Pros/Cons of internal pentest department vs external pentesters

Question: What are the advantages and disadvantages of having an internal pentest department in a large company compared to external service providers?
Comment: 3rd party pentesters have zero office politics to worry about, and are less likely to be friends with developers and environment admins.
Comment: Yeah, you'll want to go with 3rd party. Your company would have to be MASSIVE to hire your own full-time pentesters, unless security is absolutely imperative. In that case, you'll have your important machines air-gapped, so you won't have much to worry about.
Comment: I think a lot of companies would prefer to hire a skilled pentester,  but this is just not possible. Pentesting firms and silicon valley eats up the top talent.  You'll be lucky to find someone who can hack their way out of a paper bag.
Comment: Don't forget about the level of pen-testing you're trying to accomplish. Most "pen-testing" that organizations are looking at revolve around meeting compliance standards, which from experience is nothing more than vulnerability scanning and remediation. I also feel internal testing teams are asked really for application testing, and not necessarily a full test.
Answer: The most-effective use of a security professional who has penetration-testing skills is to host cyber exercises. Some are referring to this as purple teaming or adversary simulation. Each approach will be unique to an organization or set of organizations -- and have their own advantages and disadvantages.
Rafael Mudge recently spoke at the SANS Pen Test Hackfest on [PDF - Hacking to Get Caught - PDF], based on his original material from a blog post on adversary simulation.
I don't think it matters if you hire externally or internally for this sort of work -- the benefits of hiring someone internally have historically been discouraged because the individual would "likely become bored", "become predictable", and become less effective because his or her knowledge of the environment would prevent seeing things from a new or fresh perspective. However, with cyber exercises proving their value in Security Operation Centers, fusion centers based on cyber threat intelligence, and internal red teams -- the value of having in-house penetration skills is rapidly rising.
There are a few resources I'd like to point you towards in order to fully comprehend the tradtional and non-traditional approaches to penetration testing resourcing. Two books, one: "CISO's Guide to Penetration Testing: A Framework to Plan, Manage, and Maximize Benefits", and the other, "Effective Penetration Testing" by Kevin Pescatello and Matthew Larsen. In the former book, chapter 5 covers four types of tests: parallel shared, parallel isolated, series shared, and series isolated. Each of these test approaches include two types of outside penetration testers as well as one internal type -- blending a mix and balance of requirements and needs.
Lastly, I'd like to note that penetration testing is an emerging and changing field with a variety of expertise coming from many unorthodox approaches and a myriad of backgrounds. Having been introduced to US national intelligence, national security, and military TTPs such as wargaming, OPFOR, red teaming analysis (RTA), game theory, simulation, warning intelligence, S&TI, TECHINT, all-source intelligence, counterintelligence, MILDEC, counter denial, counter deception, analytical frameworks, and the fusion center model -- I have concluded that the penetration testing industry is due for a total rewrite. These antiquated third-party assessments that produce reports have always been laughable when compared to warfighting, so it is precedent that we embrace change, particularly due to this 2014 cyber war and the total cyber risk situation we are facing as a global economy or in the geopolitical space.
Comment: I think this answer is good, and I'd add that having in-house testing gives you the advantage of having in-house knowledge.  As Atdre points out, having a nice report with the results of the pen test are of limited value.  Having people inside your organization that work with your developers to improve security, and perform pen tests as well as other assessments is far more valuable IMO.
Comment: Having an appsec-focused approach to testing and remediation has been considered operational excellence for many years now. However, I believe even appsec is due for a refresh -- this foreknowledge comes from my introduction to the finer points of the FAIR model (or well, any sufficiently analytical-based risk model). The main problem  for appsec is integration into a cyber risk platform. The shift used to be a greater need for sec-focused appdevs but it is quickly moving to the opposite: tech, analyst, or managers must understand the threats and targets as deeply as possible.


Development team budget for training and social activities

Question: I am trying to understand if our team budget is aligned with the outside world,
This is the closest sub forum out there...
 For a big company (500+ employees)
 What is the budget for 5-10 developers for social activities and educational activities
Thank you!
Answer: I am going to ignore internal on the job training, mentoring, etc.
Training budgets are important; it's allows for your employees to be better equipped to do their job, and gives the employer more bang for the buck - in that with proper training you can get junior developers up to more senior levels of expertise. General expenses include;

Monthly subscriptions to online training like pluralsite; $100/month/dev
Quartlery Conferances; $1000/quarter/dev
Serious training and certicatation courses: $2500/year/dev

Activities are important not just for moral, but breaking out of the day to day grind that can become a burden to both managers and staff;

Quarterly team building; $200/quarter/month/dev
Weekly drinks, coffeess, lunches etc; $200/week/per team

Things to keep in mind is that in the budgeting world this is part of the overall employment package - I've had to work with budgets where the previous manager had used the entire budget for salaries - getting more budget was hard.
And although I am all for higher salaries, having a good work culture, and ongoing training is important. Make sure your team is aware at how their entire employment package is structured, point out the impact of training on their careers. Sometimes it's a salary/benefits balance and this needs to be comminicated.


Can anybody give me a simple guide to leveling up a character?

Question: I made a post recently about Lost Mines of Phandelver (5e), and it's safe to say I'm less experienced than a beginner.
The characters are level 2 and I looked up how to level up, but since then I've watched some videos and there seems to be a lot of different things being done in every video, in a different way.
When we leveled up we rolled for max hit point increases, found out the level 2 attributes and passives, and the wizard got 2 extra spells (also his magic missile gained an extra missile).
Is there anything I have missed? If so, can you please give me a simple step by step on what I need to do when leveling. The adventurers are almost level 3 so I was looking for a heads up for tonights session.
We have the base 4 classes - Fighter, Cleric, Rogue, Wizard
Comment: Answerers should keep in mind that Lost Mine of Phandelver is an adventure inside the Starter Kit. It may be helpful to tailor advice and page numbers to the Rules booklet it comes with, and give directions to rules beyond the booklet with that context in mind.
Comment: How did your wizard gain an additional projectile into his magic missile? That only happens if you cast the spell using a higher level spell slot.
Comment: When checking level up video's, make sure they are for the proper version of D&D. "Gains an extra magic missile" sounds like a 3rd edition video.
Comment: I think this is a perfectly valid question. Previous editions had step-by-step guides for leveling up in the PHB (3.5E, p58; 4E p27) but for whatever reason, the 5E PHB doesn't.
Answer: First, you gain hit dice (and a corresponding increase in maximum hit points).
This is described for each class briefly under Class Features, and explained on page 15 of the PHB (or here in the free Basic Rules):

Each time you gain a level, you gain 1 additional Hit Die. Roll that Hit Die, add your Constitution modifier to the roll, and add the total to your hit point maximum. Alternatively, you can use the fixed value shown in your class entry, which is the average result of the die roll (rounded up).

Almost everything else is shown on the table in each class description.
For example, page 71 for the fighter or page 113 for the wizard.  You can see the charts for the basic classes online for free as part of the Basic Rules — for example, the Cleric Table.
As you go up in level, if a value  goes up on the table, use the new value. (The plusses are not cumulative.) All classes have a proficiency bonus which works this way. When you increase this value, of course, also increase all the places on the sheet like trained skill checks which depend on it. Other examples of values which increase on the chart are the number of cantrips known, the monk's Unarmored Movement, the sorcerer's Spells Known, or the barbarian's Rage Damage.
And, if you get new spells slots, they'll be shown there too.
Then, look in the "Features" column. Anything there will be described in the corresponding description later in the section on that class. In general, when these class features improve at higher levels, there will be a note on the table. For example, Druid has "Wild Shape" at level 2 and "Wild Shape Improvement" at level 4.
Some features have per-level scaling not mentioned in the chart.
For example, the number of distinct spells a wizard can prepare per day (which is separate from spell slots) is equal to Intelligence modifier plus wizard level — but note that this isn't really something you need to know when leveling up per se. It's something to know when preparing spells. A Moon Circle druid's limit on creature CR is similar: at 6th level, this becomes druid level divided by 3. You don't need to know this when you level up, just when you shift into beast form — but of course it's good to have this in mind so you can be prepared at the table.
Other increases do basically happen at level-up time. For example,

Each time you gain a wizard level, you can add two wizard spells of your choice to your spellbook for free.

So, really there's no help for it but to be aware of which of your class-features are level-based. Most features which have something level-dependent not on the chart also have an additional complication. For example, wizards can add spells as above, but also in other ways, so just having the chart show number of spells known wouldn't work for wizards the way it does for sorcerers and bards.
The good news is that there's not really a lot of these, and the ones that exist tend to be core to the way your character works at the table (like, wizards and spellbooks or moon druids and shapeshifting) so they're relatively easy to remember. And they are all described in the appropriate class features section, not scattered randomly throughout the rules.
A tip: mark these in some way on your character sheet (with a ⛤, for example). That way, you don't have to scan through all of the features every time.
Some racial traits get better.
This is also just something you'll need to look out for. Usually, it's when you have the ability to cast spells — you may get more at higher level. In other cases, damage increases.
In the Player's Handbook, this only applies to the Drow Elf subrace (spells), Dragonborn (breath attack), and Tieflings (spells). Oh, and Hill Dwarf gets an additional hit point per level.
As with class features, marking features which scale with some symbol you'll remember on your character sheet might help.
Damage from most attack cantrips goes up at certain points.
These are "level 0" spells — they don't use spell slots or preparation and if known can be cast at will. Most damaging cantrips increase in power at 5th, 11th, and 17th character level. This is noted in the spell description, not on the class chart, because it scales with character level not class level (which may differ if you multiclass — see below). If you have cantrips written on your character sheet as attacks, this is good to be aware of when you level up.
It's also important to realize that other spells don't do this. Some spells note that they can be cast using a higher-level spell slot and give what the effect of casting in that way would be. For example, Magic Missile says:

At Higher Levels. When you cast this spell using a spell slot of 2nd level or higher, the spell creates one more dart for each slot level above 1st.

I can see how it'd be easy to interpret this as meaning "2nd character level", but D&D uses "level" to refer to different things (in 5E, character level, class level, and spell level are all distinct). Here it refers to spell level — Magic Missile is a first-level spell, but if you cast it using a higher-level slot, you can create more darts. From the class chart, you can see that wizards gain 2nd-level spell slots at 3rd class level. A 3rd-level wizard has two 2nd-level slots and four 1st-level slots, and so could cast magic missile six times, with two of those times gaining an extra dart.
In general, except for cantrips, spell damage (or number of targets, or etc.) does not increase as you level up. Instead, you gain higher-level slots, which you can use to cast some spells with greater effect.
Pretty much nothing else changes.
D&D 5E uses a concept of "bounded accuracy", which means that few things scale just for the sake of going up as you level. You mention "level 2 attributes and passives". This isn't a thing. At 2nd level, your attributes stay as you chose originally (unless of course the DM lets you rebuild; in Adventurer's League you can rearrange things at will up through level 4).
Ability scores only increase as part of the "Ability Score Improvement" class feature (or through Feats which grant increases). When you do get to the point where you increase an ability score to the point where the modifier changes, saves and skill modifiers (including passive checks) should be adjusted to match — but this is technically part of the Ability Score Improvement class feature, not of leveling alone.
Multiclassing...
If you are multiclassing — mixing and matching between different classes as you level — special rules apply. (See Multiclassing in the Basic Rules.)
If you are using the Starter Set...
In this case, the included rules don't include a generalized guide to classes or leveling up. Instead, on the second page of each character sheet, there is a section called Gaining Levels which tells you exactly what increases for each sample character at each new level. Do exactly what it says, and no more. These character sheets cover everything you need to know up through 5th level, but not beyond. For example, since the proficiency bonus increases at 5th and 9th level in the standard rules, the example sheets note this as increasing at level 5.
This is all fine, but I highly recommend at least adding the Basic Rules, downloadable from Wizards of the Coast for free, or available online (ad-supported free) as part of D&D Beyond. This will help you better understand what's going on, and give you more options. (And, for that matter, the PHB costs less than a gaming group all going out to a movie one night, and lasts a lot longer.)
Answer: Leveling up:
Proficiency Bonus
It stays at +2 when reaching lvl3, but will become +3 when reaching lvl5.
Class Feature

When your character gains a level, his or her class often grants additional features, as detailed in the class description.

The characters gain the class feature (if any) of their new level. So, when your players will reach lvl3:

Fighter: The Fighter has to choose a Martial Archetype (Champion, Battle Master, Eldritch Knight...)
Cleric: The Cleric doesn't learn more spells (they already know them all). They can prepare 3+bonus(\$WIS\$) spells (of lvl 1 or 2), and they have now 4 lvl1 spells slots and 2 lvl2 spell slots to cast them.
Rogue: The Rogue has to choose a Roguish Archetype (Thief...)
Wizard: The Wizard learn 2 new spells (of lvl 1 or 2) and add them to their spellbook. They can prepare 3+bonus(\$INT\$) spells (of lvl 1 or 2), and they have now 4 lvl1 spells slots and 2 lvl2 spell slots to cast them.

max HP increase
As you did, each player roll a dice for their character, depending of the class they took for this level (e.g. d8 for a Rogue), and add their \$CON\$ bonus. Note that:

You don't have to roll the dice, you can instead use the fixed value shown in your class entry, which is the average result of the die roll rounded up (e.g. 4.5 \$\to\$ 5 for a Rogue).
If their \$CON\$ has increased (e.g. with the Class Feature Ability Score Improvement), the effect is retroactive!

For example: your 7th-level fighter has a Constitution score of 17; when he reaches 8th level, he increases his Constitution score from 17 to 18, thus increasing his Constitution modifier from +3 to +4. His hit point maximum then increases by 8.
Comment: Shouldnt on the wizard and cleric specific level ups be made clear that the bonus they get from their casting stat is the amount prepared, not the amount casted?
Comment: Yes, I think it's better if you make the clear distinction between spells _known_, spells that can be _prepared_, and _spell slots available_. These are three concepts that can be confused by some newer players.
Answer: Step by step levelling up of a D&D 5e character.
Recording the consequences of each step on your character sheet:

decide what class your character is levelling up in (you may already have or want a multiclassed character)
if the class is a new class for the character refer to the Multiclassing rules (PHB p.163) to determine if your character has the prerequisite ability scores and what new proficiencies, if any, it gains

if it does not have the prerequisites then choose a new class to level up in

find the class table and description in the PHB, or other reference, to refer to
roll the correct hit die for the class, or use the fixed value if your DM allows, to increase hit point total (add the roll or fixed value plus your con bonus to the current hit point total)
refer to the class table to see if your character's proficiency bonus has changed

if it has, update all proficient saves, skills and attack bonuses with the new value

Refer to the class and subclass tables for any new class features and record them and/or their effects

if the character is multiclassed check the Multiclassing rules on Class Features (PHB p.164) to see what effects, if any, the new class level has on existing features from any other classes

if the class is a spell casting class:

check the class and subclass tables, and class description, to see if your character gains any new cantrips or spells

if it does select the cantrip/spell(s) from the spell list for your class

if the class allows for swapping a spell on gaining a level, choose a spell to remove and choose a spell to replace it with from the class spell list
if the character has only a single spell casting class refer to the class table to determine what spell slots the character now has
if the character has more than one spell casting class use the rules on multi-classed characters (PHB p.164) to calculate the total spell casting level of your character and refer to the multiclass spellcaster table (PHB p.164) to determine what spell slots the character now has

update the characters class(es) and level(s)

There are too many possibilities, especially going from level 2 to level 3 where many classes gain a subclass (e.g. fighter can choose champion, battlemaster or eldritch knight) to list all the details. You just need to be careful to read both the class table and the class description for the effects of new features.
Answer: The simplest I can come up with is:
As the you level - you decide if you roll HP or take average (a 5e option). After which each individual class goes into his specific table and spots what happens at the level he gained. That includes archetype.
Pending on some races, you may gain a new power on certain levels. In which case you need to look up your race again.
What makes this not simple is that each class with an archetype does different things for each level. Some gain 2 spells, other gain 1 and can reselect a previous one selected. Some gain sneak attack damage. Some gain a feat/attrib boost. Some gain access to more spells pending their religion.


Does accessing Wordpress via REST API affect the site stats and analytics?

Question: I made a few iOS Apps that access Wordpress blogs via WP REST API and I'm wondering if the calls I'm making register in the site stats in the dashboard.
If I call the root posts endpoint to get the latest posts does it register as a page view? And if I call a posts/$postId endpoint does it register as a page view as well?
Thanks!
Answer: This will depend on the type of plugin you use for counting page hits. In general stats are being counted on front end, either by inserting some image or JS which generates a server hit on the stats server that will be counted (google analytics, wordpress.com stats) or by counting the hit and storing it in the wordpress DB when the front end page is actually being generated.
The Rest API do not have easy means to add tracking JS and images, and do not follow the front end page generation code flow, so the answer to your question is 99.9% it will not be counted. Counting those types of requests will require some different strategy than the current plugins employ, but what is true for now might change in the future, although I assume that such tracking code will have different tracking for front page tracking and API tracking.


Ubuntu on Chromebook

Question: So, I recently bought a Toshiba Chromebook 2 and have I've tried everything to wipe Chrome Os off the SSD or to "Legacy Dual Boot" to run a full blown Linux Distro. So in my efforts to get a full Linux Distro I created a partition which I have no idea how to get rid of. So, if anyone knows how to delete the partition or how to install a full OS I would love some input.
Thanks
Comment: To replace ChromeOS with Linux you need to enable SEA-BIOS in coreboot. As far as I know, this is not yet possible in Toshiba Chromebook 2.  Your best course of action may be to reinstall the ChromeOS. This probably will delete any extra partitions you have created.
Answer: user68186 is right you need to flash your chromebook with a modified bios. Thanks to John's hard work you can now download it from his website.
The main steps are:

Enable developer mode on your chromebook
Disable write-protect so that you can write to the BIOS
Flash the BIOS with the modified version downloaded from John's site
Boot your chromebook from a live Ubuntu USB drive and
install in the normal way (it's a good idea to wipe all the chrome OS
partitions).

If you need a step by step process for this, see my post on wiping Chrome OS and installing Ubuntu.

Ubuntu on Chromebook


How small is the negligible advantage for DDH?

Question: The well known Decisional Diffie Hellman assumption (DDH) assert that for any $n = \log q$ and generator $g$ of $\mathbb{Z}_q$, for uniformly i.i.d $A, B, C \sim U(\mathbb{Z}_q)$, the following are indistinguishable for any PPT $M$: $g^A, g^B, g^C$ vs. $g^A, g^B, g^{AB}$. That is, up to negligible advantage:
$$\epsilon = \left|  \Pr[M(g^A, g^B, g^C) = 1] - \Pr [M(g^A, g^B, g^{AB}) = 1 \right| \leq 1/\omega(n) $$
I'm interested however how small the error can be taken? That is, is there any distinguisher for the extremely small $\epsilon = 2^{-O(n)}$? Is it known how ``negligible'' should $\epsilon$ be?
Comment: I think $\epsilon$ should be a function of $q$, not $n$, and therefore you need to specify a connection between $q$ and $n$ for this question to have an answer.
Comment: Thanks, I meant that $n = \log q$
Answer: Negligible has a precise meaning in cryptography. It is really defined in terms of growth (or rather, decay), for example, with respect to the security parameter.
A function $\mu$ is negligible if it grows slower (or decays faster) than 1 over any polynomial function. Specifically, for any polynomial $\mathsf{poly}$, for some constant $N$, then for all $x \geq N$, we have:
$$|\mu(x)| < \frac{1}{\mathsf{poly}(x)}.$$
An example of a negligible function is $\mu(x) = 2^{-x}$. This is because for any polynomial, we can always find an $N$ such that the previous inequality holds, since the decay is exponential. For example, using the polynomial $x^3$, the inequality doesn't hold at $x = 2$ (since $1/4 > 1/8$), $x = 3$ (since $1/8 > 1/27$), and so on. But when $x \geq 10$, then the inequality does hold (e.g. $2^{-10} < 1/10^3$). So in this specific eaxmple, we'd set $N = 10$.
In the specific example of DDH, suppose $M$ spends a polynomial amount of time computing random DDH triples itself, ($g^a,g^b,g^{ab}$). Then there is some tiny probability that the DDH challenge it is given was one that it computed, so it would win slightly more than $1/2$ the time (it wins half the time from a uniformly random guess). However, this advantage is negligible in the technical sense, because as $M$ is PPT, it can only compute polynomially many tuples, but the number of possible tuples grows exponentially with the security parameter. Therefore the advantage looks something like $\textsf{poly}(\kappa)/2^{\kappa}$, which is negligible in the formal sense above.
Comment: I agree that with the specific machine $M$ you mentioned, that simply guesses elements, has $1/2^{O(n)}$ advantage. Nevertheless, there might be other PPTs that do something different, and able to gain better advantage, say, $1/n^{\log n}$, which is still negligible. My question concerns more how much negligible the advantage can be: $n^{-\log \log n}, n^{-\log n}, 2^{-O(n)}$?
Comment: Theoretically, any of those things could exist, the security assumption says nothing about it. We just draw the line at "negligible" and leave it there.
Comment: I agree that all of those error are theoretically possible, but practically -- are you aware for example about a distinguisher with advantage $n^{-\log \log n}$?
Comment: No, I'm not aware off the top of my head. It sounds like it would be a weird algorithm.


Should the tag excerpt be included in the body as well?

Question: Most tag wikis (e.g. C#) repeat the excerpt in the body. This seems a bit repetitive when viewing the tag wiki page. Is it OK to edit the excerpt out of the body or is there some reason to leave it in?
Comment: Part of this is an age thing. There wasn't originally an excerpt, but then it got added and cloned the data from the original body. So a lot of old wikis will have this behavior. I think that's a consequence of that, moreso than an accepted style, and more users are just too lazy to come up with better stuff and are content to leave it. Also, a related request regarding excerpts and being displayed in the full wiki: http://meta.stackexchange.com/questions/63192/can-we-have-an-option-to-hide-the-excerpt-from-the-full-tag-wiki-entry
Comment: Related is when you have said everything in the excerpt and there is not much extra to say in the body. And if you just have a couple of minor additions for the body you might not reach the minimum body size unless you do put all the text from the excerpt there as well. What to do in this case?
Answer: As the tag wiki is displayed separately from the excerpt, the information in the excerpt should also appear in the tag wiki body. For example, on the <code>/tags/NAME/info</code> page, the excerpt is not shown; if the first sentence of the body assumes continuity with the excerpt, it will be incomprehensible.
This doesn't mean that the first paragraph of the body should repeat the excerpt verbatim; most of the time that is a bad idea. The excerpt needs to be short and to the point and cannot use any markup. The body can give more information and present it better.
Comment: +1 for "if the first sentence of the body assumes continuity with the excerpt, it will be incomprehensible."  This happens on the `questions/tagged/NAME` pages too.
Comment: I think the except should always be shown when the main text is displayed. This eliminates all confusion. As the except normally contains the definition, the text without it may look very incomplete.
Answer: Feel free to edit the tag wiki excerpt to boil down the essence of the tag and its concepts. Go for 120 characters or less if you want to.
Most of the excerpts you see are holdovers from when people were plugging away into the body but left little thought as to what to put in the excerpt of the tag.
There is no need to repeat yourself.
Answer: To add to what reported in the other answers, the excerpts are now shown when a user adds a tag to a question.

The excerpts should report information that is immediately visible to who is adding the tag to a question, for example something similar to the following text:

Consider using [tag name] when the question is about [topic].

Such text doesn't needs to be repeated in the tag wiki, as that text is already read when a user adds the tag to a question, and that is the only moment that text is relevant.
Before, the excerpt was only visible in the page showing all the tags used in a site; it was not the text shown to who was adding a tag. It was only a short version of the tag wiki that was shown in a space where the full tag wiki would not have been visible.


Modular Arithmetic

Question: I am doing some exam preparation and can't figure out how to do the following question. It seems to be a regular question and was wondering if anyone who could tell me an approach to this style of question in laymen's term as everything tutorial i have found is either unrelated or over complicated. The question is as followed
Find the value of the unique integer $x$ satisfying $0\le x <17$ for which
$$4^{102400000002}\equiv x \pmod{17}$$
Answer: As $16\equiv-1\pmod{17}$
$$ 4^{102400000002}=(4^2)^{51200000001}\equiv(-1)^{51200000001}\pmod{17}\equiv?$$
We can generalize $102400000002$ with $4n+2$ where integer $n\ge0$
Answer: Since $17$ is prime, we can apply Fermat's little theorem:
$$
a^{17}\equiv a\pmod{17}
$$
for any integer $a$. More useful is the statement that
$$
a^{16}\equiv 1\pmod{17}
$$
whenever $17$ is not a divisor of $a$. Since $4$ is not divisible by $17$, we can write
$$
102400000002=16\cdot 6400000000+2
$$
so
$$
4^{102400000002}=(4^{16})^{6400000000}\cdot 4^2\equiv 1\cdot16\pmod{17}
$$
Answer: The fundamental idea is that when you exponentiate a number modulo $m$...
$$a^0, a^1, a^2, a^3... \mod m$$
You can't just keep getting different results, because all the values have to be between $0$ and $m-1$. So eventually you'll have to get a repeat, and from that point on, you get a repeating pattern. For example, modulo $10$, exponentiating $2$ goes like this:
$$1, 2, 4, 8, 6, 2, 4, 8, 6 ...$$
So to work out $4$ to the power of some massive number modulo $17$, we just look for the pattern:
$$1, 4, 16, 13, 1, 4...$$
So every $4$ multiplications, we get a repeat. So work out what that exponent is modulo $4$ and that'll tell you where in the cycle you'll be at that point.

Modular Arithmetic


Augment Base Color Class on Android

Question: I have a lot of code written for later Android APIs (26+) which supports things like Color.valueOf() and numeric color channels.  I want to back-port some of that code to work with older API devices without having to change every instance of my Color class use to be something else.
Is there a way in Java to modify a class without having to create a derived class with the new functionality?
Basically, I want to augment the lesser-API Color class and code in the missing functions I use.
In my thinking, I see it conceptually like this:
augment class Color() {

    // Add in missing functions
    public static int valueOf(float r, float g, float b) {
    }

    public static int valueOf(int r, int g, int b) {
    }

    // Other functions here
}

It would compile the default Color class adding in those additional functions so they'd be available from that point forward in that app in the lesser-API device.
Answer:
Is there a way in Java to modify a class without having to create a derived class with the new functionality?

There is nothing built into Java for this, sorry.
Note that the methods in question (valueOf()) are static methods. Your current code calls them like this:
Color.valueOf(foo, bar, goo);

It would not take much to write a script that replaces those calls with:
RickColorCompat.valueOf(foo, bar, goo);

Or, try Edit > Find > Replace in Path in Android Studio. Personally, I have a command-line gsub Ruby script that I wrote a while back for this sort of search-and-replace work.
Depending on what else you are using from Color, though, that approach may not work.
Comment: @RickC.Hodgin: "Could I create my own Color class which extends android.graphics.Color and change the imports in my source files to use mine?" -- yes. "how can I implement conditional compilation so that my functions aren't included for APIs which have them?" -- Java does not offer that.
Comment: Could I create my own Color class which extends android.graphics.Color and change the imports in my source files to use mine?  And if I do this, how can I implement conditional compilation so that my functions aren't included for APIs which have them?
Answer: I thought I would post my solution in case anybody needs the assistance.
My goal was to take an existing API 26 app back to API 9 so it would run on the Android 2.x series.  Several Color member functions were missing related to processing integer colors and floating point color channels.
To bring the old API Color class up to date, I created a Colorx class and replaced all references of Color with Colorx.  Here's the source code.  By making this change, the rest of my design (using integers and floating point color channels) was able to continue unchanged, with only the refactoring from Color to Colorx being required.
Hope this helps somebody.  And if you have any suggestions for other changes / enhancements / bug fixes, please let me know.  Thank you.
package ...;

import android.graphics.Color;

public class Colorx extends Color
{
    // Class variables
    public int m_red;
    public int m_grn;
    public int m_blu;
    public int m_alp;

    // Constant colors (taken from Color)
    public static final int BLACK       = 0xFF000000;
    public static final int DKGRAY      = 0xFF444444;
    public static final int GRAY        = 0xFF888888;
    public static final int LTGRAY      = 0xFFCCCCCC;
    public static final int WHITE       = 0xFFFFFFFF;
    public static final int RED         = 0xFFFF0000;
    public static final int GREEN       = 0xFF00FF00;
    public static final int BLUE        = 0xFF0000FF;
    public static final int YELLOW      = 0xFFFFFF00;
    public static final int CYAN        = 0xFF00FFFF;
    public static final int MAGENTA     = 0xFFFF00FF;
    public static final int TRANSPARENT = 0;

    // Constructors
    public Colorx()
    {
        super();

        // Initially set the alpha to 100%
        m_alp = 255;
    }

    public Colorx(float r, float g, float b)
    {
        String rrggbb;

        // Convert to integers
        m_red = (int)range(255.0f * r, 0.0f, 255.0f);
        m_grn = (int)range(255.0f * g, 0.0f, 255.0f);
        m_blu = (int)range(255.0f * b, 0.0f, 255.0f);

        // Parse the indicated color
        rrggbb = "#ff" + hexString2(m_red) + hexString2(m_grn) + hexString2(m_blu);
        parseColor(rrggbb);
    }

    public Colorx(float r, float g, float b, float a)
    {
        String aarrggbb;

        // Convert to integers
        m_red = (int)range(255.0f * r, 0.0f, 255.0f);
        m_grn = (int)range(255.0f * g, 0.0f, 255.0f);
        m_blu = (int)range(255.0f * b, 0.0f, 255.0f);
        m_alp = (int)range(255.0f * a, 0.0f, 255.0f);

        // Parse the indicated color
        aarrggbb = "#" + hexString2(m_alp) + hexString2(m_red) + hexString2(m_grn) + hexString2(m_blu);
        parseColor(aarrggbb);
    }

    public Colorx(int color)
    {
        String aarrggbb;

        // Convert to integers
        m_red = (int)range((color >> 16) & 0xff, 0, 255);
        m_grn = (int)range((color >>  8) & 0xff, 0, 255);
        m_blu = (int)range((color >>  0) & 0xff, 0, 255);
        m_alp = (int)range((color >> 24) & 0xff, 0, 255);

        // Parse the indicated color
        aarrggbb = "#" + hexString2(m_alp) + hexString2(m_red) + hexString2(m_grn) + hexString2(m_blu);
        parseColor(aarrggbb);
    }

    public float red()
    {
        return ((float)m_red / 255.0f);
    }

    public float green()
    {
        return ((float)m_grn / 255.0f);
    }

    public float blue()
    {
        return ((float)m_blu / 255.0f);
    }

    public float alp()
    {
        return ((float)m_alp / 255.0f);
    }

    public int toArgb()
    {
        int color =   ((m_alp & 0xff) << 24)
                    | ((m_red & 0xff) << 16)
                    | ((m_grn & 0xff) <<  8)
                    |  (m_blu & 0xff);

        return color;
    }

    public static Colorx valueOf(float r, float g, float b)
    {
        return new Colorx(r, g, b, 1.0f);
    }

    public static Colorx valueOf(float r, float g, float b, float a)
    {
        return new Colorx(r, g, b, a);
    }

    public static Colorx valueOf(int color)
    {
        return new Colorx(color);
    }

    public float range(float v, float vMin, float vMax)
    {
        return Math.max(vMin, Math.min(vMax, v));
    }

    public static String hexString2(int v)
    {
        String text;

        // Convert
        text = Integer.toHexString(v);

        // Evaluate
             if (text.length() == 2)  return text;        // It's the proper length
        else if (text.length() == 1)  return "0" + text;  // It's only one digits
        else                          return "00";        // It's an invalid length, force it to 00
    }
}

Augment Base Color Class on Android


Is a SWF whose src uses HTTPS secure?

Question: Here is a scenario:
I am embedding form.swf in http://somesite.com/page.html. The SWF is loaded from https://example.com/form.swf and submits to https://example.com/secureform.php.
So, is the transmission to the server secure?
Answer: It depends what you mean by secure. I think you are asking whether the submitted data is secure, and the answer is that if you are using HTTPS, it is.
HTTPS on the SWF ensures just that the Flash object cannot be maliciously modified between the server and the client.
Answer: Yeah, you are going to have to elaborate on what you mean by 'secure'.  HTTPS just provides transport security (in most cases).  It doesn't provide end-point security.  That is to say, there is no way to guarantee that either end of the connection is secure, just that the transport is (mostly) secure.  If either end point has been hacked many kinds of attacks can occur through altered SSL certificates.  So you can't trust the client data.  I will assume for now you can trust the server data (or you are in real trouble :-)).
Comment: To clarify, that's all that I meant - security of transmission from the SWF to the server :)

Is a SWF whose src uses HTTPS secure?


Smartphone locked with no access to Gboard Keyboard

Question: (First excuse my bad English, It's not my mother tongue)
Before my smartphone (Wiko Freddy) was locked, somebody disable GBoard on it, and reboot the phone.
I read a lot of articles and try a lot of tools on my computer (Windows 10 x64) from the net, but actually nothing unlocked this problem.
When connecting the phone with a USB cable to Windows 10 :

the phone is in "charging mode"

On the phone, USB Debugging Mode seems active, but not detected from the tools who requested to activate this option on the phone before continuing.
List of products/tools tested :

DroitKit
FoneDog Toolkit for Android
Free Android Data Recovery
iMyFone D-BAck for Android
iMyFone LockWiper (Android)
Jihosoft Android Phone Recovery
MyPhoneExplorer
ScrCpy
SnapPea
UltData for Android
UnlockGo (Android)
And other products removed from the pc.

Some of the tested tools inform that they can unlock only Samsung phone.
Some are only trial version.
In device manager (Windows) :
=> Android Device

Android Composite ADB Interface

=> Other devices : (3 times Android without installed drivers)

Android
Android
Android

I try to update drivers but Windows says that the last drivers are still installed.
=> Wiko-Freddy USB drivers
=> Google USB Drivers
I try to use ADB commands.
But the device is unauthorized.
D:_adb-tools>adb devices
* daemon not running; starting now at tcp:5037
* daemon started successfully
List of devices attached
37dc5a88        unauthorized      <=====
I don't see any confirmation dialog box on the phone to allow remote connexion (from windows).
I'm sure that this problem can be resolved without reset the phone in the original configuration. I would like to preserve all datas on the phone.
I would like to know How to use ADB commands to :

Force the unauthorized status to authorized
Reactivate GBoard
and change the charging mode to MTP mode

By advance, many thanks for your help.
Regards,
Hi Alexcs (and eveybody)
Thank you very much for your reply.
As I'm a novice, and try to understand, can you give me more details  on this solution please.

With this solution, is there any risk for the data's ?
When I search the stock ROM for the Wiko Freddy on the net, there are a lot of sites who propose this file, with different size.
Do you have any recommendation for choosing the right one ?
How to put the phone in EDL mode ?

I just know the recovery mode when pressing Power on and volume down on the phone on boot.
Options are :
Reboot system now
Reboot to bootloader
Apply update from ADB       (**)
Apply update from SD card
Wipe data factory
reset wipe cache partition
Mount /system
View recovery logs
Power off
(**) When testing this option, this message appear on the mobile :
Supported API: 3
Now send the package you want to apply to the device with "adb sideload "
On windows :
List of devices attached
37dc5a88 sideload
As it's seem possible to send package and write in this case to the phone,
Is there any way to :

copy the configuration file where the Gboard keyboard should be define to the pc
modify this file (with any tool)
and copy (replace) it back to the phone in the good place
and reboot the mobile to retrieve the keyboard?

By advance, thank you very much for your help and answers about all solutions who will preserve all data's on the phone.
Regards,
Comment: Hi, Is there any way to transform an APK file to ZIP file with correct footer to upload it on android mobile?
Answer: You haven't mentioned android version, but I guess it's AVBv1 signed. Therefore it's possible to flash modified boot partition.

download the stock ROM

extract the boot.img file with AIK

modify default.prop
ro.adb.secure=0
persist.service.adb.enable=1

repack the file

flash file into boot partition in EDL mode

once adb is working use scrcpy to do the necessary.


Authentication options for SharePoint Online

Question: So I am starting to create and plan out an intranet sight for my company. One aspect that I'm looking to get info on is about authentication, we want to be able to access it within our network openly. Outside of our network we want to be able to login with Office 365 credentials (we have SharePoint on Office365). I have looked into form authentication, and have also looked into setting up SharePoint in an Azure instance and using IP filtering. Has anyone done this or know how to start doing this?
Comment: You might want to look into ADFS or a third party auth provider, like Okta who we use.
Comment: @EricAlexander I'm assuming that needs to be setup in a Self hosted or Azure instance correct? Will that allow there to be no authentication if it's within our network (IP range)? Only asking as I mentioned above that right now we only have SharePoint on Office 365.
Answer: There is only a single method of authentication to Office 365 (or SharePoint Online, however you'd like to look at it). You're either using federated using ADFS, Okta, Ping, etc. or using 'managed' accounts (where Azure AD sync is in place, but you're not using federation). There is no way to do one or the other depending on location.
I typically suggest that clients use Azure IaaS (or AWS, whichever your platform of choice is) to host Web Application Proxy, ADFS 3.0, and two Domain Controllers with a site-to-site VPN tunnel to their internal network. These are usually smaller customers, but this way if the Internet connectivity to their data center becomes unavailable, they're still able to log in from outside of the office thanks to ADFS running in Azure. We also use the Azure Resource Model to make sure each WAP/ADFS/DC is on a separate fault/update domain, as well as for easier management should they upgrade Windows Server down the road (just delete the Resource Group to axe all related resources).
Comment: That definitely helps. I may end up using a dynamic website for this. Thanks for the help. Right now we only have the Office365 so I have some thinking to do.


What does 气场全开 mean?

Question: Reading a sentence "37岁秦岚登T台走秀气场全开秀迷人天鹅颈", I check online the meaning of the idiom 气场全开,which is given as 自己不说话,站在那里别人都怕自己 (you scare the other people with your silence), but that sounds ridiculous in this context.
Comment: The word(s) (fashion) hype spring(s) to mind. The damsel may have aged a little in the meantime: 43岁的秦岚太优雅了!在《瑞丽伊人风尚》上演绎时尚,尽显洒脱
Answer: "气场" means "aura". "她气场全开" = "She has a strong aura (of confidence and grace). "
Answer: I think it's not the traditional usage in Chinese (that means it's not appropriate to appear in the formal written language),  but obviously, it's quite popular in young people's daily talks.
The phrase "气场全开 "  can be divided into two parts, the first two words' meaning refers to the influences of the thinking, personalities, characters, and behaviors of a person; the last two words' meaning describes the degree, be full of or thoroughly.
So combined together, the meaning of 气场全开 can be apprehended to depict someone with great influences on the surroundings or public. People with the character of "气场全开" has notable characteristics (personal authority or charming or outstanding competence or good-looking etc.)of behavior,  becoming the center of attention, other people cannot omit the sense of the presence of him/her, and what's more, they feel the energy from that person and become to appreciate and worship to him/her.
At last, the phrase is a commendatory term.
Answer: This term is a bit of a slang,  so I think it has a lot of variation in the usage, and the multiple meanings are still changing, they are a little hard to pin down compared to a formal vocab term.
However these are some of the common applications of the term I've seen:
Most often, I see it used to represent confidence, in the way that you can stand tall and take control of a situation/group/conversation etc. Being able to be a natural leader (or at least so since a huge amount of seeing this vocab is overly shy people wanting to change)
If you think of the english phrase "fake it til you make it" it has a bit of the same energy. The difference being that the chinese slang can be used for those who don't need to fake it.
In your original sentence, it is saying that 秦嵐 walked the cat walk in a very confident way,a way the grabbed the attention of those present and took control of the energy of the room.
Imagining the confidence and apparent ease of controlling the situation successful model's display is actually a great example of the aura meant by 气场全开 overall. The person in the group that everyone else naturally congregates around etc.
Comment: That makes much sense, and I also heard another similar expression 火力全开, perhaps they can be interchangeable.
Comment: @NanningYouth I don't think both are interchangeable, at least from what I've seen. 火力全开 is also slang but the use I've seen is basically like saying you gave it 120% effort.  It doesn't have to be people though.  It could be a sports star did really good in a game, or the winter being super cold. I could imagine both being used together sometimes.
Answer: 37岁秦岚登T台走秀气场全开秀迷人天鹅颈. Literal translation: At 37, Qin Lan appeared on the runway, with her chi (or aura) field fully-open, showing off her charming swan neck.

What does 气场全开 mean?


Cantonese Question: When does one use 咩 versus 乜野?

Question: I've been listening to some Cantonese audio from Pimsleur and noticed they use a different word for "what" compared to what I learned from CantoneseClass101. In CC101, they used 咩, such as "咩事啊?", whereas the audio I just listened to is using sentences like "你想飲乜野啊?" What is the difference if any?
Answer: It's a contraction. (合音)

Cantonese contracts 乜嘢 (mat1 ye5)[4] 'what?' to 咩 (me1).

Common words spoken fast often have the first initial mixed in with the last final. For example 咩 takes the "m" from 乜 and the ending "e" from 嘢, creating the contracted form: me.
Same meaning, same usage - just quicker speeds.
You will find many contractions in Chinese topolects.
Comment: Is that then analogous to 什麽 and 啥 in Mandarin? Cuz that would make a lot of sense if that was the case.
Comment: @ShawnHemelstrand It has been proposed that 啥 is [probably a fusion of 什麼/什么 (shénme)](https://en.wiktionary.org/wiki/%E5%95%A5#Chinese), so yes that is correct.
Comment: This brings me to suggest that the verbal contraction of 乜野 to 咩 with the latter written with a "Sheep",  羊, component, is no coincidence as the 咩 sounds like the bleating sheep. Listen to this:- https://en.wikipedia.org/wiki/File:Sheep_bleating.ogg
Comment: The linked page doesn't have examples of Cantonese contraction. E.g. 係唔係 -->係咪
Comment: The contraction of 乜嘢 sounds kind of like me1 e5 (kind of like a descending tone which doesn't otherwise exist in Cantonese), whereas the particle 咩 is pronounced me1. So to me, they are not the same.


Graduate school admission advantage if offering instrument time

Question: Would you have an advantage when applying for some graduate school if you write in your forms that you own some useful equipment already from your independent research and you would offer free time to the institute to use it or for undergraduate teaching purposes. Something in the price range of 90'000$, like a bioluminescence microscope or a large telescope?
Answer: That might certainly catch my eye if I read your application, but I'm not sure how much weight it would carry. I would be a bit nervous offering it quid pro quo - that seems to get into a dangerous or at least gray area in the vicinity of a bribe for admission.
My suggestion, if you include such information, would be to limit your disclosure to a demonstration of your commitment to the topic of interest, or to talk about ways you have already used the equipment for outreach purposes to demonstrate your value to the community as an emerging scholar - and not as a condition on accepting your application.
The problem is the perception, and whether you offer it directly or not you could be perceived as trying to sway the admissions committee. For example, a police officer has some leeway in choosing whether to cite you or not; offering the officer $100 is going to get you in trouble, whether you say "I will give you $100 if you let me go" or if you say "Hey I just wanted to let you know how much I care about police officers in general, so I am going to put this $100 on your car, you can take it if you want."
Your situation is different because the legality is much less clear than the example I just gave, but I would be uncomfortable accepting a student who wouldn't normally meet the expectations of the university because they were offering the use of some equipment.
Comment: No, of course not a hard condition, but in the sense of a significant advantage, like that you'd certainly be on the pile of applicants that most likely make it to the final round and interviews. Also in combination with what you've already achieved with it on the basis of your enthusiastic autodidactic learning.
Comment: I amended my answer to respond to your comment; I would reiterate that using your personal ownership of some equipment to demonstrate your enthusiastic autodidactic learning ability is certainly fine, though I wouldn't personally weight it above having equal experience with similar equipment owned by anyone else.
Answer: Smacks of bribery.  I would avoid any quid pro quo.  If you get in, you should owe your department your best efforts, and nothing else, and they owe you an opportunity for an education.
Mention in your statement the kind of research that you do and the types of experience that you have, because that's relevant to your package.  Do not mention that you will make the equipment available to them, because that would not be appropriate.


Why Don't the Death Eaters Kill Harry Physically

Question: We know that someone actually died while playing Quidditch. So why didn't anyone, such as Voldemort or Draco, just poke a quill in Harry's eye to kill him?
Comment: That would just blind him in one eye. You should have suggested a machete , you can do a lot more with that.
Comment: I'd imagine it's for the same reason you wouldn't beat someone to death if you had a gun. Magic is quicker, easier, more reliable, less messy and less traceable.
Answer: Since you mention Quidditch, recall that Voldemort/Quirrell did try to kill Harry while he was playing a game in The Philosopher's Stone by jinxing his broom.
Other attempts at assassination were also done, although most of them likely planned to use magic to do so, rather than stabbing him with a quill. Perhaps the most relevant to the phrasing of your question is that Barty Crouch Jr lured Harry to Moody's office in The Goblet of Fire to kill him personally.
Apart from that, Voldemort obviously tried to kill him in Goblet of Fire to use his blood in his own resurrection. Death Eaters also crashed the wedding of Bill and Fleur, presumably with the primary aim of killing Harry. Death Eaters also tried to kidnap Harry from the Hogwarts Express in the Half-Blood Prince.
Comment: The point Petra is making is; Harry seems to have all sorts of magic protections, so instead of using magic why not use a large pointy piece of metal
Comment: @user20310 If that's the point Petra is making, I agree that this is a duplicate, as suggested in the comments to the question.
Comment: @tobiasvl That was my point; sorry, never new this question had already been asked. I'm very much new here. How do we know if our our question has already been answered? Thanks.
Comment: @Petra Search before you ask :) but of course, sometimes you fail to find previous questions because you use other terms. In that case, the community finds it for you, like here.


Why does the formula for an augmented 7 chord contain a b7 and not a 7?

Question: Why does the formula for an augmented 7 chord contain a flat7 note, not a major 7th note?
Comment: With "flat7" do you mean a whole tone below the tonic, and with "7th note" a half tone?
Comment: whose formula, do you mean jazz chord symbols?
Comment: what is a formula for a chord? May want to explain your terminology a little bit.
Answer: This is how the notation is defined. A "7" by itself means a ♭7; a major 7 must be notated explicitly.
A = A major
A7 = A major, plus a ♭7
A△7 = A major, plus a major 7
A- = A minor
A-7 = A minor, plus a ♭7
A-△7 = A minor, plus a major 7
A+ = A augmented
A+7 = A augmented, plus a ♭7
A+△7 = A augmented, plus a major 7 (also A△7[♯5])
Diminished chords are an exception.
Adim = A diminished
Adim7 = A fully diminished seventh (also Ao7)
A-7(♭5) = A half-diminished seventh (also Aø7)
Adim△7 = A diminished triad with a major seventh
Comment: @Tim it's not necessary for a major chord but you do need ma, maj or a triangle to indicate a maj7. Abm in E will get you a knock on the door from the enharmonic police dept.
Comment: oh... ok! ... and I also had the triangle and bar backward... the triangle is major, the bar is minor (more sides, less sides). Well done!
Comment: Great "in a nutshell" explanation of chord symbols, +1. Plus, I'm a fan of dashes and triangles in chord symbols.
Comment: @JohnBelzaguy It's not that I completely screwed those up; I was just checking if you were paying attention. (Thanks for the catches!)
Comment: What can I say, it's a slow night! :)
Comment: @JohnBelzaguy - those dashes work o.k. in printed form, but can get lost/misinterpreted when handwritten.
Comment: @Aaron - there are signs for dim and half-dim., (which I can't find on my keyboard!)
Comment: @Tim Indeed. Updated.
Comment: @Tim like I said I'm a fan of them but unfortunately I end up using m and maj most of the time because of concern that they won't be played correctly.
Comment: @JohnBelzaguy - is 'maj' necessary? I see 'nothing' as default to major, so it's superfluous, easier to write, easier to read, and clogs up less. I did try lower case for minors, but f and c got confusing, when handwritten, so gave up on that idea. But - context often gives the clue anyway. Although I just couldn't find the chord Abm in key E once...
Comment: @JohnBelzaguy - yes, the triangle always works for me. NNS uses caps and lower case, with impunity! I've also seen '7' and 'European 7' used to differentiate between dom/maj 7, but it's not clear cut.
Comment: @Aaron - often wondered why + is aug., whereas the opposite (-) isn't the opposite (dim), but *minor*. Quite illogical, like most of life!
Comment: @Tim Just a guess, but ... since major is normative, + means "bigger than major" (augmented), and - means "smaller than major" (minor) — both chords being "one step away" from major.
Answer: Further to Aaron's answer: the 'flat 7' found in a dominant seventh chord is there due to the chord being made up from notes diatonic to a different key.
As in C7 - C E G B♭. Those notes are diatonic to key F, rather than key C, which is also where it's found.
And 'augmented seventh' is a bit of a misnomer! There's a seventh, and the fifth is augmented. There's no augmented seventh interval in sight. If that interval was there, in, say, key C, it would incorporate a B♯, sounding rather like the root note, C!
Answer: There's a logical reason for why this is the case:
That's because an augmented 7th chord has nothing to do with an interval of an augmented seventh! In fact, the full name for this type of chord is Augmented Dominant 7th.

C E G# Bb

C+7
Caug7
C7#5
(These are all equivalent ways to write C augmented 7th. You may also see parentheses involved, which indicate that the notes inside are to be explicitly added to whatever remains outside of the chord. In this case, grouping makes no difference at all since 7th chords are already defined as triads with added 7ths.)

Now it should be easier to split up that +7 symbol into the + and the 7. The + represents an augmented triad, and the 7 indicates that the chord is of dominant 7th quality. If it helps any, think of the chord as a dominant 7th chord first, then augment the 5th afterwards. That should help you make the association between the interval pattern and the symbol (and it's good practice for the many altered dominant chords that act the same way)!
For fun: there's also a chord called Augmented Major 7th, labelled +maj7. This chord is an augmented triad with a major 7th (or, potentially more helpfully, a major 7th chord with an augmented fifth). Not a very common one in tonal harmonies, but a good one to know about!
Answer: We sometimes call the 'C7' chord type a 'Dominant Seventh'.  Because its most common occurrence is as the dominant chord in a major or minor key.
So C7 doesn't have a 'flattened 7th'.   As the dominant chord in F major it has a normal, diatonic 7th.
Most chords with '7th' in their name are variations of this basic 'dominant 7th' shape.   'Caug7' is C7 with a raised ('augmented') 5th.   The 'augmented' refers to the 5th, not to the 7th.  'C7(b5)'  is C7 with a lowered 5th.
But in 'Cdim7' the 'dim' DOES refer to the 7th (as well as to the 5th).    Once again, music theory has frustrated our desire for a nice, neat set of rules.
"'7th' in a chord name means it's based on the dominant 7th shape, except when it doesn't."
Sorry.
Answer: An augmented seventh chord comprises of a root note, a major third, a augmented fifth and a major seventh. It is the chord that naturally lies on the third step of the harmonic minor scale (The mediant).
Nice jazz chord but also extant in standard harmony.
Comment: I have tried to answer the question, but I may have a correct understanding of what a formula for a chord is.


What do the terms 'Human Emancipation' and 'Political Emancipation' mean?

Question: What do the terms 'Human Emancipation' and 'Political Emancipation' mean?
And which one of these are promoted by capitalism?
Comment: Can you please link to where these are used? These are pretty broad terms that could mean a lot of things based on the context they are used in.
Comment: Looking at the tags it might be in the context of Marxism, but the question author should mention that in the question.
Comment: I edited the tags. Human and political emancipation are terms often associated with a certain text by Marx. The economy-specific tags (communism, socialism, capitalism) were all unnecessary.
Answer: Marx discusses human and political emancipation in a (relatively) little known work, On the Jewish Question. There are many copies online for free.
Political Emancipation
Marx characterizes society under bourgeois as a place where rulers take their private concerns and turn them into public concerns (effectively pushing their personal preferences to the public, who cannot refuse them).
Political emancipation is a state of being where people are freed from this process.
For example, under the French ancien regime people were forced to accept the religious preferences of the state (Roman catholicism). This is a state without political emancipation. Contrast this with the 21st century America. The state does not overtly prefer any religion and citizens have freedom of (and from) religion.
This is important because it provides the bourgeoisie the ability to rule in their own economic interest without having to satisfy other social concerns. Although Marx doesn't use the term, it's easy to think of it as being similar to  rationalization
These lecture notes from Florida International University provide this quote:

the modern State emancipates the Jews, not by freeing them from the domination of religion but by freeing itself from religion, by giving recognition to no religion and hence putting the Jews on an equal footing with everyone else

The Problem with Political Emancipation
Here is the problem Marx gets to: political emancipation frees the state, but it is a barrier to the freedom of individual citizens. Marx is a materialist, and as part of his project he claims that religion is something people cling to when their economic/material lives are unsatisfactory [Read more @ SEP]. When the rulers have freed themselves of religion, they are less constrained in oppressing workers. However, under political emancipation the public is still divided by religion, preventing them from either perceiving their oppression or resisting it.
Human Emancipation
The solution is the concept of human emancipation. Although Marx never really defines human emancipation, the way he contrasts it with political emancipation suggests that it is the actual emancipation of humans, not the state, from oppression.
Using religion as an example again, political emancipation from religion means that the state is now unconstrained by religion. However, citizens may still be religious and (in Marx's terms) are alienated from their labor by religion. Human emancipation from religion would indicate that citizens are no longer alienated from their labor by religion.


Mold on bottom of fig tree

Question:
Bottom of fig tree with soft spongy mold
Can anybody tell me what this is at the bottom of my fig tree? It looks like it killed part of it? Any remedy or advice. Thanks
Comment: Are  you saying some of the tree or its trunk is now dead? Have you had lots of very wet weather in the last few weeks? Have you tried leaning or pushing against the trunks to see if they're still solid and stable,or wobbly and likely to fall?
Comment: We live in the South east, and it is alway humid here and has been raining on and off. The branch is wobbly and most definetely dead. However that mold is extending to other live branches and I am wondering whether the mold killed that branch of the tree and what can I do to save the rest of the tree...
Answer: If the trunk is already dead and the fungus is spreading, it's most likely one of the foot and butt rots at the root. There is nothing you can do to save the rest of the tree, though removal of the dead trunk with the worst of the fungus might mean the rest lasts a bit longer. The fungus will be working its way up the inside of the tree as well as the outside, I'm afraid. It's probably safest to remove it altogether.

Mold on bottom of fig tree


Do you have suggestions for these assembly mnemonics?

Question: Last semester in college, my teacher in the Computer Languages class taught us the esoteric language named Whitespace. In the interest of learning the language better with a very busy schedule (midterms), I wrote an interpreter and assembler in Python. An assembly language was designed to facilitate writing programs easily, and a sample program was written with the given assembly mnemonics.
Now that it is summer, a new project has begun with the objective being to rewrite the interpreter and assembler for Whitespace 0.3, with further developments coming afterwards. Since there is so much extra time than before to work on its design, you are presented here with an outline that provides a revised set of mnemonics for the assembly language. This post is marked as a wiki for their discussion.
Have you ever had any experience with assembly languages in the past? Were there some instructions that you thought should have been renamed to something different? Did you find yourself thinking outside the box and with a different paradigm than in which the mnemonics were named? If you can answer yes to any of those questions, you are most welcome here. Subjective answers are appreciated!

Stack Manipulation (IMP: [Space])
Stack manipulation is one of the more common operations, hence the shortness of the IMP [Space]. There are four stack instructions.
hold N       Push the number onto the stack
copy         Duplicate the top item on the stack
copy N       Copy the nth item on the stack (given by the argument) onto the top of the stack
swap         Swap the top two items on the stack
drop         Discard the top item on the stack
drop N       Slide n items off the stack, keeping the top item

Arithmetic (IMP: [Tab][Space])
Arithmetic commands operate on the top two items on the stack, and replace them with the result of the operation. The first item pushed is considered to be left of the operator.
add          Addition
sub          Subtraction
mul          Multiplication
div          Integer Division
mod          Modulo

Heap Access (IMP: [Tab][Tab])
Heap access commands look at the stack to find the address of items to be stored or retrieved. To store an item, push the address then the value and run the store command. To retrieve an item, push the address and run the retrieve command, which will place the value stored in the location at the top of the stack.
save         Store
load         Retrieve

Flow Control (IMP: [LF])
Flow control operations are also common. Subroutines are marked by labels, as well as the targets of conditional and unconditional jumps, by which loops can be implemented. Programs must be ended by means of [LF][LF][LF] so that the interpreter can exit cleanly.
L:           Mark a location in the program
call L       Call a subroutine
goto L       Jump unconditionally to a label
if=0 L       Jump to a label if the top of the stack is zero
if<0 L       Jump to a label if the top of the stack is negative
return       End a subroutine and transfer control back to the caller
halt         End the program

I/O (IMP: [Tab][LF])
Finally, we need to be able to interact with the user. There are IO instructions for reading and writing numbers and individual characters. With these, string manipulation routines can be written. The read instructions take the heap address in which to store the result from the top of the stack.
print chr    Output the character at the top of the stack
print int    Output the number at the top of the stack
input chr    Read a character and place it in the location given by the top of the stack
input int    Read a number and place it in the location given by the top of the stack

Question: How would you redesign, rewrite, or rename the previous mnemonics and for what reasons?
Comment: Holy crap, a whitespace assembler? I believe your geek-o-meter just went up to eleven!
Answer: I think the first change I'd propose is changing hold and drop to push and pop respectively.
Then maybe I'd rename copy to dup (I think that's the most common name for this operation in stack oriented languages).
I'm a little puzzled why often you have short one word explanations that are different to the mnemonic. For example mnemonic is Save, explanation is Store. Mnemonic is Load, explanation is Retrieve. Incidentally those are the two mnemonics that aren't sufficiently explained to me. Save what where? Load what from where? (Edit the question has subsequently been edited to make these meanings clear)
Thanks for the interesting post.
Comment: The explanations come from the tutorial found here: http://compsoc.dur.ac.uk/whitespace/tutorial.php
Answer:
push #n, to make it clear that n is an immediate.
"swap" is sometimes "exc" or "exch" I think.
"save" is usually "st" (store)
"load" is usually "ld"
"call" could also be "jsr" or "bl".
"goto" is usually "jmp" or "bra"
"if=0" is usually "beq"
"if<0" is usually "blt"
"return" is usually "ret" or "blr"
"exit" is usually "halt"/"hlt" in the context of a CPU.
"print chr" and "print int" could be "print.c" and "print.i". There are many ways to specify instruction variants, but usually it's not in the operands.

EDIT:
If you don't mind conflating opcodes and addressing modes, using CISCy syntax,

"push (sp)" instead of "copy"
"push N(sp)" instead of "copy N" (modulo multiplying by the word size)
"push *(sp)" instead of "load" (except it does a pop before pushing the loaded values)
"pop *1(sp)" instead of "push" (except it actually pops twice)

On the other hand, stack-based code usually treats push and pop as implicit. In that case, "imm n" (immediate) instead of "push". Then all stack operations are purely stack operations, which is nice and consistent.
I'm not sure how I'd write "drop N"  — the description makes it sound like "drop 1" isn't equivalent to "drop" which seems odd.
Comment: Thank you! The hold instruction was original push, and the drop instruction was originally away. Pop was considered, but neither push nor pop describe the operation very well (even though they are standard). Your suggestion on changing exit to halt makes sense. "print chr" is an instruction: it has no operand. Maybe studying 4D is getting to me. They allow spaces in their instructions, weirdly. :)
Comment: It depends on which paradigm you're using. The x87 has "fstp" which means "floating point store and pop", i.e. storing is orthogonal to popping (a lot of x87 instructions have "and pop" variants). Adding an edit...
Comment: From Wapedia: `In Unix halt is the command to shut down the computer. In x86 assembly language, HLT is an instruction that halts the CPU until the next external interrupt is fired.` That may come in handy later on when Whitespace is developed into further versions. Programming an interrupt system into the language would be a great learning experience.
Comment: On some systemss, there's a distinction between {{halt}} and {{poweroff}}.
Answer: I'm not sure I completely understand your question, so if I'm off base, forgive me.
In addition to your stack, I would probably add a "status register" that contains a variety of different flags (like Carry, Overflow, and Zero) that are set by the arithmatic operators.
I would then add "if" forms that test those flags.
I would add bit shift and rotate (both left and right) instructions, as well as AND/OR/XOR/NOT operations that operate on bits.
You will most likely want to have some sort of memory access, unless you intend the I/O instructions to treat memory as a stream of values for that good ol' fashioned Turing Machine feel.
Comment: Since I did not write the language and intend to currently just rewrite the interpreter for version 0.3 of the language, options for changing it are limited. If all goes well, I may take the liberty to make small modifications to instruction set and focus primarily on the assembly code for  extension version 0.4 of the language. Continuing on, version 0.5 would probably concentrate on the instruction and involve a much larger overhaul of Whitespace assembly. In addition, moving the language from using three whitespace characters to all six whitespace characters is a small additional objective.


What's the most efficient way to kill an Iron Golem?

Question: What's the most efficient way to kill an Iron Golem? Should I try killing it with sharp pointy things? Should I set up traps to do the work for me?
Answer: The Wiki says:

They can take damage from weapons, lava, fire, poison, cacti, and
  suffocation. They do not take fall damage or drowning damage.

So, I tested.
19 hits from Iron Sword (aprox 19 seconds based on 1 hit/second.)
15 hits from Diamond Sword (aprox 15 seconds based on 1 hit/second.)
13 hits with an arrow. (aprox 26 seconds based on 0.5 hit/second.)
Fire: I dropped a Iron Golem into an enclosed area with a floor on fire. The golem lasted for a good 60 seconds plus before dieing.
Lava: The Iron Golem was dropped into a 1-block deep area of lava. He lasted 13 seconds.
Cacti: Dropped into a pit full of cacti. Around 25 seconds.
Suffocating: Created in a 3x3 hold and then used pistons to squish them in - around 25 seconds.
The verdict is: Using your own default weapons (swords and bows/arrows) are highly effective, and are encouraged.  Using lava may be risky; setting up the trap takes time, but just going all out on an Iron Golem should do the trick. Enchantments may also speed up the time it takes to kill one of them.
Answer: Like most mobs, the easiest way is suffocation. Once you've captured your golem in a trap, just piston a block into its head and it will die very quickly.
Here's a good tutorial for making such a farm:
Answer: Carry a bucket of lava. Place lava in the square in which the golem stands, not on the golem directly. Use the bucket to collect the lava once the golem starts to burn to keep the lava from spreading. You may need to apply the lava a few times to finish off the golem.
Note that burning golems can set other things on fire sometimes. I've found this to be uncommon and manageable, but probably also depends on the village. You can extinguish flames that happen to start on buildings.
I've done this in 1.7.2 and it will not generate agro. You can also kill villagers this way without upsetting the golems.


"mdwlist.sty" file not found

Question: I am new to latex, whenever I quick build my latex document it shows an error ("mdwlist.sty" file not found). I googled it many times but I am not getting anything, please tell me how to solve this problem.
Comment: Welcome to TeX.SX! What TeX distribution are you using? Can you make a small example of a document producing the error?
Answer: It is part of the mdwtools bundle. But you should know it is superseded by tthe  enumitem package that allows for complete customisation of lists.

"mdwlist.sty" file not found


GIT: "fatal: unable to write new_index file" while commit

Question: When I try to commit changes to local repo, I have got following message:
    fatal: unable to write new_index file
Answer: As this thread illustrates, this is usually a disk space issue:
$ git status
fatal: unable to write new_index file

One cause of this that I found was that my file system had run out of space.
  Finding large directories with something like the following helped clean up some log files that had run wild :

$ du -h / | grep ^[0-9.]*G

Note: you can also see it for

a resource issue with msysgit and Egit (Git for Eclipse):

Problem still remained so I ran File Monitor from Sysinternals Suite.
  It seems that Eclipse is accessing index file constantly and blocks command line git

for a classic anti-virus issue:

Yeah, looks like Windows Defender strikes again. I always forget to disable that damn thing. I can't believe how broken it is. Destroys Blu-ray playback at home, breaks Git at work...
Comment: +1 for the Windows Defender portion! http://windows.microsoft.com/en-US/windows-vista/Turn-Windows-Defender-on-or-off did the trick
Comment: also you can change the permissions (in windows) on the .git folder by uncheking the read-only
Comment: That's why AV like MSE lets you select folders not to monitor.
Answer: If you are using TortoiseGit, this error (or more recently: error: Unable to write index.) is very likely caused by having TortoiseGit icon overlays enabled. To disable icon overlays, go to:
TortoiseGit > Settings > Icon Overlays
and set Status cache to None. This may be fixed in a future version of TortoiseGit, but for now it seems to be common.
Comment: This was the cause of the issue for me. Thanks much.
Comment: This was the cause in my case too. Thanks for posting this answer.
Comment: Yup, this was it for me - sort of. I had to actually kill the `TGitCache.exe` process, but that did the trick.
Answer: I was getting the same error while I was merging a git repo that was sshfs mounted. There was no shortage of space anywhere.
In my case the solution was to add an -o workaround=rename option to the sshfs mount command.
Like so:
sshfs -o idmap=user -o uid=[lokal uid] -o gid=[lokal gid] -o workaround=rename [host]: [mountpoint]
Answer: I had same problem. In my case above solutions didn't work.
The reason behind this error is that the file .git/index was corrupted for some unknown reason. I just renamed the file to something else and run the  'git add .' command from git bash and it worked.
Hope this helps someone.
Comment: This did the trick for me.  But instead of running `git add .`, I ran `git reset`, which re-generated the index file without unnecessarily adding all changes everything to the staging area.  I had SourceTree opened to the repo over an SSHFS mount while simultaneously interacting with it via the terminal; something there may have caused the file to get corrupted.
Answer: I have found solution. Just need to free some disk space.
Comment: I was writing the same thing;)
Answer: For me it was a file locking issue.
To solve it I:

Copied the index file (located in the hidden ".git" folder)
Deleted the original
Renamed the copy back to 'index'

Hope this helps!
Answer: I have followed every solution here and none of them worked. I have no shortage of disk space, I have disabled Windows Defender, disabled icon overlays and whatnot. I had tons of files to import and maybe this was causing the problem (I had boost libraries among other things).
I simply opened "Git Bash" and issued a number of git add and a git commit and all went well. This has something to do with TortoiseGit but I am not sure what. It seems to choke on a large number of files or large directory depth.
Answer: I got this error using Cygwin and git-svn. The solution that worked for me was to do garbage collection (odd as it seemed at the time):

$ git gc
Answer: I was having this issue, but I was able to commit with msysgit.  I updated tortoisegit, and also noticed that my msysgit version was not in sync with tortoise git.  I'm not sure if the latest version fixed it, or if it was due to having different versions of tortoise and msysgit.  Anyway, another thing to check.  It all started working after updating them both to
TortoiseGit 22.214.171.124
git version 1.7.10.msysgit.1
Answer: I had the same problem on macOS, I have solved it by removing repo_folder/.git/index.lock
Answer: I used Unlocker on .git\index.lock to unlock any handles that are held open by other processes.  In my case it was TGitCache.exe.
Answer: I'm using git in Windows 10, and this issue was resolved for me by clearing the system's temp directory.
As most replies here suggest, it's a disk-space related problem.


Omni-Channel Lead Transfer Event

Question: How can I capture the Omni-Channel 'Transfer' event? We need to do some custom post-processing or pre-processing when a Lead is transferred to another agent.
Answer: To capture the Transfer event, you have to write trigger on AgetWork and you have to check for status field. Status field value change in following ways.
If a work item is assigned to agent and it is in new item then status field will be Assigned.
If a work item is accepted by agent and then status will be opened.
If a work item is transferred by agent and then agent work status will be transfer.
Please go through the below link for more information on agent work object.
[https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_objects_agentwork.htm][1]

Omni-Channel Lead Transfer Event


Cannot link Arduino project to include Simulink Code

Question: At work, I recently took training on MATLAB/Simulink, including the Simulink Coder that can generate C code for embedded applications. I wanted to try my hand at it, so I bought an Arduino, and dove in. I am able to write simple sketches with no problem, but have been hitting a brick wall when trying to integrate the code generated by Simulink.
I initially used the Arduino IDE, then Eclipse with the Arduino plug-in, and finally Xcode with the embedXcode templates. (My work machine with Simulink is a PC, but I'm not allowed to install "unauthorized software", so I did the rest on my home Mac.) All three use the same avr-gcc compiler.
All three had the same point of failure: "Undefined Reference" errors on the generated function calls. I believe this to be a linker issue rather than basic syntax or header inclusion, as the Eclipse and Xcode code-completion are working OK, and if I change the call signature in any way, the error changes. I can make references to the data structures OK.
As far as I can tell, the default makefiles are set up to compile and link any files within the folder. A "mass_model2.o" file is being created, at least with Xcode. Finally, if I manually write a separate "myFunction.c" and "MyFunction.h" file with a simple function call, this does compile and run on the device as expected.
In desparation, I copied the entire contents of the generated ".c" file, and pasted them in the main sketch file after my setup() and loop() functions, keeping the same ".h" references, and removed the ".c" file from the project. This actually did compile and run! However, I should not have to touch the generated code in order to use it.
What do I need to do to get this to compile and link properly?
The Simulink code is quite verbose, so here are the key parts:
mass_model2.h excerpts:
#include "rtwtypes.h"
#include "mass_model2_types.h"

/* External inputs (root inport signals with auto storage) */
typedef struct {
  int16_T PotPos;                      /* '<Root>/PotPos' */
} ExternalInputs_mass_model2;

/* External outputs (root outports fed by signals with auto storage) */
typedef struct {
  int16_T ServoCmd;                    /* '<Root>/ServoCmd' */
} ExternalOutputs_mass_model2;

/* External inputs (root inport signals with auto storage) */
extern ExternalInputs_mass_model2 mass_model2_U;

/* External outputs (root outports fed by signals with auto storage) */
extern ExternalOutputs_mass_model2 mass_model2_Y;

/* Model entry point functions */
extern void mass_model2_initialize(void);
extern void mass_model2_step(void);

mass_model2.c excerpts:
#include "mass_model2.h"
#include "mass_model2_private.h"

/* External inputs (root inport signals with auto storage) */
ExternalInputs_mass_model2 mass_model2_U;

/* External outputs (root outports fed by signals with auto storage) */
ExternalOutputs_mass_model2 mass_model2_Y;

/* Model step function */
void mass_model2_step(void)
{
    // lots of generated code here
}

/* Model initialize function */
void mass_model2_initialize(void)
{
    // generated code here
}

The other referenced headers, "rtwtypes.h" and "mass_model2_private.h" define specific types that are used by the generated code, like int16_T. These files are included in the project, and I do not receive any errors associated with them.
In my sketch file, the setup() function calls mass_model2_initialize(). loop() reads my input (a potentiometer), sets the value in mass_model2_U.PotPos, and calls mass_model2_step(). It then gets mass_model2_Y.ServoCmd and writes the value to a servo for output, and finally has a delay().
Answer: You can use this download, http://www.mathworks.com/matlabcentral/fileexchange/24675, with Simulink, Simulink Coder and Embedded Coder. Make sure you have the correct version numbers of each tool.
Comment: It looks like I should be using this version, since I am using R2012a: http://www.mathworks.com/matlabcentral/fileexchange/35639. I'm giving this an upvote since it *should* work, although I am unable to install it at this time. (I've sumbitted a question to Mathworks on that page...) Information I had seen about the direct support indicatied that I/O support was limited and did not include Servo drive; this version appears to.
Answer: The #include "Arduino.h" statement is required on the main sketch.


Why does iPhone and iPad apps have a Free version and a full version, instead of "unlocking" it through in-app purchase?

Question: Many apps have a Free version and a Full version.  How is it compared to, installing a single version, and use an in-app purchase of $0.99 or $1.99 to unlock to the program to make it a full version?  It does have the advantage that the user doesn't have to go to the App Store and install the program one more time and thus making it easier for the users to purchase.
Comment: The "in-app payment" option was only recently enabled.  Free-Full versions was the only option before that.
Comment: To further on Thorbjørn's comment, prior to "in-app payments", the only way Apple could get their cut was if you bought/upgraded from the app store. If developers set aside third-party method to upgrade to the "full version", Apple couldn't get their share of the purchase. I saw this used in for a number of apps a few years ago to bypass having to pay Apple 30% (or whatever their cut is).
Comment: so nowadays, the in-app purchase is like an app purchase -- that Apple will take 30% as well?
Answer:
One thing I don't understand is, many apps have a Free version and a Full version.

Some do, some don't. There's not one specific reason, like "the app store guidelines say you have to do it this way." There are several reasons, including but not limited to:

Setting up and administering in-app purchase can be a bit complicated and an ongoing hassle, especially compared to just selling something through the app store.
Building two versions of an app from a common code base may be simpler than building one version that dynamically switches from "free" mode to "paid" mode.
Having two apps in the app store gets you a little more exposure than just having one. Your apps can be listed in both the "free" and "paid" categories, and searches that find your app will often display both versions.
It may be advantageous to have two different bundle identifiers in some cases.
Comment: +1 for "Having two apps in the app store gets you a little more exposure than just having one. Your apps can be listed in both the "free" and "paid" categories, and searches that find your app will often display both versions."
Answer: One obvious answer: if the full version isn't included in the free version, no one can gain unpaid access to the full version by cracking the free version.
Comment: I thought about that too, but I thought that if the person is using jailbroken version or downloadable version, he can get the full version illegally anyway
Comment: @動靜能量- I would imagine most developers that have a free and paid version are doing it as a cheap way to implement a trial period within their application.  It is far easier as a developer to simply comment out code, then it is is to worry about trying to implement in-game upgrades, plus like other suggested additional exposer is good.
Comment: ^ What Mason said.  I'd add that when you require a new download, you let Apple worry about all the upgrade transaction/security details with the extra download and you don't have to inside your app at all.
Answer: Some of these apps may have been created before Apple allowed in-app purchases, and the developers don't want to orphan existing users by removing the old paid version from the store.  In-app purchasing also requires the use of a few more APIs and lines of code that some developers may not want to or know how to add.  The use of the IAP API can also increase the number of test scenarios needed, and thus test and QA time and/or cost.
Answer: if you look at ratings and comments for apps that require in-app purchase to get the complete functionality people often regard it as a ripp-off. why? because people are moving fast and do not read. so they see a free app, read the feature list and download it only to discover later that most features have to be enabled via in-app purchase. of you provide both, free and full version, you have two possibilities to explain it in the app store. and just by adding "free" or "light" to your app name you make it obvious that there are 2 versions with different functionalities. you cannot do this with in-app purchase. in-app purchase is only good for adding new functionality and features, not for unlocking the basic functionality.


Underlying utility function behind a linear two-product demand curve

Question: I am trying to find the underlying utility function behind a linear two-product demand model. For that, I use two methods considering the following utility function:
\begin{equation}
U(q_1,q_2) = \alpha_1q_1 + \alpha_2q_2  - \frac{1}{2}(q_1^2+q_2^2+2\epsilon q_1 q_2).
\end{equation}
First, I do utility maximization without explicitly considering the budget constraint. Second, I do the maximization with explicitly stating the budget constraint. The former method gives me linear demand functions, whereas the latter does not. I am not sure why there is this difference. More specifically,
I first solve the utility maximization problem as:
\begin{equation}
\max_{q_1,q_2} \alpha_1q_1 + \alpha_2q_2  - \frac{1}{2}(q_1^2+q_2^2+2\epsilon q_1 q_2) - p_1 q_1 - p_2q_2
\end{equation}
Then, the optimal solution is given as
\begin{align*}
q_1 (p_1,p_2) &= \frac{\alpha_1 - \epsilon\alpha_2 -p_1 +\epsilon p_2}{1-\epsilon^2} \\
q_2 (p_1,p_2) &= \frac{\alpha_2 - \epsilon\alpha_1 -p_2 +\epsilon p_1}{1-\epsilon^2}
\end{align*}
Both of these demand functions are linear in prices $p_1$ and $p_2$, which is what I am looking for. However, when I consider a budget constraint, that is when I consider a constrained maximization problem of the following form:
\begin{align*}
\max_{q_1,q_2} & \alpha_1q_1 + \alpha_2q_2  - \frac{1}{2}(q_1^2+q_2^2+2\epsilon q_1 q_2)  \\
\text{s.t. }&   p_1 q_1 + p_2q_2 \le m,
\end{align*}
I obtain the following two demand functions:
\begin{align*}
q_1 (p_1,p_2;m) &= \frac{mp_1 + \alpha_1 p_2^2 - \alpha_2 p_1 p_2 - \epsilon m p_2}{p_1^2-2\epsilon p_1 p_2 + p_2^2} \\
q_2 (p_1,p_2;m) &= \frac{mp_2 + \alpha_2 p_1^2 - \alpha_1 p_1 p_2 - \epsilon m p_1}{p_1^2-2\epsilon p_1 p_2 + p_2^2}
\end{align*}
The problem is that these demand functions are not linear. How should I interpret this discrepancy?
Comment: My guess is that in the second case you automatically assumed the budget constraint is binding, but that in fact depends on the value of $m$.
Comment: In the first case you changed your utility function. It is not permitted.
Answer: Hint: First, start off with the constrained maximization problem and then use the Lagrangian method to get the first-order conditions. Then use the Kuhn-Tucker method (see Mathematics for Economist by Simon and Blume) to solve for your optimal demands.
The consumer solves the following maximization problem:
\begin{align*}
\max_{q_1,q_2} \alpha_1q_1 + \alpha_2q_2  - \frac{1}{2}(q_1^2+q_2^2+2\epsilon q_1 q_2)  \\
\text{s.t. }  p_1 q_1 + p_2q_2 \le m.
\end{align*}
The Lagrangian associated with maximization problem is
\begin{equation*}
  \mathcal{L} = \alpha_1q_1 + \alpha_2q_2  - \frac{1}{2}(q_1^2+q_2^2+2\epsilon q_1 q_2) + \lambda[m - p_1 q_1 - p_2q_2]
\end{equation*}
Then take the derivatives of $\mathcal{L}$ wrt to $q_{1}$, $q_{2}$, and $\lambda$ to get the following first-order conditions:
\begin{equation}
 \frac{\partial \mathcal{L}}{\partial q_{1}}=\alpha_{1}-q_{1}+\epsilon q_{2} -\lambda p_{1} =0
\end{equation}
\begin{equation}
 \frac{\partial \mathcal{L}}{\partial q_{2}}=\alpha_{2}-q_{2}+\epsilon q_{1} -\lambda p_{2}=0
\end{equation}
\begin{equation}
   \frac{\partial \mathcal{L}}{\partial \lambda}=m-p_{1}q_{1}-p_{2}q_{2}\geq0
\end{equation}
Then we use the Kuhn-Tucker method:
$\lambda[m-p_{1}q_{1}-p_{2}q_{2}] = 0$ is the complementary slackness condition on $\lambda$
and
$\lambda\geq0$ is the non-negativity constraint on $\lambda$.
We can have two cases: either $\lambda>0$ or $\lambda=0$. I show what happens for $\lambda>0$ and then you can check what happens for $\lambda=0$.
If $\lambda>0$ then $m-p_{1}q_{1}-p_{2}q_{2}=0$ by the complementary slackness condition. In other words, this is the case where the budget constraint is binding, that is, $m=p_{1}q_{1}-p_{2}q_{2}$. Then we check whether the first-order conditions and the non-negativity condition hold.
After doing so we are left with the following set of equations:
\begin{equation}
 \frac{\partial \mathcal{L}}{\partial q_{1}}=\alpha_{1}-q_{1}+\epsilon q_{2} -\lambda p_{1} =0
\end{equation}
\begin{equation}
 \frac{\partial \mathcal{L}}{\partial q_{2}}=\alpha_{2}-q_{2}+\epsilon q_{1} -\lambda p_{2}=0
\end{equation}
\begin{equation}
   m-p_{1}q_{1}-m_{2}q_{2}=0
\end{equation}
Then substitute away $\lambda$ from the first two equations and solve for $q_{1}$ and $q_{2}$ using the binding budget constraint.
Edit: For the unconstrained problem you have no budget constraint so your set up is conceptually wrong. The way you get an unconstrained problem from a constrained problem is that you substitute away your budget constraint in the utility function. Also I haven't imposed non-negative conditions on $q_{1}$ and $q_{2}$, as then the process would be quite tedious.
Comment: I see your point and you are right... After some more research, I found out how people derive the underlying utility function behind a linear demand curve. They define an outside good $m$ that can be bought with the extra money left from the budget constraint. In this case, the constraint optimization problem becomes: $\max_{q_1,q_2} = m + \alpha_1 q_1 + \alpha_2 q_2 - \frac{1}{2}(q_{1}^{2} + q_{2}^{2} + 2\epsilon q_1 q_2)$ s.t. $m+p_1q_1+p_2q_2 \le I$. In this case, the optimal demands as functions of $p_1$ and $p_2$ are linear. See, for example, ...
Comment: the working paper by Stephen Martin titled as "Microfoundations for the Linear Demand Product Differentiation Model, with Applications" available at https://www.krannert.purdue.edu/programs/phd/working-papers-series/2009/1221.pdf
Comment: Thanks a lot for your answer... I have solved the KKT conditions that you posted and they actually give the same answers to my case above, i.e., $q_1 (p_1,p_2) = \frac{m*p_1+\alpha_1*p_2^2-\alpha_2*p_1*p_2+\epsilon*m*p_2}{p_1^2+2*\epsilon*p_1*p_2 + p_2^2}$. So, I am not sure why  "[my] set up is wrong for the constrained problem as well.". In essence, these type of budget constraints will always be tight, right? So, can't we just incorporate them to the objective function? The problem with this result is that it is not linear in $p_1$ and $p_2$ ... Thanks a lot!
Comment: @safak Sorry I meant to say that the set up for the unconstrained problem is conceptually wrong without inclusion of the Budget Constraint. A BC should be included in an optimization problem. Then you can substitute away your BC with one quantity to make your optimization problem an unconstrained problem. But you didn't have a BC in Method 1 so obviously you'll have a different answer. So the difference is that you didn't include a BC for Method 1 and you did for Method 2. Also you can upvote and accept my answer if you found it helpful, as it is the community standard.
Answer: in the first case you implicitly assumed that your utility function is of the quasi-linear type, i.e. there is a fully specified utility function u(q1,q2,y) = U(q1,q2) + y (using your notation for utility over goods and where "y" is the numeraire good or just money). There is nothing wrong with this, and this is actually done in most of Industrial Organization when cross-effects between markets are neglected. If you formulate your problem using this fully specified utility function AND a budget constraint, you end up solving the problem you wrote down in the text.
The second approach you have is also correct -- but you are using a different utility function (and therefore get different results).