The content below is taken from the original (Toyota’s new solid-state battery could make its way to cars by 2020), to continue reading please visit the site. Remember to respect the Author & Copyright.

Toyota is touting its progress on a new kind of battery technology, which uses a solid electrolyte instead of the conventional semi-liquid version used in today’s lithium-ion batteries. The car maker said that it’s near a breakthrough in production engineering that could help it put the new tech in production electric vehicles as early as 2020, according to the Wall Street Journal.

The improved battery technology would make it possible to create smaller, more lightweight lithium-ion batteries for use in EVs, that could also potentially boost the total charge capacity and result in longer-range vehicles.

Another improvement for this type of battery would be longer overall usable life, which would make it possible to both use the vehicles they’re installed in for longer, and add potential for product recycling and alternative post-vehicle life (some companies are already looking into putting EV batteries into use in home and commercial energy storage, for example).

Batteries remain a key limiting factor for electric vehicle design, because of how far tech companies focused on the problem have pushed existing science. The move to solid state would help make room for more gains in terms of charge capacity achieved in the footprint available in consumer vehicles, while helping to push further existing efficiencies achieved through things like the use of ultra-light materials in car frames and interiors.

Toyota isn’t saying yet where its batteries will end up, but any edge here is bound to be a big boon for automakers looking at a future that increasingly seems like it’ll be dominated by EVs.

Featured Image: TOSHIFUMI KITAMURA/AFP/Getty Images

The content below is taken from the original (New – GPU-Powered Streaming Instances for Amazon AppStream 2.0), to continue reading please visit the site. Remember to respect the Author & Copyright.

We launched Amazon AppStream 2.0 at re:Invent 2016. This application streaming service allows you to deliver Windows applications to a desktop browser.

AppStream 2.0 is fully managed and provides consistent, scalable performance by running applications on general purpose, compute optimized, and memory optimized streaming instances, with delivery via NICE DCV – a secure, high-fidelity streaming protocol. Our enterprise and public sector customers have started using AppStream 2.0 in place of legacy application streaming environments that are installed on-premises. They use AppStream 2.0 to deliver both commercial and line of business applications to a desktop browser. Our ISV customers are using AppStream 2.0 to move their applications to the cloud as-is, with no changes to their code. These customers focus on demos, workshops, and commercial SaaS subscriptions.

We are getting great feedback on AppStream 2.0 and have been adding new features very quickly (even by AWS standards). So far this year we have added an image builder, federated access via SAML 2.0, CloudWatch monitoring, Fleet Auto Scaling, Simple Network Setup, persistent storage for user files (backed by Amazon S3), support for VPC security groups, and built-in user management including web portals for users.

New GPU-Powered Streaming Instances
Many of our customers have told us that they want to use AppStream 2.0 to deliver specialized design, engineering, HPC, and media applications to their users. These applications are generally graphically intensive and are designed to run on expensive, high-end PCs in conjunction with a GPU (Graphics Processing Unit). Due to the hardware requirements of these applications, cost considerations have traditionally kept them out of situations where part-time or occasional access would otherwise make sense. Recently, another requirement has come to the forefront. These applications almost always need shared, read-write access to large amounts of sensitive data that is best stored, processed, and secured in the cloud. In order to meet the needs of these users and applications, we are launching two new types of streaming instances today:

Graphics Desktop – Based on the G2 instance type, Graphics Desktop instances are designed for desktop applications that use the CUDA, DirectX, or OpenGL for rendering. These instances are equipped with 15 GiB of memory and 8 vCPUs. You can select this instance family when you build an AppStream image or configure an AppStream fleet:

Graphics Pro – Based on the brand-new G3 instance type, Graphics Pro instances are designed for high-end, high-performance applications that can use the NVIDIA APIs and/or need access to large amounts of memory. These instances are available in three sizes, with 122 to 488 GiB of memory and 16 to 64 vCPUs. Again, you can select this instance family when you configure an AppStream fleet:

To learn more about how to launch, run, and scale a streaming application environment, read Scaling Your Desktop Application Streams with Amazon AppStream 2.0.

As I noted earlier, you can use either of these two instance types to build an AppStream image. This will allow you to test and fine tune your applications and to see the instances in action.

Streaming Instances in Action
We’ve been working with several customers during a private beta program for the new instance types. Here are a few stories (and some cool screen shots) to show you some of the applications that they are streaming via AppStream 2.0:

AVEVA is a world leading provider of engineering design and information management software solutions for the marine, power, plant, offshore and oil & gas industries. As part of their work on massive capital projects, their customers need to bring many groups of specialist engineers together to collaborate on the creation of digital assets. In order to support this requirement, AVEVA is building SaaS solutions that combine the streamed delivery of engineering applications with access to a scalable project data environment that is shared between engineers across the globe. The new instances will allow AVEVA to deliver their engineering design software in SaaS form while maximizing quality and performance. Here’s a screen shot of their Everything 3D app being streamed from AppStream:

Nissan, a Japanese multinational automobile manufacturer, trains its automotive specialists using 3D simulation software running on expensive graphics workstations. The training software, developed by The DiSti Corporation, allows its specialists to simulate maintenance processes by interacting with realistic 3D models of the vehicles they work on. AppStream 2.0’s new graphics capability now allows Nissan to deliver these training tools in real time, with up to date content, to a desktop browser running on low-cost commodity PCs. Their specialists can now interact with highly realistic renderings of a vehicle that allows them to train for and plan maintenance operations with higher efficiency.

Cornell University is an American private Ivy League and land-grant doctoral university located in Ithaca, New York. They deliver advanced 3D tools such as AutoDesk AutoCAD and Inventor to students and faculty to support their course work, teaching, and research. Until now, these tools could only be used on GPU-powered workstations in a lab or classroom. AppStream 2.0 allows them to deliver the applications to a web browser running on any desktop, where they run as if they were on a local workstation. Their users are no longer limited by available workstations in labs and classrooms, and can bring their own devices and have access to their course software. This increased flexibility also means that faculty members no longer need to take lab availability into account when they build course schedules. Here’s a copy of Autodesk Inventor Professional running on AppStream at Cornell:

Now Available
Both of the graphics streaming instance families are available in the US East (Northern Virginia), US West (Oregon), EU (Ireland), and Asia Pacific (Tokyo) Regions and you can start streaming from them today. Your applications must run in a Windows 2012 R2 environment, and can make use of DirectX, OpenGL, CUDA, OpenCL, and Vulkan.

With prices in the US East (Northern Virginia) Region starting at $0.50 per hour for Graphics Desktop instances and $2.05 per hour for Graphics Pro instances, you can now run your simulation, visualization, and HPC workloads in the AWS Cloud on an economical, pay-by-the-hour basis. You can also take advantage of fast, low-latency access to Amazon Elastic Compute Cloud (EC2), Amazon Simple Storage Service (S3), AWS Lambda, Amazon Redshift, and other AWS services to build processing workflows that handle pre- and post-processing of your data.

— Jeff;

The content below is taken from the original (Making the Small Business Case for Windows 10 S), to continue reading please visit the site. Remember to respect the Author & Copyright.

Chromebooks have proven popular with startups and small businesses, especially those that have invested in Google G Suite. With the release of Windows 10 S, business users can get most of the benefits of Chrome OS. They can also get the Office desktop apps if they have an Office 365 subscription. In this Ask the Admin, I will look at how Windows 10 S stacks up for businesses that are either already using Chromebooks, or are trying to decide between Windows 10 and Chrome OS.

Windows has always had one major problem in the small business space. It is difficult to secure and manage without full-time IT support. Because of that, Chromebooks have become popular. They are maintenance-free and perform reliably until the hardware starts to give up. However, Chrome OS is limited in ways Windows is not. For instance, Chromebooks requires the Internet. Essentially, Chrome OS is Google Chrome browser nicely bundled as an operating system.

Reliance on the Internet might not be a problem as some websites have an offline function. Google G Suite apps, such as Docs and Mail, support offline use. This allows users to create and edit documents, search and compose email, and edit photos that are stored locally. Microsoft Word Online cannot be used offline so that might restrict use of Office 365 on a Chromebook. Although, Office 365 Outlook does have an offline mode.

Windows 10 S was announced alongside the new Surface Laptop at an event in New York in May. While the initial focus is on the education sector, Windows 10 S notebooks will be available for everyone to buy. As a challenger to the dominance of Chromebooks in education, Windows 10 S limits users to installing apps from the Windows Store and Microsoft Edge is the only supported browser.

Windows 10 S for Business

Windows 10 S matters because the restricted environment ensures that users do not have administrative access to the operating system, cannot install legacy win32 apps that play outside of a Universal Windows Platform (UWP) app sandbox, and browsers cannot be installed that might introduce vulnerabilities. Windows Store apps are automatically updated as necessary, removing another potential security issue.

In short, if a Chromebook was previously a consideration for your business, Windows 10 S would also fit the bill. For a similar price, Windows 10 S does everything a Chromebook can do and more. But most importantly, Windows 10 S does not suffer from the same security and stability issues as unmanaged Windows 10 Pro. This is because of the restricted OS access and curated app experience. Additionally, Microsoft’s antimalware solution, Windows Defender, is included free out-of-the-box.

If you currently use Google G Suite with no plans to switch to Office 365, it is worth noting that there are no official Google apps in the Windows Store. That is not likely to change any time soon. This means that access to Google Drive in Windows 10 S is only possible via Microsoft Edge. There is an official Dropbox UWP app, although it does not provide offline synchronization. The OneDrive and OneDrive for Business synchronization client is built into Windows 10 S, so there is always access to Office 365 files locally.

Management Features

Windows 10 S can join an Azure Active Directory (AD) domain but not Windows Server AD. Azure AD is the directory service used by Office 365, so the ability to join Windows 10 S to Azure AD can make using the cloud easier with features such as single sign-on.

If you need to manage Windows 10 S based devices, Microsoft Intune Mobile Device Management (MDM) can be used to configure security settings and manage updates, albeit without the fine-grained control offered by Active Directory Group Policy.

At the end of the day, if you decide that Windows Store apps do not meet your needs, Windows 10 S can be upgraded to Pro free for a limited period and then for a one-time fee of $49.

Fall Creators Update

But that is not all. Google has been attempting to bring Android apps to Chrome OS for some time but that effort has been delayed. It is probably not as easy as it looks. However, Microsoft is already there and the Windows Store is not limited to just UWP apps either. Some legacy win32 apps can be downloaded from Windows Store, including the Microsoft Office suite of desktop programs. This gives Windows 10 S a significant advantage of Chrome OS.

The Windows 10 Fall Creators Update is set to make the experience better with some long overdue features and improvements to how Windows is deployed, including:

• Pin websites to the taskbar
• Support for Progressive Web Apps (PWAs) in Microsoft Edge
• On-Demand Sync for OneDrive and OneDrive for Business
• Support for ARM64
• Windows Autopilot for self-service deployment and device reset

Windows 10 S is a worthy alternative to Chrome OS, particularly as it is more capable for a similar price. There are few downsides though. Chrome OS has a more transparent update mechanism than Windows. According to Google’s Auto Update policy, most devices receive updates for around 5 years. Bear in mind that if you have hardware that is not plug and play, Windows 10 S is not for you. You would not be able to install the necessary drivers.

Windows 10 S notebooks will be available later this summer starting at $229.

Follow Russell on Twitter @smithrussell.

The post Making the Small Business Case for Windows 10 S appeared first on Petri.

The content below is taken from the original (Sandsifter checks your processor for secrets), to continue reading please visit the site. Remember to respect the Author & Copyright.

The content below is taken from the original (OneNote features you may not be using, but should be using!), to continue reading please visit the site. Remember to respect the Author & Copyright.

The content below is taken from the original (5 Wi-Fi analyzer and survey apps for Android), to continue reading please visit the site. Remember to respect the Author & Copyright.

The content below is taken from the original (Creating Portable HTML in PowerShell), to continue reading please visit the site. Remember to respect the Author & Copyright.

In a previous Petri.com article, we were exploring ways to do more with HTML in PowerShell. At the end, I showed you a finished file that used a path to a local copy of a CSS file. There is nothing wrong with this if the file will never leave your computer or when testing. To make the document portable, you can embed the style information directly into your HTML file.

To keep my code samples a bit easier to read, I am going to be working with the same data.

$data = Get-Eventlog -List | Select @{Name="Max(K)";Expression = {"{0:n0}" -f $_.MaximumKilobytes }},
@{Name="Retain";Expression = {$_.MinimumRetentionDays }},
OverFlowAction,@{Name="Entries";Expression = {"{0:n0}" -f $_.entries.count}},
@{Name="Log";Expression = {$_.LogDisplayname}}

I will pipe $data to ConvertTo-HTML. I am also going to start using a hashtable of parameter values to splat to ConvertTo-HTML.

$convertParams = @{
 Title = "Event Log Report"
 PreContent = "<H1>$($env:COMPUTERNAME)</H1>" 
 PostContent = "<H5><i>$(get-date)</i></H5>"
}

The style information goes in the html header. I will copy the code from my CSS file to a here string variable. Then, I will add the variable to the parameter hashtable, since I have already created it.

$head = @"
<style>
body { background-color:#E5E4E2;
       font-family:Monospace;
       font-size:10pt; }
td, th { border:0px solid black; 
         border-collapse:collapse;
         white-space:pre; }
th { color:white;
     background-color:black; }
table, tr, td, th { padding: 0px; margin: 0px ;white-space:pre; }
table { margin-left:25px; }
h2 {
 font-family:Tahoma;
 color:#6D7B8D;
}
.footer 
{ color:green; 
  margin-left:25px; 
  font-family:Tahoma;
  font-size:8pt;
}
</style>
"@

$convertParams.add("Head",$head)

Let’s try it out.

$data | convertto-html @convertParams | out-file d:\temp\a.htm

Using Embedded CSS (Image credit: Jeff Hicks)

Pretty good. Although, if you look closely, you will see that I have lost my report title. When you use a header, the -Title parameter is ignored. Let’s revise the header to insert the Title tag and try again.

$convertParams = @{ 
 PreContent = "<H1>$($env:COMPUTERNAME)</H1>" 
 PostContent = "<H5><i>$(get-date)</i></H5>"
 head = @"
 <Title>Event Log Report</Title>
<style>
body { background-color:#E5E4E2;
       font-family:Monospace;
       font-size:10pt; }
td, th { border:0px solid black; 
         border-collapse:collapse;
         white-space:pre; }
th { color:white;
     background-color:black; }
table, tr, td, th { padding: 0px; margin: 0px ;white-space:pre; }
table { margin-left:25px; }
h2 {
 font-family:Tahoma;
 color:#6D7B8D;
}
.footer 
{ color:green; 
  margin-left:25px; 
  font-family:Tahoma;
  font-size:8pt;
}
</style>
"@
}

$data | convertto-html @convertParams | out-file d:\temp\a.htm

Corrected Header with Title (Image credit: Jeff Hicks)

And while we are on the subject of style, here is a tip on how to get alternating bands. This is helpful for very long tables. Insert this code into your style sheet.

tr:nth-child(odd) {background-color: lightgray}

You can set the background-color value to any valid HTML color value. Another style trick is to set the table to fill more of the page and also to automatically resize when you resize the browser.

table { width:95%;margin-left:5px; margin-bottom:20px;}

Here is my final complete code:

$convertParams = @{ 
 PreContent = "<H1>$($env:COMPUTERNAME)</H1>" 
 PostContent = "<H5><i>$(get-date)</i></H5>"
 head = @"
 <Title>Event Log Report</Title>
<style>
body { background-color:#E5E4E2;
       font-family:Monospace;
       font-size:10pt; }
td, th { border:0px solid black; 
         border-collapse:collapse;
         white-space:pre; }
th { color:white;
     background-color:black; }
table, tr, td, th { padding: 2px; margin: 0px ;white-space:pre; }
tr:nth-child(odd) {background-color: lightgray}
table { width:95%;margin-left:5px; margin-bottom:20px;}
h2 {
 font-family:Tahoma;
 color:#6D7B8D;
}
.footer 
{ color:green; 
  margin-left:25px; 
  font-family:Tahoma;
  font-size:8pt;
}
</style>
"@
}

$data | convertto-html @convertParams | out-file d:\temp\a.htm

A Better Formatted Report (Image credit: Jeff Hicks)

This is a much nicer looking report and I hope you will try the code out for yourself to see this in action.

My sharp eyed readers may have noticed a section of the style sheet that defined a footer. However, the final result does not appear to be using it. How is that supposed to work? Or let’s say I want any event log with 0 entries to display in red. How can I do that? I will show you how in the next article.

The post Creating Portable HTML in PowerShell appeared first on Petri.

The content below is taken from the original (Motorcycle helmets finally get decent heads-up display navigation), to continue reading please visit the site. Remember to respect the Author & Copyright.

I’m a huge proponent of reducing any and all distractions while riding a motorcycle, scooter, or moped. Helmets and padded gear are great, but when you get down to it, riders are still just squishy people zipping through traffic next to giant machines that could kill you if a driver sneezes or decides to text a friend. So the idea of a HUD (Heads Up Display) for a motorcycle is equal parts intriguing and terrifying.

Done right, it keeps your head up and eyes off your gauges and whatever navigation system you have strapped to your handlebars. Done wrong, and it’s a one-way ticket to the emergency room because you were spending too much time going through menus and trying to find relevant information instead of paying attention to the car in front of you that just slammed on its brakes. A fender bender in a car is a annoyance. A fender bender on a bike could land you in the ICU.

In comes the $700 Nuviz, a HUD for full-face helmets. The device’s purpose is to keep you informed while riding without adding too much distraction that could lead to hospitalization. And for the most part, it succeeds.

It shows your speed, navigation, maps, calls and your music via a tiny mirrored see-thru display that sits below the vision-line of your right eye. It’s there when you need it and you can almost ignore it when you don’t.

To see the information about your ride, you peer downward at the display which is focused about 13.5 feet in front of you. That means you’re refocusing your eyes, but the same thing happens when you look at your gauge cluster. Fortunately, the main screen is tailored for quick glances. Your speed and next turn are easily discernible by quickly peeking downward without moving your head which is Nuviz’s advantage over the dials that came with your bike.

Plus, the Nuviz supports audio and comes with the headset that can be installed in a helmet or it’ll sync to Bluetooth-enabled helmets. It’s a bit of a multimedia experience right on your noggin.

My apprehension about the potential for distraction intensified when I installed it on my helmet. From the outside, it’s huge. And while its 8.5 ounce weight didn’t bother me, for some folks with lightweight helmets, that might be a deal breaker. But when I actually put on my helmet all I saw was the tiny display which was a relief.

Riding with the Nuviz also reduced my anxiety. With the combination or visual and audio cues, I was finally able to navigate to a destination without pulling over and checking my phone or attaching it to the mount I bought a few years back and have only used twice because I’m sure my iPhone will fall out of it and break into a thousand pieces on US 101.

The display was bright enough to be legible in direct sunlight, although there were some tiny rainbow-colored dots that appeared in the glass. It wasn’t enough to block the information, but it’s there and while beautiful at times, it’s just another thing you’ll catch yourself looking at.

Navigating the menu system was simple enough with the supplied controller you attach near your left handlebar. An up and down lever scrolls through the main features and it’s surrounded by four action buttons. After a few hours riding using it becomes as second nature as activating my turn signals, high beams or horn.

The controller is also how you turn on the device’s 8 megapixel camera. With it you can take video and photos of your ride. The quality won’t replace a GoPro, but the photos were good enough to capture deer in the brush next to the road. The 1080p video quality is reminiscent of a smartphone from five years ago. It’s basically satisfactory and really the allure is that you don’t have to stop and pull out a camera to capture a moment.

It also might lead to gigantic slideshows, I took 100 photos during a ride around Mount Tamalpais. It’s very easy to just tap the photo button on the controller while riding.

Yet those are the kind of rides the Nuviz is built for. Long excursions on roads without heavy traffic. It was only during that type of jaunt that I felt comfortable turning on music (something I would never do while riding in San Francisco) and taking photos. The companion app makes creating a route with multiple stops that you send to the device a breeze and the actual navigation both on screen and in ear, was easy to follow without being overly distracting.

The device and controller are both easy to remove and reattach to your bike and helmet so you don’t have to check your bike every five minutes during lunch breaks. That also means you can ditch the whole system when doing short rides around town. In my experience, the Nuviz didn’t add much value to my daily commute. I know where I’m going and the roads are for too congested to even think about using it.

Plus, when it’s attached to your helmet, it’s never 100 percent gone. The tiny display, while helpful, is still in your peripheral. You sort of learn to ignore it, but when you’re lane splitting (only legal in California) and keeping an eye out for one of San Francisco’s many bike-swallowing potholes, you don’t need another (no matter how small) distraction.

But for weekend jaunts, the Nuviz is outstanding. It’s eight hour battery life should keep you on your route for the entire day and it’s on-board GPS and downloaded maps means even if you lose signal, you won’t get lost. For Kawasaki KLR and BMW GS riders, it’s a great little companion. But for daily riders in congested cities, it’s best to focus on the act of riding.

The content below is taken from the original (Microsoft Azure leads the industry in ISO certifications), to continue reading please visit the site. Remember to respect the Author & Copyright.

The content below is taken from the original (Case study finds the drawbacks of Facebook’s ‘free’ internet), to continue reading please visit the site. Remember to respect the Author & Copyright.

Facebook’s successor to its Internet.org "web for all" service, Free Basics, has had a troubled rollout. India notoriously shut it out of the country back in February 2016 for violating net neutrality (prioritizing Facebook services), with Egypt blocking it months later over privacy concerns. Still, the social titan has deployed Free Basics’ free internet to 63 countries in Africa, Asia and Latin America — and wants to bring it to the United States soon. But a report released today criticizes the service’s shortcomings and claims its decision to allow access to some sites but not others violates net neutrality.

Citizen media nonprofit Global Voices summarized their 36-page paper with several key complaints. First, Free Basics does not adequately meet the linguistic needs where it operates, especially in its failure to operate in more than one language in multilingual countries like Pakistan and the Philippines. The thousand-odd sites supported by the service are mostly provided by corporations in the US and UK, leaving a huge gap of services relevant to local issues and needs. In short, it doesn’t connect users to the full internet — and even prevents them from accessing competing social media services — but continues to collect data on them.

It’s this prioritized access to some services, and continually pressuring users to sign up for Facebook’s app, that leads Global Voices to claim Free Basics violates net neutrality. The platform separates third party services into two tiers: Those that meet particular technical requirements that are difficult for low-resource organizations to fulfill (as well as route their traffic through Facebook’s servers) which are prominently presented, and those that don’t which are tucked away. Further, Free Basics pointedly doesn’t include email — or even Twitter — limited user ability to communicate online. Plus, Facebook is harvesting user behavior data the whole time.

This isn’t surprising criticism, given India’s resistance to these very practices — not just from Free Basics, but from every "zero-rating" service, as they’re known. But beyond the report’s broad complaints are specific statistics suggesting people aren’t even using Free Basics for its intended purpose as a primary internet connection. A survey of 8,000 Free Basics users by the Alliance for Affordable Internet found that only 12 percent had never been on the internet before. Furthermore, 35 percent use Free Basics as a supplementary service to regular data plans and public WiFi.

When reached for comment, Facebook rejected the sample size of the study as not representative of its many users.

"Our goal with Free Basics is to help more people experience the value and relevance of connectivity through an open and free platform," a Facebook spokesperson said. "The study released by Global Voices, and the subsequent article in the Guardian, include significant inaccuracies. The study, based on a small group of Global Voices contributors in only a handful of countries, does not reflect the experiences of the millions of people in more than 65 countries who have benefited from Free Basics."

Source: Global Voices

The content below is taken from the original (netstress (2.0.9686)), to continue reading please visit the site. Remember to respect the Author & Copyright.

NetStress – Network Benchmarking Tool For Wired and Wireless Networks

The content below is taken from the original (trid (2.24.20170722)), to continue reading please visit the site. Remember to respect the Author & Copyright.

TrID is an utility designed to identify file types from their binary signatures

The content below is taken from the original (Help keep your Google Cloud service account keys safe), to continue reading please visit the site. Remember to respect the Author & Copyright.

By Grace Mollison, Cloud Solutions Architect

Google Cloud Platform (GCP) offers robust service account key management capabilities to help ensure that only authorized and properly authenticated entities can access resources running on GCP.

If an application runs entirely on GCP, managing service account keys is easy — they never leave GCP, and GCP performs tasks like key rotation automatically. But many applications run on multiple environments — local developer laptops, on-premises databases and even environments running in other public clouds. In that case, keeping keys safe can be tricky.

Ensuring that account keys aren’t exposed as they move across multiple environments is paramount to maintaining application security. Read on to learn about best practices you can follow when managing keys in a given application environment.

Introducing the service account

When using an application to access Cloud Platform APIs, we recommend you use a service account, an identity whose credentials your application code can use to access other GCP services. You can access a service account from code running on GCP, in your on-premises environment or even another cloud.

If you’re running your code on GCP, setting up a service account is simple. In this example, we’ll use Google Compute Engine as the target compute environment.

• Create a service account
• Grant least-privilege permissions to the service account using IAM. For example, if your application only needs to access Google Cloud Storage, then grant the service account the roles/storage.admin role.

Now that you have a service account, you can launch instances to run from it. (Note: You can also temporarily stop an existing instance and restart it with an alternative service account).

• Next, install the client library for the language in which your application is written. (You can also use the SDK but the client libraries are the most straightforward and recommended approach.) With this, your application can use the service account credentials to authenticate applications running on the instance. You don’t need to download any keys because you are using a Compute Engine instance, and we automatically create and rotate the keys.

Protecting service account keys outside GCP

If your application is running outside GCP, follow the steps outlined above, but install the client library on the destination virtual or physical machine. When creating the service account, make sure that you’re following the principles of least-privilege. This is good practice in all cases, but it becomes even more important when you download credentials, as GCP no longer manages the key, increasing the risk of it being inadvertently exposed.

In addition, you’ll need to create a new key pair for the service account, and download the private key (which is not retained by Google). Note that with external keys, you’re responsible for security of the private key and other management operations such as key rotation.

Applications need to be able to use external keys to be authorized to call Google Cloud APIs. Using the Google API client libraries facilitates this. Google API client libraries use Application Default Credentials for a simple way to get authorization credentials when they’re called. When using an application outside of GCP, you can authenticate using the service account for which the key was generated by pointing the GOOGLE_APPLICATION_CREDENTIALS environment variable to the location where you downloaded the key.

Best practices when downloading service account keys

Now you have a key that can gain access to GCP resources, you need to ensure that you manage the key appropriately. The remainder of this post focuses on best practices to avoid exposing keys outside of their intended scope of use. Here are best practices to follow:

1. If you’ve downloaded the key for local development, make sure it’s not granted access to production resources.
2. Rotate keys using the following IAM Service Account API methods:
• ServiceAccounts.keys.create()
• Replace old key with new key
• ServiceAccounts.keys.delete()
3. Consider implementing a daily key rotation process and provide developers with a cloud storage bucket from which they can download the new key every day.
4. Audit service accounts and keys using either the serviceAccount.keys.list() method or the Logs Viewer page in the console.
5. Restrict who is granted the Service Account Actor and Service Account User role for a service account, as they will have full access to all the resources.
6. Always use the client libraries and the GOOGLE_APPLICATION_CREDENTIALS for local development.
7. Prevent developers from committing keys to external source code repositories.
8. And finally, regularly scan external repositories for keys and take remedial action if any are located.

Now let’s look at ways to implement some of these best practices.

Key rotation

Keyrotator is a simple CLI tool written in Python that you can use as is, or as the basis for a service account rotation process. Run it as a cron job on an admin instance, say, at midnight, and write the new key to Cloud Storage for developers to download in the morning.

It’s essential to control access to the Cloud Storage bucket that contains the keys. Here’s how:

1. Create a dedicated project setup for shared resources.
2. Create a bucket in the dedicated project; do NOT make it publicly accessible.
3. Create a group for the developers who need to download the new daily key.
4. Grant read access to the bucket using Cloud IAM by granting the storage.objectViewer role to your developer group for the project with the storage bucket.

If you wish to implement stronger controls, use the Google Cloud Key Management Service to manage secrets using Cloud Storage.

Prevent committing keys to external source code repositories

You should not need to keep any keys with your code, but accidents happen and keys may inadvertently get pushed out with your code.

One way to avoid this is not to use external repositories and put processes in place to prevent their use. GCP provides private git repositories for this use case.

You can also put in place preventive measures to stop keys from being committed to your git repo. One open-source tool you can use is git-secrets. This is configured as a git hook when installed

It runs automatically when you run the ‘git commit’ command.

You need to configure git-secrets to check for patterns that match service account keys. This is fairly straightforward to configure:

Here’s a service account private key when downloaded as a JSON file:

{
 "type": "service_account",
 "project_id": "your-project-id",
 "private_key_id": "randomsetofalphanumericcharacters",
 "private_key": "-----BEGIN PRIVATE KEY-----\thisiswhereyourprivatekeyis\n-----END PRIVATE KEY-----\n",
 "client_email": "[email protected]",
 "client_id": "numberhere",
 "auth_uri": "http://bit.ly/2vkRh07;,
 "token_uri": "http://bit.ly/2uK9ebm;,
 "auth_provider_x509_cert_url": "http://bit.ly/2vk9fzV;,
 "client_x509_cert_url": "http://bit.ly/2uK4iDI;
}

To locate any service account keys, look for patterns that match the key name such as ‘private_key_id’ and ‘private_key’. Then, to locate any service account files in the local git folder, add the following registered patterns:

git secrets --add 'private_key'
git secrets --add 'private_key_id'

Now, when you try to run ‘git commit’ and it detects the pattern, you’ll receive an error message and be unable to do the commit unless mitigating action is taken.

This screenshot shows a (now deleted) key to illustrate what developers see when they try to commit files that may contain private details.

Scan external repositories for keys

To supplement the use of git-secrets you can also run the open-source tool trufflehog. Trufflehog searches a repo’s history for secrets by using entropy analysis (it uses Shannon entropy) to find any keys that may have been uploaded.

Conclusion

In this post, we’ve shown you how to help secure service account keys, whether you’re using them to authenticate applications running exclusively on GCP, in your local environment or in other clouds. Follow these best practices to avoid accidentally revealing keys and to control who can access your application resources. To learn more about authentication and authorization on GCP, check out our Authentication Overview.

The content below is taken from the original (India’s first solar-powered train makes its debut), to continue reading please visit the site. Remember to respect the Author & Copyright.

India’s diesel-powered train network has a new kid on the block. The gas-guzzling Indian Railway system has just debuted its first solar-powered train, called the Diesel Electric Multiple Unit (DEMU). It will operate in the city of New Delhi.

Placement of the solar panels on the train car was challenging. Sandeep Gupta, Vice Chairman and Managing Director of Jakson Engineers Limited (the company that produced and installed the solar panels) told Business Standard, "It is not an easy task to fit solar panels on the roof of train coaches that run at a speed of 80 km per hour." The panels feed into an onboard battery that can store surplus power.

The train will still be pulled by a diesel locomotive; the solar panels will only power passenger comfort systems, such as lights, information displays and fans. Even so, Indian Railways estimates that just one train with six solar-panel equipped cars will save 21,000 liters (5,547 gallons) of diesel fuel per year, at a cost savings around Rs12 lakh (almost $20,000).

Indian Railways is the largest rail network in Asia, running around 11,000 trains daily. The service moves roughly 13 million passengers every day. That translates to incredibly large fuel bills; in 2015, the service spent Rs16,395 crore ($2.5 billion) on diesel. They’ve been trying to reduce their fuel consumption, in part by more reliance on solar energy; the hope is that it will save them Rs41,000 crore ($6.31 billion) over the next 10 years.

Via: Quartz

Source: Business Standard

The content below is taken from the original (List of Microsoft Apps available for Android), to continue reading please visit the site. Remember to respect the Author & Copyright.

The content below is taken from the original (Now you can get a bachelor’s degree in data center engineering), to continue reading please visit the site. Remember to respect the Author & Copyright.

In an era where all the hot tech jobs seem to focus on application development and cloud computing, it can be hard to find fresh data center engineering talent. The Institute of Technology in Sligo, Ireland, is trying to rewrite that story with a new Bachelors Degree in Data Center Facilities Engineering, starting this fall.

According to the school, “The purpose of this new engineering degree programme is to provide the Data Centre industry with staff who are qualified to provide the proficient and in-depth skills necessary for the technical management and operation of data centre facilities. Expert operation and maintenance of these facilities is crucial in order to maintain 24/7 services with optimum energy efficiency.”

Online classes, but you still have to go to Belgium

While the school may be in Ireland, the degree is offered online, in English, with lab sessions in Haute École Louvain en Hainaut (HELHa) in Mons, Belgium.  Students will have to show up there on specified days, which obviously tilts the program toward European students. Still, it provides a template that could be followed by schools around the world, creating cadres of new data center staff members without the need for intensive on-the-job training. 

Because the course was reportedly developed after 18 months of consultations with Google, Facebook and Microsoft, it’s not entirely clear to what extent the course will focus on traditional enterprise data center practices or if it will concentrate on the needs of the web giants. 

Creating a pool of entry-level workers?

But in an industry where technology graduates typically receive a more general education—perhaps bolstered with a short specialized course in data centers or other disciplines—the mere fact it exists also comes as a vote of confidence for careers in data center engineering. To be fair, there is a master’s program in data center engineering at SMU’s Lyle School of Engineering in Dallas, but that requires students to already have their B.S. in engineering or a related field. The IT Sligo course can be expected to turn out younger, presumably less expensive, data center workers who are better suited for entry-level positions.

IT Sligo President Dr. Brendan McCormack told Irish Tech News, “We are proud to be helping the data centres to address a specific skill need which several of the world’s leading tech companies recognise and value.”

Denis Browne, Google’s EU regional data center lead, added, “Google’s data centers are some of the best in the world, and we look for the best talent to work with us. Thanks to IT Sligo and HELha, this online course will increase the skills of people already working in the sector and for those who wish to work in the industry going forward.”

In four years or so, we’ll have a better idea of how it’s all working out.

Join the Network World communities on

Facebook

and

LinkedIn

to comment on topics that are top of mind.