute force, reworked using pointer solution (_From LeetCode_)
13. Binary Tree Traverse In-Order - Binary Tree Traversal, Implemented Iteratively Using Stack (_From LeetCode_)
14. Serialize and Deserialize Binary Tree - Binary Tree Work, Implemented Using Queue and Iterative Solution but may not be the most efficient (_From LeetCode_)
15. Longest Substring without Repeating Characters - Array/String Problem, Implemented Using a Dequeue and Includes, may be faster with a Set (_From LeetCode_)
16. Column To Number Conversion - Converting the Excel-style Column Headers to a Number, solved using Ascii Codes and Base Manupulation (_From LeetCode_)

gha_language: JavaScript


text:
# OpenTK GLFW redist #

Because opentk has it's own needs when it comes to it's nuget glfw redist package this repository was created to manage our own version of the fantastic glfw-redist project originally found here: https://bitbucket.org/sgrottel_nuget/glfw

# GLFW NuGet #

![GLFW Icon](glfw.png)

This repository contains all files and information to create a NuGet package out of the official pre-compiled binaries of GLFW.

We do not compile the library myself! We only package the available pre-compiled binaries.

GLFW is licensed under the [zlib/libpng license](http://www.glfw.org/license.html).

Project Website: http://www.glfw.org/

## How do I get set up? ##

* Download the pre-compiled GLFW for Windows (`WIN32` and `WIN64`): http://www.glfw.org/download.html
* Copy the following items into the corresponding folders:
    * `docs` > `.`
    * `include` > `.`
    * `lib-vc2010` > `Win32`
    * `lib-vc2012` > `Win32` or `x64`
    * `lib-vc2013` > `Win32` or `x64`
    * `lib-vc2015` > `Win32` or `x64`
    * `lib-vc2017` > `Win32` or `x64`
    * `lib-vc2019` > `Win32` or `x64`
    * `COPYING.txt` > `docs`
* You might need to adjust `glfw.nuspec`, `glfw.targets`, and `glfw-propertiesui.xml`
    * `glfw.nuspec` stores the meta data and which files to include in the package.
	* `glfw.targets` contains all MSBuild settings to consume the package. This includes automatic adjustment of platforms, configurations and toolsets.
	* `glfw-propertiesui.xml` provides some Visual Studio UI to allow the consume of the package to force some settings.

## Building the NuGet Package ##

Install nuget command line tool.

Run: `make_nuget.ps1 . 5`

The first argument is this project directory.

The second argument is the build number, which is to be increased each time a new package for the same version is published.

license: Zlib

repository: jvbsl/glfw-redist

repo_name: jvbsl/glfw-redist


text:
# openic

An open source instrument cluster designed around a 1920x720 LCD and a Raspberry Pi. Primary test subject is a 1998 Jeep Grand Cherokee which communicates via CCD. We will take CCD and forward it to CAN and read in the CAN. Signal definitions will be done via DBC file.

### Parts List
###### Display
- C123HAN01.0 LCD (Aliexpress)
- HDMI driver board (Aliexpress/Alibaba)
###### Compute
- Raspberry Pi 3B
- Arduino (CCD to CAN adapting)

###### Car Communications
- MCP2551 (CAN at 500k baud)
- MCP2515 (SPI)
- CDP68HC68HC1 (CCD at 7812 baud)

### Initial Issues w/ 1998 Jeep Grand Cherokee 5.9 Limited
- The IC is a bus termination and bias point (unlike CAN, CCD only gets power and ground from certain modules, not every module). So, we'll need to recreate that on our board.
- The instrument cluster provides bias to the ABS lamp and if all is okay, the ABS module turns off the lamp (floats the ground, I'm assuming).
- Turn signals are done at a low level, so we need to read their states via transistors and display them on the screen.
- Everything else is done via CCD (such as the cruise available state. Don't know if engaged or not is available).

### Display Fitment
- We need to recreate the row of warning/status lamps at the bottom as the LCD is too tall to keep them.
- Design and have CNC cut an overlay to over the LCD
- Design and 3d print the brackets for the LCD, LED Driver connections at the display (fragile), LCD and LED Driver, RPi.

### General LCD Issues
- Many LCD Driver boards come with manual keys for the menu system and also brightness adjustment. It seems like the LED driver board accepts a PWM signal from the LCD Driver board for brightness. Probably offload this onto an attiny or something similar to handle that task. Needs to be separate from the main avr as it is a time specific task and crucial to the display function.

repository: csouers/openic

repo_name: csouers/openic


text:
# RecurringInfo

## Properties
Name | Type | Description | Notes
------------ | ------------- | ------------- | -------------
**recurrence_pattern** | [**RecurrencePattern**](RecurrencePattern.md) | Represents a recurrence pattern of the recurring task. Can be one of the values of  enum. |
**start_date** | **datetime** | Specifies the date for the occurrences to begin. |
**end_date** | **datetime** | Specifies the date for the occurrences to end. |
**duration** | **str** | Specifies the duration for one occurrence of the recurring task. the instance of  class. |
**occurrences** | **int** | Specifies a number of occurrences of the recurring task. |
**use_end_date** | **bool** | Determines whether to use the end date or a number of occurrences for the recurring task. |
**daily_repetitions** | **int** | Specifies an interval between repetitions for the daily recurrence pattern. |
**daily_use_workdays** | **bool** | Determines whether to use workdays for the daily recurrence pattern. |
**weekly_repetitions** | **int** | Specifies an interval between repetitions for the weekly recurrence pattern. |
**weekly_days** | [**WeekDayType**](WeekDayType.md) | Specifies a collection of days used in the weekly recurrence pattern. |
**monthly_use_ordinal_day** | **bool** | Determines whether to use ordinal day for the monthly recurrence pattern. |
**monthly_ordinal_number** | [**OrdinalNumber**](OrdinalNumber.md) | Specifies an ordinal number of the monthly recurrence pattern. Can be one of the values of  enum. |
**monthly_ordinal_day** | [**DayOfWeek**](DayOfWeek.md) | Specifies a day of the monthly recurrence pattern when using ordinal day. Can be one of the values of  enum. |
**monthly_ordinal_repetitions** | **int** | Specifies a number of repetitions for the monthly recurrence pattern when using ordinal day. |
**monthly_day** | **int** | Specifies a number of day of the monthly recurrence pattern. |
**monthly_repetitions** | **int** | Specifies a number of repetitions for the monthly recurrence pattern. |
**yearly_use_ordinal_day** | **bool** | Determines whether to use ordinal day for the yearly recurrence pattern. |
**yearly_date** | **datetime** | Specifies a date for the yearly recurrence pattern. |
**yearly_ordinal_number** | [**OrdinalNumber**](OrdinalNumber.md) | Specifies an ordinal number of the yearly recurrence pattern. Can be one of the values of  enum. |
**yearly_ordinal_day** | [**DayOfWeek**](DayOfWeek.md) | Specifies a weekday of the yearly recurrence pattern when using ordinal day. Can be one of the values of  enum. |
**yearly_ordinal_month** | [**Month**](Month.md) | Specifies a month of the yearly recurrence pattern when using ordinal day. Can be one of the values of  enum. |

[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)


text:
# Tutorials_QE_and_eQE
Tutorials on Quantum Espresso (QE) and embedded QE (eQE)

* 1_md - demonstrates computing 50 steps of MD for ethylene molecule with QE package and also MD for CO2

* 2_delta-scf - demonstrates how to fix the occupation numbers and perform the delta-SCF calculations of
        the excited states for ethylene molecule of course

* 3_pdos
          demonstrates how to compute pDOS and post-process it using Libra
          is the fresh setup for more complex system, similar to ex3, also demonstrates the nscf calculations (for pDOS calculations, but only internally by QE)

* 4_normal_modes - is a demonstration of the normal modes calculations with QE

* 5_interactive_qe - running QE from the Jupyter notebook

* 6_nac_workflow - NAC calculations with QE

* 7_eqe_nacs  -  example of how to use the `nonadiabatic` branch of eQE for computing time-overlaps


text:
---
layout: page
title: Contact
permalink: /contact/
feature-img: "img/color.png"
---

If anyone out there would like to contact me, please fill out the form below and I will get back to you as soon as I can. Or if anyone is in Columbus, Ohio and looking for a buddy to code with then feel free to let me know! I look forward to answering any questions or even just chatting about Development with anyone interested. If you are interested in joining Bloc.io I would be happy to put you in touch with the admissions team.

<form action="https://getsimpleform.com/messages?form_api_token=ea49a42532d5d0e54b7b03c8679ea129" method="post">
  <!-- the redirect_to is optional, the form will redirect to the referrer on submission -->
  <input type='hidden' name='redirect_to' value='https://th0mps0nty.github.io/thank-you/' />
  <input type='text' name='name' placeholder='Your Full Name' />
  <input type='email' name='email' placeholder='Your E-mail Address' />
  <textarea name='message' placeholder='Write your message ...'></textarea>
  <input type='submit' value='Send Message' />
</form>


text:
# RailsAdminSimpleHasMany

RailsAdminSimpleHasMany is a field type for [Rails Admin](https://github.com/sferik/rails_admin) for has_many associations that do not require a complex multiselect field. RailsAdminSimpleHasMany has been only tested with Mongoid adapter and on Chrome/Safari. I do not expect major issues with other ORMs or browsers, but bugs and enhancements pull requests are welcome!

Example of how the collection field would look like:

![RailsAdminSimpleHasMany screenshot1](https://s3.amazonaws.com/aimannajjar.com/assets/images/portfolio/rails_admin_simple_has_many_sm_orderable.png)

## Usage

Simply add the following gem to your Gemfile:
```ruby
gem "rails_admin_simple_has_many"
```
And then run `bundle` (note: `rails_admin` should already be in your Gemfile)

Next, add the field as follows in your model

```ruby
rails_admin do
    field :players, :simple_has_many do
        help 'Please add 12 players'
        orderable true
        required true
    end
end
```

Note: `orderable` enables UI controls to move items up and down but you still need to support it in your models, see [this](https://github.com/sferik/rails_admin/wiki/Orderable---Sortable-Has-Many-without-Through) for an example using `has_many` assocaition with Mongoid/MongoDB and [this](https://github.com/sferik/rails_admin/wiki/Has-many-%3Athrough-association) for an example using `has_many :through` and ActiveRecord.

gha_language: Ruby


text:
# tf-techknowday-workshop
TechKnowday Terraform workshop files

## Terraform Installation
1. Download Terraform from terroform.io

    For Mac,
      ```
      wget https://releases.hashicorp.com/terraform/0.11.11/terraform_0.11.11_darwin_amd64.zip -O /tmp/terraform.zip
      ```

      For Linux,
      ```
      wget https://releases.hashicorp.com/terraform/0.11.11/terraform_0.11.11_linux_amd64.zip -O /tmp/terraform.zip
      ```

2. Extract to a directory
    ```
    mkdir -p mkdir -p ${HOME}/terraform
    unzip /tmp/terraform.zip -d ${HOME}/terraform/
    ```

3. Set Classpath
    ```
    echo 'export PATH=${HOME}/terraform:${PATH}' >> ~/.bashrc
    source ~/.bashrc
    ```

## Configure AWS
Make sure to configure AWS credentials so that terraform can create/manage AWS resources.

Create/Open `~/.aws/credentials` file and make sure it has access key and secret access key
```
[demo]
region = us-west-2
output = json
aws_access_key_id = <YOUR AWS ACCESS KEY ID>
aws_secret_access_key = <YOUR AWS SECRET ACCESS KEY ID>
```

## Run Terraform
**Running these(Terraform) examples may incur charge in AWS account.**

1. Navigate to code directory (let's say `demo2/`)
2. Put one `tfvars` file under `env` directory for each environment. (Refer `example.tfvars` file)
2. Run `terraform init` to initialize terraform
3. Run `terraform plan -var-file=env/demo.tfvars` to see the plan (Let's say `demo.tfvars` is for `demo` environment)
4. If happy with the plan, run `terraform apply -var-file=env/demo.tfvars`
5. If want to **cleanup**(or **destroy** all resources created by this example terraform code), run `terraform destroy -var-file=env/demo.tfvars`

## Slides
[Terraform Workshop Slides](terraform_workshop.pdf)

repository: pradeepbhadani/tf-techknowday-workshop

repo_name: pradeepbhadani/tf-techknowday-workshop


text:
# Kubernetes CI/CD

WIP: Simple gated CI/CD Server to run on K8's Cluster typically in a hosted environment

## Architecture

Coming soon!

### Components

1. Server - Receive notifications on code changes, parse and trigger Pipeline
    * SCM - WebHook (GitHub/BitBucket Server)
    * SCM - Poll
    * Pipeline Parser
    * Conditional Driver (Push/Tag/Pull Request/GIT Diff/GIT Branch/File Exists/File Content)
    * Pipeline Execution (K8's Jobs)
    * Pipeline Execution monitoring
    * Data Store & Logger (configMaps or etcd-io bbolt in a persistance storage)
2. Server UI - User Interface to View/Admin Server
3. Authenticator - Authenticate and authorize users
    * RBAC
    * Dex
4. Secrets - Store Secrets as K8's secrets
5. API - API for server
6. CLI - CLI for server

repository: prabdeb/kubernetes-cicd

repo_name: prabdeb/kubernetes-cicd


text:
# xiDIA-library

Tool to generate a cross-linking spectral library for Spectronaut from Xi results.

### Note
This tool requires adaptation in the code regarding the location of the peak list data in order to function in a different environment than the Rappsilber lab:

To make it work:

use the get_annotation_json() function instead of get_annotation_xidb().

to create a valid json request use the provided create_json_annotation_request() with your data including the peak list.

### Requirements
Python 3

virtualenv

### Installation

Clone git repository to your machine:

```git clone https://github.com/Rappsilber-Laboratory/xiDIA-library.git```

cd into the repository:

```cd xiDIA-library```

Create python virtualenv:

```virtualenv -p python3 --no-site-packages python_env```

Activate virtualenv:

```source python_env/bin/activate```

Install dependencies:

```pip install -r requirements.txt```

### Required files
XiFDR PSM csv file(s)

all runs that are referenced in the XiFDR PSM files in mzML format

### Usage

Modify the config.py.example file, save it as config.py and then run create_spectronaut_lib.py

```
baseDir = "/path/to/your/directory/"    # Path to your working directory
psm_csv_path = baseDir + "psm_csv/"     # Path to subdirectory with your XiFDR psm csv files
mzml_path = baseDir + "mzml/"           # Path to subdirectory with your mzML files
output_path = baseDir + "out/"          # Path to subdirectory where the library output file will be saved

# iRT equation parameters
# y = m * x + t
# e.g. y= 0.6452 x + 47.469
iRT_m = 0.56                            # iRT equation slope value
iRT_t = 53.34                           # iRT equation y-intercept value

proteinId = "HSA"                       # protein name string
includeNeutralLossFragments = False     # set to True if you want to include neutral loss fragments
writeClSitesToModifiedSequence = True   # set to True to write the cross-linked sites to the ModifiedSequence column
clName = "bs3"                          # cross-linker name string

label_experiment = False                # set to True if you did an heavy-light isotope labeled experiment
clLightLabelName = "bs3-light"          # will be ignored if label_experiment is False
clHeavyLabelName = "bs3-heavy"          # will be ignored if label_experiment is False
deuteriumCount = 4                      # will be ignored if label_experiment is False

fragmentMzLowerLim = 100                # lower m/z limit for fragments
fragmentMzUpperLim = 1000               # upper m/z limit for fragments

# Total number of fragments can not exceed 20!
nClContainingFragments = 15             # maximum number of cross-linker containing fragments that will be included
nLinearFragments = 5                    # maximum number of linear fragments that will be included

```

repository: Rappsilber-Laboratory/xiDIA-library

gha_language: Python

repo_name: Rappsilber-Laboratory/xiDIA-library


text:
# Educational features
Ideas for general educational features to include in the game.

## Scaffolding
The game difficulty should scaffolding to increase the difficulty based on the user's ability.

Scaffolding options may include:
-  **Survival Mode**:
   -  Starts out easy and gets harder & harder.
   -  Users can set records for how long they survived.
   -  multiplayer?
      -  Teams vs one another?
      -  Allow lobbies with disproportionate teams.
-  **Self-Selection**:
   -  Users can select their own level of difficulty
-  **Track Progress**:
   -  Users create a profile and the game tracks their progress.
   -  Game will design custom challenges based on their ability.
   -  Initial profile _may_ consider a typing test to estimate their placement. This is done well by [typingclub](https://www.typingclub.com/sportal/program-3.placement). However, the placement test should be shorter. Can add initial high user variability (reference ELO ratings).

## Touch Typing
This game should include an option for users to practice their touch typing. There may be modes/tutorials to practice touch typing.

For instance, a mode to practice specific fingers.  [typingclub](https://www.typingclub.com/sportal/program-3.placement) contains practices for specific fingers that can be referenced.

*Note*: Should eventually be responsive to keyboard layout.

## Custom practices
This game should track user metrics and design customized practices.

**Metrics** may include:
- Input time, e.g., how long it takes a user to perform a specific stroke
- Number of times users misspell a word/what kind of misspelling it is.
  - will be computationally heavy
- Mean Time to Word Resolution since appeared on screen

*Note*: May only like to analyze user data from last X days, so referencing most recent data (like with Multiplication Medley).

**Customized practices** may include:
- words that users mess up the most frequently.
- common types of misspellings, e.g., i before e
- letters that users are slower to input
- words that are longer than mean word length typed


text:
---
title: "Beyblade Burst Evolution Tamil Dubbed Episodes Download For Free"
date: "2018-12-31"
---

Download Beyblade Burst Season 2 Tamil Episodes Free And Watch Beyblade Burst Evolution Tamil Dubbed HD Episodes In Tamil

**Newyear Special..! 2019**

[![](https://4.bp.blogspot.com/-Zukm65_fN8c/XCpiQ5GClHI/AAAAAAAABO0/53M93aedGnwWqu6Tw5EboGVZtJZWzFPgwCLcBGAs/s320/Bby{2bdbed38d32e7704a3eaa20af56e2289d0665505d01c3d892d71953ac3249a13}2BB{2bdbed38d32e7704a3eaa20af56e2289d0665505d01c3d892d71953ac3249a13}2BTamilKidz.jpg)](https://4.bp.blogspot.com/-Zukm65_fN8c/XCpiQ5GClHI/AAAAAAAABO0/53M93aedGnwWqu6Tw5EboGVZtJZWzFPgwCLcBGAs/s1600/Bby{2bdbed38d32e7704a3eaa20af56e2289d0665505d01c3d892d71953ac3249a13}2BB{2bdbed38d32e7704a3eaa20af56e2289d0665505d01c3d892d71953ac3249a13}2BTamilKidz.jpg)

Title : Beyblade Burst Evolution  2017

Season : Beyblade Burst S02

Audio : HQ Org Audio

Quality : HDRip 720p

Size : 130 – 150MB

Some Audios Provide : **[ToonWorld](https://www.toonworldtamil.blogspot.com/) \***

Encoder : TamilKidz

Beyblade Burst Evolution is the 2017 sequel to the anime television series Beyblade Burst. … They’re both excited to show off their Beys’ new abilities, but Valtryek and Roktavor aren’t the only ones to have

* * *

Episodes

**● [E01 : Fresh Start! Valtryek’s Evolution](https://clk.ink/IMlUssb9) \***

**● [E02 :](https://clk.ink/DkhRyM) [Fighting Spirit! Berserk Roktavor!](https://clk.ink/DkhRyM) \***

**● [E03 :](https://clk.ink/oDuN)** **[Drain Fafnir! Winding Up!](https://clk.ink/oDuN)** \*

● **[E04 : Whirlwind!Tempest Wyvron!](https://clk.ink/3JZD1Wk)** **New.!!** \[Aud-[Vishwasid](https://vishwasid2.blogspot.com/)\]

**● [E05 :](https://clk.ink/K8aYW1MK) [Drain Fafnir! Winding Up!](https://clk.ink/K8aYW1MK)**

● [**E06 : Squad Shake Up!**](https://clk.ink/ERVf04A)

● **[E07 : Journey to the Top!](https://clk.ink/zodWWajk)**
**● [E08 : Season Opener! European League!!](https://clk.ink/UiaGugDy)**

● **[E09 : Alter Cognite! The Shape Shifter!](https://clk.ink/j1CX)**

● **[E10 : Free To Launch](https://clk.ink/5puV)**

Post Your Comments…


text:
#Multiply color

##Description
Scale the RGB components of a color by a supplied factor.

##Inputs
###color
Color to be modulated.

###factor
Factor to scale the RGB components of the supplied color with.

##Outputs
###color
Output color: R * V, G * V, B * V, A

##Detail

repository: ericelliott/vizor

branch_name: refs/heads/develop

repo_name: ericelliott/vizor