Context
#
Learned in this study
#
Things to explore
#
Overview
#
AWS
#
AWS has the concept of groups, users, roles and policies.
Groups
#
A group is a list of users to which are assigned policies (permissions).
A useful feature they also provide is the Access Advisor, which allows administrators to observe when certain policies are being used and by which users.
To keep things simple, groups cannot be nested into other groups.
Users
#
Users represent an entity that has access to the AWS platform. They may access AWS either programmatically and/or through the console to administer the account.
During the using creation process, the creator has the ability to assign the user to a group, copy permissions from an existing user or attach policies to the user.
Upon creation of a user with programmatic access, the user is generally given an access key with its corresponding secret.
Roles
#
Roles are very similar to groups conceptually, but instead of being “persistent”, they are temporary. While you will generally assign one or many groups to a user, roles are not assigned to a user (or vice-versa, a user is not assigned one or many roles) but given based on certain criteria. A user takes a given role and only receives this role’s policies/permissions until he returns to his own identity.
Policies
#
A policy is a set of rules that determines the permissions given to a user, group or role. It has a name, description and a policy document, which describes the permissions.
The policy document is a JSON formatted object which contains a version and a list of statements. Each statement has an effect (Allow/Deny), a list of actions and a list of resources to which it applies.
You can learn more about 
AWS policies evaluation logic. Their IAM Policy Reference might also prove useful in understanding the various bits that compose the policy document.
Actions
#
Within AWS, each service has a unique lowercase identifier. Within each of these services, a list of actions exists, which can be granted (or denied) to an identity. Examples of actions are:
*: Allowed to use all actions under all servicess3:*: Allowed to use all actions under the s3 services3:GetObject: Allowed to use the GetObject action under the s3 service
Resources
#
Resources represent entities within their given service. For example, arn:aws:s3:::some-bucket/* represents the content under the some-bucket bucket in the s3 service.
Format : arn:$partition:$service:$region:$account-id:$resource
See also
#
References
#
Steps
#
- Build a list of task/items
List everything that you want to get out of your head. The goal here is to make explicit as much as possible.
- Deconstruct tasks into their pre-requisites and follow-up tasks
There are a couple of important things to consider when one wants to prioritize their task list. One is that even if a task is at the top of the list, it might not be possible to do it until its dependencies are fulfilled. This in turn means that all dependencies will have a superior priority to this task automatically.
However, it frequently happens that what we consider dependencies can in fact be delayed or temporarily replaced by another solution which takes less time to implement or costs less (or for whatever other reason can replace the original dependency).
- Split tasks into 2 groups (and repeat this process)
The idea here is to quickly filter out as many tasks as possible. As you may have noticed, I have not specified the filtering predicate. It is up to you to filter out your tasks such that you will have the least amount to filter at once. Examples of predicates you could use are “will/will not do”, “want/do not want”, “need/do not need”, “like/do not like” and so on.
- Prioritize the tasks that will have to be done
After a certain number of iterations of the previous step, you should arrive at a point where the items you have all need to be done, but you do not know in which order you have to do them (or want to do them).
Methods
#
4 Quadrants Method
#
This method, also known as the Eisenhower Matrix, involves categorizing tasks into four groups: Urgent/Important, Not Urgent/Important, Urgent/Not Important, and Not Urgent/Not Important. By sorting tasks this way, you can focus on what truly matters and avoid spending time on less critical activities.
Analytic Hierarchy Process
#
The Analytic Hierarchy Process (AHP) is a structured technique for organizing and analyzing complex decisions. It involves breaking down a problem into its components, comparing them pairwise, and assigning weights to determine the relative priority of each task.
Binary Search Tree
#
Using a binary search tree for prioritization means inserting tasks based on their priority value, allowing for efficient retrieval and reordering. This approach is useful for dynamically managing and updating a list of tasks as priorities change.
Planning Game
#
The Planning Game is a collaborative method often used in agile development, where stakeholders and team members estimate and prioritize tasks together. It encourages discussion, negotiation, and consensus to determine which tasks should be tackled first.
100-Point Method
#
In the 100-Point Method, each participant is given 100 points to distribute among a list of tasks or requirements according to their perceived importance. The tasks with the highest total points are prioritized, reflecting the collective preferences of the group.
Prioritizing reading
#
- What you feel like reading
- Reading dependencies
- ROI evaluation
References
#
- Karlsson, Joachim, Claes Wohlin, and Björn Regnell. “
An evaluation of methods for prioritizing software requirements.” Information and Software Technology 39.14 (1998): 939-947.
- Karlsson, Joachim, Stefan Olsson, and Kevin Ryan. “Improved practical support for large-scale requirements prioritising.” Requirements Engineering 2.1 (1997): 51-60.
- Ahl, Viggo. “An experimental comparison of five prioritization methods: investigating ease of use, accuracy and scalability.” (2005).
- Gill, Nasib Singh. “A Comparison among Various Techniques to Prioritize the Requirements.” International Journal of Computer Science and Management Studies (IJCSMS) www. ijcsms. com 1.12: 601-607.
http://www.gwern.net/Resorter
Context
#
Learned in this study
#
Things to explore
#
Overview
#
- Encapsulate the application within a .phar
- Use obfuscation (can only obfuscate variables inside function/methods as anything else must remain with the same name in order to allow for dynamically called methods (or simply do not support such code))
Requirements
#
- Must not make it easy to extract the original source code
- Must checksum itself for modification
- Should prevent usage by sharing a single license (TBD?)
- Should not be possible to reuse a trial forever in a VM
Issues
#
- Relying on opcode (to act as a binary) probably implies you are dependent on the php version used. Furthermore, it also means that the extension must be available and enabled for the code to work
- Given the current implementation of opcache, the cache cannot be reused on other machines as it contains the system ID as part of an opcache file header
PHP OPCache
#
Header
#
-
OPCACHE
-
System ID
-
Timestamp
-
Checksum
-> zend_accel_load_script (persistent_script, from_memory)
Obfuscation
#
- Replace classes methods with (generated) traits that contain one or many of the classes method
- Compression/optimization by creating variables
Issues
#
- Even with obfuscation, PSR0/4 based code is too easy to distinguish (no reason to obfuscate libraries)
Ideas
#
- Find some way to transform the original source such that it is in symbiosis with a client identifier (and thus cannot be removed)
Packaging
#
- Replace variables within functions with obfuscated names
- Concatenate all files into a single file (or bundle of files)
- Pre-process require/include, or do not allow their use (as the files will not be available)
- Randomize file order
- Scramble method order
- Inject junk code
- Insert junk code with encrypted user identification
- Generate a differently scrambled version per download/user
See also
#
References
#
Obfuscation
#
Context
#
Learned in this study
#
Things to explore
#
Overview
#
- Encapsulate the application within a .phar
- Use obfuscation (can only obfuscate variables inside function/methods as anything else must remain with the same name in order to allow for dynamically called methods (or simply do not support such code))
Requirements
#
- Must not make it easy to extract the original source code
- Must checksum itself for modification
- Should prevent usage by sharing a single license (TBD?)
- Should not be possible to reuse a trial forever in a VM
Issues
#
- Relying on opcode (to act as a binary) probably implies you are dependent on the php version used. Furthermore, it also means that the extension must be available and enabled for the code to work
- Given the current implementation of opcache, the cache cannot be reused on other machines as it contains the system ID as part of an opcache file header
PHP OPCache
#
Header
#
-
OPCACHE
-
System ID
-
Timestamp
-
Checksum
-> zend_accel_load_script (persistent_script, from_memory)
Obfuscation
#
- Replace classes methods with (generated) traits that contain one or many of the classes method
- Compression/optimization by creating variables
Issues
#
- Even with obfuscation, PSR0/4 based code is too easy to distinguish (no reason to obfuscate libraries)
Ideas
#
- Find some way to transform the original source such that it is in symbiose with a client identifier (and thus cannot be removed)
- Obfuscate php built-in functions
- Zend Host ID limited deployment: It appears that Zend Guard allows the software to be limited to run on only specific “Zend Host” (what are those?)
- Zend Guard Loader is a custom extension? for PHP which requires a licence_path to work
Packaging
#
- Replace variables within functions with obfuscated names
- Concatenate all files into a single file (or bundle of files)
- Pre-process require/include, or do not allow their use (as the files will not be available)
- Randomize file order
- Scramble method order
- Inject junk code
- Insert junk code with encrypted user identification
- Generate a differently scrambled version per download/user
See also
#
References
#
I am currently looking into javascript based libraries that will allow me to do in-browser queries, similar to how a server-side application would query a NoSQL database.
In order to pick the most appropriate database for my project, I first search for available solutions online. Then, I build a comparison table like the one below in order to determine the most popular database and its current health.
https://www.amazon.ca/XCSOURCE-20X-800X-Microscope-Endoscope-Magnifier/dp/B00N4K22OA/